Self-signed client certificates are no longer offered to choose in Firefox 71 - they were in Firefox 70
Categories
(Core :: Security: PSM, defect)
Tracking
()
People
(Reporter: juergen, Unassigned)
Details
Attachments
(4 files)
User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:71.0) Gecko/20100101 Firefox/71.0
Steps to reproduce:
Create a self-signed client certificate with key length 4096 bits, SHA256 signature, and an expiration date in the future. Load the certificate into the certificate store of Firefox 70 or 71 (Windows 10). Access a web-site that will not offer hints as to which certificate authorities are valid, but will accept the certificate I have just generated because it is permitted. This is actually an NGINX using ssl_trusted_certificate instead of the ssl_client_certificate directive. Something changed in the interpretation of certificates between Firefox 70 and 71. A downgrade to Firefox 70 returned everything to normal. After an upgrade to Firefox 71, the wrong behaviour is restored.
Actual results:
Under Firefox 70, the list of certificates offered to authenticate will include the self-signed certificate. Under Firefox 71, it will not. In fact, when I go into the certificate viewer, Firefox 71 claims the certificate is invalid or broken, while Firefox 70 is able to properly display it.
Expected results:
The available certificates should be offered for authentication.
|
||
Updated•4 years ago
|
Can you share an example certificate that doesn't work in 71? Thanks!
I have attached four files: pkcs12, pem, key and the certificate info in clear text.
These are throwaway certificates of the sort I use. The key is without a password.
You may import the pkcs12 into Firefox and place the .pem file in a web server as a trusted client certificate.
This certificate works in Firefox 70, it is declared broken in Firefox 71. In consequence, I guess, Firefox does not care to offer me this certificate when I am expected to present one to a web site. Therefore, I believe the core problem to be in the certificate store or the way certificates are read from there. Re-importing does not help.
Thanks! Did this work in earlier versions (before 70)?
Same Problem here. We are using self-signed client certificates for our customers to access our servers. Some customers updated to Version 71 and now they cannot access the servers anymore. Firefox behaves like there are no client certificates installed.
With Version 70.0.1 everything worked fine. I tested from my machine with version 68.3.0 and it worked as expected. After upgrading to Version 71 I got the same behavior as our customers.
Addition:
The client certificates are not marked as broken in my case. We are using p12-files as client certificate.
We are using this approach since many years and had no problems. Other Browsers like Chrome or Edge are still working as expected.
|
Reporter | |
Comment 11•4 years ago
|
||
(In reply to Dana Keeler (she/her) (use needinfo) (:keeler for reviews) from comment #7)
Thanks! Did this work in earlier versions (before 70)?
Yes this worked in versions before 70 and in version 70. Something broke in version 71.
Description
•