1642789 - Ensure PEM file is stripped of all data before import

Status: RESOLVED FIXED

(Firefox :: Enterprise Policies, defect, P5)

Description

[ericj]

User Agent: Mozilla/5.0 (X11; Linux x86_64; rv:77.0) Gecko/20100101 Firefox/77.0

Steps to reproduce:

Firefox 77.0 on openSUSE 15.1:

Update policies.json to automatically install/trust my CA certificate.
"Certificates": {
"Install": ["/path/to/my/certificates/myca.pem"]
}

Verified the certificate file is valid via: openssl x509 -in /path/to/my/certificates/myca.pem -text -noout

Actual results:

about:policies shows the following Policy Error:
Unable to add certificate - /path/to/my/certificates/myca.pem

Browser console shows:
Policies.jsm: Unable to add certificate - /path/to/my/certificates/myca.pem Policies.jsm:284

Expected results:

Firefox should add this CA certificate to its trust store and not show this error.

There is nothing in the documentation on what logging module will help debug this. I tried pipnss:4 but that did not log anything related.

Comment 1

[ericj]

Note that this is not related to updating to 77.0, I have not attempted this policy before this.

Comment 2

[BugBot [:suhaib / :marco/ :calixte]]

Bugbug thinks this bug should belong to this component, but please revert this change in case of error.

Comment 3

[Mike Kaply [:mkaply]]

Would you be willing to send me the pem file?

Does the pem file install properly inside of Firefox?

Comment 4

[ericj]

(In reply to Mike Kaply [:mkaply] from comment #3)

Would you be willing to send me the pem file?

Does the pem file install properly inside of Firefox?

I am unable to send you the pem file, however I can indeed manually install it inside Firefox successfully.

As a test, I also grabbed a Verisign CA certificate from /usr/share/pki/trust/ca-certificates-mozila.trust.p11-kit (this comes with openSUSE 15.1 as part of the OS install). I took the snippet and put it in a PEM file. The Enterprise Policy also failed with the same error.

I also tried converting the PEM to DER format and it also failed the same way.

Comment 5

[ericj]

As a side note, I previously installed my CA cert at Firefox compile time (by adding the block to security/nss/lib/ckfw/builtins/certdata.txt). That block was generated using the addbuiltin tool (part of the nss tools) but that seemed to break with Firefox 77.0 (compile fails). It is probable that I need to recreate that block with a newer version of nss (3.52.1 it looks like FFOX 77.0 uses). I am working on that now but having issues getting nss to compile.

Comment 6

[Mike Kaply [:mkaply]]

Unfortunately I don't print out a good error in this case and there's no easy way to give you code that can do this.

dkeeler: Do you have a logging suggestion so we can see the error coming from constructX509 or constructX509FromBase64?

I'll update the policy to show the full errors in these cases.

Comment 7

[Dana Keeler (she/her) (use needinfo) [:keeler]]

Unfortunately those functions don't log anything. We could add some or change the return values to depend on the NSS error that gets encountered.

Comment 8

[ericj]

I still have not been able to get a PEM certificate installed via Enterprise Policies, and when I attempted to install a DER certificate, I converted it via:
openssl x509 -inform PEM -outform DER -text -in myca.pem -out myca.der

Using this DER certificate also failed to load.

However, I re-converted the DER certificate without the -text via:
openssl x509 -outform der -in myca.pem -out myca.der

And it was successfully installed via Enterprise Policies.

So the additional text header in that DER file caused it to fail. But it doesn't explain why PEM format does not work.

Comment 9

[Mike Kaply [:mkaply]]

I wonder if the pemToBase64 is doing something weird?

Does it look like this JS would do the right thing on your PEM file?

function pemToBase64(pem) {
return pem
.replace(/-----BEGIN CERTIFICATE-----/, "")
.replace(/-----END CERTIFICATE-----/, "")
.replace(/[\r\n]/g, "");
}

Comment 10

[ericj]

(In reply to Mike Kaply [:mkaply] from comment #9)

I wonder if the pemToBase64 is doing something weird?

Does it look like this JS would do the right thing on your PEM file?

function pemToBase64(pem) {
return pem
.replace(/-----BEGIN CERTIFICATE-----/, "")
.replace(/-----END CERTIFICATE-----/, "")
.replace(/[\r\n]/g, "");
}

I am not proficient in JS. I do have node.js installed so I could run this via terminal (but how to get the pem file in the 'pem' variable?

Comment 11

[Mike Kaply [:mkaply]]

I'll put something together you can run in Firefox. Probably first thing Monday.

Comment 12

[Mike Kaply [:mkaply]]

Would there happen to be nightlies for openSUSE or can you run one of our official builds?

I put a change in to at least give us a slightly better error.

Still working on a way for you to test.

Comment 13

[ericj]

(In reply to Mike Kaply [:mkaply] from comment #12)

Would there happen to be nightlies for openSUSE or can you run one of our official builds?

I put a change in to at least give us a slightly better error.

Still working on a way for you to test.

I downloaded the nightly binary tar and configured the enterprise policy. The error is more verbose now (although I am unable to determine the problem from it still). Attached is the exception from the browser console.

Comment 14

[ericj]

Attachment: cert_error.txt

certificate install error from browser console.

Comment 15

[ericj]

I found the issue. In the PEM file, there were 3 lines of comments before the -----BEGIN CERTIFICATE-----
The comment lines started with #. Even though tools like openssl will only look at the data between:
-----BEGIN CERTIFICATE-----
-----END CERTIFICATE-----
it looks like Firefox does not support that. Now that I removed the comments in the file, the PEM file loads successfully.

Comment 16

[Mike Kaply [:mkaply]]

Interesting. We can fix that.

Thanks for finding this!

Comment 17

[ericj]

(In reply to Mike Kaply [:mkaply] from comment #16)

Interesting. We can fix that.

Thanks for finding this!

Thank you for all your help!

Comment 18

[Mike Kaply [:mkaply]]

Attachment: Bug 1642789 - Remove all excess data from PEM files. r?keeler

Comment 19

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/7b9f4185ccd2
Remove all excess data from PEM files. r=keeler

Comment 20

[Bogdan Tara[:bogdan_tara | bogdant]]

https://hg.mozilla.org/mozilla-central/rev/7b9f4185ccd2

Comment 21

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/comm-central/rev/2fd504523a1b
Port bug 1642789 - Remove all excess data from PEM files. r=darktrojan DONTBUILD

Comment 22

[Mike Kaply [:mkaply]]

Comment on attachment 9155746 [details]
Bug 1642789 - Remove all excess data from PEM files. r?keeler

ESR Uplift Approval Request

• If this is not a sec:{high,crit} bug, please state case for ESR consideration: Policy only
• User impact if declined: Some certificates don't load from policy
• Fix Landed on Version: 79
• Risk to taking this patch: Low
• Why is the change risky/not risky? (and alternatives if risky): Policy only.
• String or UUID changes made by this patch:

Comment 23

[Ryan VanderMeulen [:RyanVM]]

Comment on attachment 9155746 [details]
Bug 1642789 - Remove all excess data from PEM files. r?keeler

Approved for 78.1esr.

Comment 24

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-esr78/rev/51fbdd67be3c

Comment 25

[Rob Lemley [:rjl]]

Thunderbird 78.0:
https://hg.mozilla.org/releases/comm-esr78/rev/9c2fb958a75f