1442880 - Downloading a certificate from a website triggers the auto import cert , this window is like it has an old file with the same name in cache.

Status: RESOLVED INCOMPLETE

(Core :: Security: PSM, defect)

Description

[jose.mgavillan]

User Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 11_3 like Mac OS X) AppleWebKit/604.1.34 (KHTML, like Gecko) GSA/43.0.185608249 Mobile/15E5167f Safari/604.1

Steps to reproduce:

Our website generates our CA cert, but the CA file has the same name. When a user generates a new CA and downloads it Firefox seems to use a cache file since the new generated CA has the same name. We did a right click to force a Download and the correct file was loaded but when we did a certificate import it still use its own cache file.


Actual results:

The imported CA is the old certificate


Expected results:

The new CA should have been imported to the certificate

Comment 1

[:Gijs (he/him)]

Not a bug that needs to stay hidden.

For this bug to be actionable, I expect you'd need to at least clarify what your cache headers on the certificate file are.

Comment 2

[jose.mgavillan]

How can I verify that?

Comment 3

[:Gijs (he/him)]

(In reply to jose.mgavillan from comment #2)
> How can I verify that?

Uh, request the file in question before/after it changes, with cURL or a similar tool (or with the browser, but use the network monitor in the browser toolbox ( https://developer.mozilla.org/en-US/docs/Tools/Browser_Toolbox )) and check the headers? https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Cache-Control and https://developer.mozilla.org/en-US/docs/Web/HTTP/Caching may further be helpful here.

Comment 4

[Dana Keeler (she/her) [:keeler]]

I believe the "cache" in question is actually the certificate database. You can probably find the old CA certificate in about:preferences -> search for "certificates" -> "View Certificates" -> "Authorities". If you delete the old certificate and restart Firefox, you should be able to import the new one.

To prevent this happening in the future, you should ensure that all certificates are unique in terms of the pair (issuer name, serial number). That is, no two certificates should have the same issuer names and serial numbers if they're actually different certificates.