1310959 - add user interface for hpkp (http public key pinning)

Status: RESOLVED WONTFIX

(Firefox :: Security, enhancement, P3)

Description

[keynet]

User Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:49.0) Gecko/20100101 Firefox/49.0
Build ID: 20160922113459

Steps to reproduce:

Updated a website certificate using a NEW private key, which means a new HSTS pin required.



Actual results:

Website updated OK
Firefox fails with MOZILLA_PKIX_ERROR_KEY_PINNING_FAILURE
But Chrome works OK


Expected results:

Firefox should have option to delete out of date pin, and restart the pin learning process. At the moment there seems to be no UI (not in history etc) to do this in any reasonable way. It's quite likely that a new cert will involve a new private key (if you're being secure, that is). Timeouts are typically long.

In the end I had to mess about and manually edit SiteSecurityServiceState.txt to remove the old record per this
https://linux-audit.com/deleting-outdated-hpkp-key-pins-in-firefox/

Then it was OK!

Comment 1

[Dana Keeler (she/her) (use needinfo) [:keeler]]

The issue is that there's no user-friendly way to modify collected hpkp state in the browser. We could build some ui for this.

Comment 2

[keynet]

A couple more  points:
- Current Apple Safari like Chrome handles this correctly (without user intervention)
- I think the reported error is actually wrong.
"The server uses key pinning (HPKP) but no trusted certificate chain could be constructed that matches the pinset."
This is not true. There is a valid certificate chain, it's just that the browser is not using the current pin, it's sticking to the older one, and not replacing it with the current one. Fix this, and you don't need a UI to handle the situation.

Comment 3

[YF (Yang)]

(In reply to keynet from comment #0)
> Actual results:
> 
> Website updated OK
> Firefox fails with MOZILLA_PKIX_ERROR_KEY_PINNING_FAILURE

I think it's right.

> But Chrome works OK

Maybe you did not reload this page to bypass the cache? I see this situation through use the https://chrome.google.com/webstore/detail/pinpatrol/jenmooahjheolakpacikdlloalfaihef/ and distort the dynamic_spki_hashes to simulate it. Chrome also provides an error page, default report the invalid cases (Firefox does it but not by default), and does not allow it to be overwritten.


> Expected results:
> 
> Firefox should have option to delete out of date pin, and restart the pin
> learning process. At the moment there seems to be no UI (not in history etc)
> to do this in any reasonable way. It's quite likely that a new cert will
> involve a new private key (if you're being secure, that is). Timeouts are
> typically long.

I think it will violate the HPKP / HSTS rules and increase the user's risk for misuse.

> In the end I had to mess about and manually edit
> SiteSecurityServiceState.txt to remove the old record per this
> https://linux-audit.com/deleting-outdated-hpkp-key-pins-in-firefox/
> 
> Then it was OK!

https://addons.mozilla.org/firefox/addon/enforce-encryption/ and future add-ons that works like the PinPatrol for Chrome.

I don't think it is a necessary UI for general user, because it is a security sensitive and rare demand.

Comment 4

[Christian Stadelmann]

I think this can be closed because HPKP has been removed from Firefox, see bug #1412438.

Comment 5

[Wayne Mery (:wsmwk)]

(In reply to Christian Stadelmann from comment #4)

I think this can be closed because HPKP has been removed from Firefox, see bug #1412438.

Plus bug 1630038