1317842 - After upgrade CA certificates disappeared and cannot be imported

Status: RESOLVED INCOMPLETE

(Core :: Security: PSM, defect)

Description

[Andrzej]

User Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:49.0) Gecko/20100101 Firefox/49.0
Build ID: 20161025164528

Steps to reproduce:

Upgraded FF to 49.0.2 on Windows 7 64b. Previously had several custom (corporate) CA certificates imported and they worked fine.


Actual results:

After upgrade all custom CA certificates have disappeared. Re-importing them did not work (the imported CA certificate did not show up on the list). After downgrading FF to v48 I could re-import missing CA certificates successfully.


Expected results:

Certificates should not have disappeared. Importing certificates should work.

Comment 1

[Dana Keeler (she/her) [:keeler]]

To diagnose this, we'll need some more information. Here are some steps you can take that might help:

1. Does this still happen if you create a new profile?
2. Does this happen with other CA certificates? (e.g. http://www.cacert.org/certs/root.crt )
3. Can you attach one of the problematic certificates to this bug?
4. Even though the imported CA certificates aren't visible, can you still connect to sites that use them?

Thanks!

Comment 2

[Andrzej]

Thanks, I will check that tomorrow at work. Unfortunately I won't be able to attach our corporate certificates.

I tried several different certificates exported from IE in two different formats. They all work in versions <=48 and fail in 49.0.2.

Today I tried the same thing again (48.0.2->49.0.2->48.0.2) and noticed that after downgrading back to 48 the previously imported certificates were still on the list. So 49.0.2 doesn't remove the certificates, just ignores them.

Comment 3

[Andrzej]

1. Yes.
2. Yes.
3. No.
4. No.

More informations: the problem persists in 50.0. Downgrading to 48 doesn't fix it anymore, even clean installation of v.48 (after removing the profile) is affected.

I can see the the following error in Browser Console (v.48.0) after attempting to import the certificate:
NS_ERROR_FAILURE: Component returned failure code: 0x80004005 (NS_ERROR_FAILURE) [nsIX509CertDB.importCertsFromFile] certManager.js:492 (in addCACerts()).

Comment 4

[Dana Keeler (she/her) [:keeler]]

I'm assuming version 47 works? If so, bug 1250258 modified that code around that time, so it could be due to a change made then. Unfortunately, without a certificate where I can reproduce the problem, it will be hard to debug this. You could try running with the environment variable "MOZ_LOG" set to "pipnss:4" - the output from that might be helpful.

Comment 5

[Andrzej]

Initially the issue was triggered by upgrading to 49.0.2 and fixed by downgrading to 48.0. However, now all versions I tried (47.0, 48.0, 49.0.2, 50.0) are affected with exactly the same symptoms (error message in the console, certificate not added, previously imported CA certificates not listed).

As I mentioned, the CA Cert certificate linked above is affected too (cannot be added), so the issue is not specific to our certificates.

I tried to enable logging the way described above but it didn't produce any additional information on STDERR, browser console, and (with MOZ_LOG_FILE) the log file wasn't created.

Comment 6

[Dana Keeler (she/her) [:keeler]]

Hmmm - strange that the logging didn't produce any output. Maybe the information in https://developer.mozilla.org/en-US/docs/Mozilla/Debugging/HTTP_logging will be helpful?

Comment 7

[Dana Keeler (she/her) [:keeler]]

Any updates here?