1662607 - Firefox doesn't prompt for client certificate with Mutual TLS

Status: RESOLVED INCOMPLETE

(Core :: Security: PSM, defect)

Description

[Joaquin]

User Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:80.0) Gecko/20100101 Firefox/80.0

Steps to reproduce:

1. Create self-signed certificate/key, server cert/key, client cert/key
2. Convert client cert/key to .p12 format, with password of password

   openssl pkcs12 -export \
   -out laptopuser.p12 \
   -in tls/client.laptopuser.crt \
   -inkey tls/client.laptopuser.key
   

3. Import ca.crt into browser, i.e. Settings -> Privacy and Security -> Security -> Manage Certificates -> Authorities
4. Import client cert laptopuser.p12 into browser, i.e. Preferences -> Prvacy & Security -> View Certificates -> Your Certificates
5. Connect to web services with https://localhost:8080

Have explicit tests, tools, etc. to automate reproducing this:

• https://gist.github.com/darkn3rd/e8276306c3bae9767c49d03a16250002

Actual results:

I am not able to connect to the web service and I am not prompted to use the client certificate.

Expected results:

I would be prompted to select a client certificate when I try to connect to the service requiring Mutual TLS.

This works fine under Chrome with KeyChain stored Root CA and client cert. I can also verify this works with curl when specifying the client certificate from the command line.

Comment 1

[BugBot [:suhaib / :marco/ :calixte]]

Bugbug thinks this bug should belong to this component, but please revert this change in case of error.

Comment 2

[Dana Keeler (she/her) (use needinfo) [:keeler] (on leave)]

Can you attach the client certificate and CA certificate to this bug? Thanks! (no need for the key)

Comment 3

[Joaquin]

Attachment: CA Certificate as requested ca.crt

Comment 4

[Joaquin]

Attachment: client certfiicate client.dgraphuser.crt

Comment 5

[Dana Keeler (she/her) (use needinfo) [:keeler] (on leave)]

Thanks. Can you run Firefox with the environment variable MOZ_LOG set to pipnss:4, try to connect to that site, and attach the output that results from that here?

Comment 6

[Joaquin]

Let me try these things, and follow up before closing.