1631124 - osclientcerts: look for intermediate client certificates to help PSM with path building (windows)

Status: RESOLVED FIXED

(Core :: Security: PSM, defect, P1)

Description

[samlh]

Attachment: example chain.crt

+++ This bug was initially created as a clone of Bug #1630473 +++

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:75.0) Gecko/20100101 Firefox/75.0

Even with the fix from bug 1639473, some client certificates are shown in the list unless the intermediate is added into Firefox

See attachment for the client certificate and chain

Comment 1

[Dana Keeler (she/her) [:keeler]]

Thanks - let's first land bug 1630473.

Comment 2

[Dana Keeler (she/her) [:keeler]]

If you set security.osclientcerts.autoload and security.enterprise_roots.enabled to true with the latest version of Nightly, are you still seeing this behavior?

Comment 3

[samlh]

Attachment: about:support

Comment 4

[samlh]

Hi Dana!

Yes, I am still seeing this behavior on Nightly 20200424114754.

If I do not import any intermediates, I have 1 client certificate show up in the list.

If I import the corresponding intermediates for the other 2 client certificates (one attached), the client certificates also shows up in the list.

Possible correlation:

• The certificate that shows up in the list as-is has an exportable private key
• The certificates that do not show up in the list do not have exportable private keys (due to being on a smart card or similar)

If there is logging I can enable or instructions for what to check in a debugger, I'm happy to give it a try.

Thanks,
Sam

Comment 5

[Dana Keeler (she/her) [:keeler]]

If you set the environment variable RUST_LOG to osclientcerts_static it should output some debugging information to the console (here's how to run Firefox with a console: https://developer.mozilla.org/en-US/docs/Mozilla/Command_Line_Options#Miscellaneous)

Comment 6

[samlh]

Attachment: RUST_LOG=osclientcerts_static open firefox and close again.txt

Comment 7

[samlh]

Attachment: RUST_LOG=osclientcerts_static open firefox and close again with intermediate added.txt

Comment 8

[samlh]

Attachment: RUST_LOG=osclientcerts_static open firefox, try logging in, and close again.txt

Comment 9

[samlh]

Attachment: RUST_LOG=osclientcerts_static open firefox, successfully log in, and close again with intermediate added.txt

Comment 10

[Dana Keeler (she/her) [:keeler]]

Thanks! It looks like the module is finding 4 client certificates. Can you do that again with MOZ_LOG set to pipnss:4? (no need for the testcases where you don't visit the server)
Also, to be clear, when you said "If I do not import any intermediates" did you mean importing via the certificate manager or by setting security.enterprise_roots.enabled?

Comment 11

[samlh]

Attachment: MOZ_LOG=pipnss4 RUST_LOG=osclientcerts_static open firefox, try logging in, and close again.txt

Thanks! It looks like the module is finding 4 client certificates. Can you do that again with MOZ_LOG set to pipnss:4? (no need for the testcases where you don't visit the server)

Logs attached.

Also, to be clear, when you said "If I do not import any intermediates" did you mean importing via the certificate manager or by setting security.enterprise_roots.enabled?

Importing via about:preferences#privacy -> Certificate Manager.
All logs are with security.enterprise_roots.enabled=true and security.osclientcerts.autoload=true

Thanks for taking a look!

Comment 12

[samlh]

Attachment: MOZ_LOG=pipnss4 RUST_LOG=osclientcerts_static open firefox, successfully log in, and close again with intermediate added.txt

Comment 13

[samlh]

Attachment: intermediates imported (foo.p7b)

Comment 14

[samlh]

Attachment: Powershell "Get-ChildItem -path cert:\CurrentUser\My | Format-List *"

It looks like the module is finding 4 client certificates.

Yes. See the attached list of certs.

The one I want to use is #2 in the attached list.
(SerialNumber: 5D00347B941897D81CCCF1B545000000347B94)

The only one that shows up is #4.
(SerialNumber: 7F53F612C9576F51C9FCF462AF06E243)

Comment 15

[samlh]

The only one that shows up is #4.
(SerialNumber: 7F53F612C9576F51C9FCF462AF06E243)

Argh, sorry, that should be #3 (48:00:70:5C:69:3C:2E:86:02:55:52:71:10:00:01:00:70:5C:69)

Comment 16

[Dana Keeler (she/her) [:keeler]]

Attachment: Bug 1631124 - osclientcerts: attempt to find issuing certificates when looking for client certificates (Windows) r?kjacobs,mhowell

To implement filtering client certificates by the acceptable CAs list sent by
servers when they request client certificates, we need the CAs that issued the
client certificates. To that end, this change modifies the Windows backend of
the osclientcerts module to also gather issuing CAs while looking for client
certificates. These certificates will not affect trust decisions in gecko.

Comment 17

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/38e08f6e791c
osclientcerts: attempt to find issuing certificates when looking for client certificates (Windows) r=kjacobs,mhowell

Comment 18

[Andreea Pavel [:apavel]]

https://hg.mozilla.org/mozilla-central/rev/38e08f6e791c

Comment 19

[Dana Keeler (she/her) [:keeler]]

Does the latest build of Nightly work for you?

Comment 20

[samlh]

Yes, everything works perfectly on latest nightly.

Thank you - I really appreciate it!

Comment 21

[Dana Keeler (she/her) [:keeler]]

Thanks!