1472375 - Allow ESR version to accept corporate self-signed certificate

Status: RESOLVED WONTFIX

(Toolkit :: Add-ons Manager, defect)

Description

[u608644]

User Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:60.0) Gecko/20100101 Firefox/60.0
Build ID: 20100101

Steps to reproduce:

1. Install Firefox ESR on company computers.
2. Install company's unsigned add-on[internal use only] (xpi.signature.required = false)
3. After installation, right-clik the add-on and check for update.


Actual results:

addons.update-checker	WARN	Request failed: https://corporate.internal/addon_update.json - [Exception... "Certificate issuer is not built-in."  nsresult: "0x80004004 (NS_ERROR_ABORT)"  location: "JS frame :: resource://gre/modules/CertUtils.jsm :: checkCert :: line 163"  data: no]


Expected results:

We already added https://corporate.internal/'s Root certificate as trust chain, so Firefox never complain when we visit https://corporate.internal/.

I want you to accept https://(self-signed & already trusted) address ad manifest.json - update_url.

Comment 1

[u608644]

"as" manifest.json.

"applications":{..."update_url":"https://corporate.internal/...

Comment 2

[Andrew Swan [:aswan]]

We won't be changing the existing behavior.  In bug 1303183 we intend to move to signed content instead of realying on a pinned certificate for the underlying TLS connection.  In the mean time, you can set the preference extensions.update.requireBuiltInCerts to false to skip that check.