1562656 - security.enterprise.roots not reading Keychain certificates

Status: RESOLVED DUPLICATE of bug 1300420

(Core :: Security: PSM, defect)

Description

[Rob]

Attachment: Screenshot 2019-07-01 at 16.06.30.png

User Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:60.0) Gecko/20100101 Firefox/60.0

Steps to reproduce:

We enable security.enterprise.roots.enabled to true in Firefox 60.7.2 ESR on macOS and navigate to a webpage that is signed by a 3rd party root certificate that is stored in our organisations System Keychain.

Actual results:

The webpage was untrusted and prompted for a user to add an exception if they want to access the webpage

Expected results:

The user should have been taken straight to the webpage with no warning of an untrusted certificates as the root certificate that signed this webpages certificate is stored in the system keychain and is trusted.

Tested in Firefox 67.0.4 (not ESR) and this behaves as expected. i.e the webpage is shown as trusted.

Comment 1

[Rob]

Attachment: Firefox 67.0.4 showing working webpage

Additional screenshot this time showing exactly the same webpage on the same mac using the same profile just with Firefox 67.0.4 instead of 60.7.2 ESR this time.

Rob

Comment 2

[Dana Keeler (she/her) [:keeler]]

This feature didn't ship until 63 for macos, so it's not available in ESR 60. See bug 1300420. ESR 68 is being released in the near future, so it'll be available when you upgrade to it.