1668192 - the Install Certificates group policy doesn't work

Status: RESOLVED FIXED

(Thunderbird :: Security, defect, P2)

Description

[Marek Ludha]

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:78.0) Gecko/20100101 Firefox/78.0

Steps to reproduce:

Created a file c:\root.der containing my own root certificate.
Created the following registry entry:
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Mozilla\Thunderbird\Certificates\Install]
"1"="c:\root.der"
Started Thunderbird.

Actual results:

My certificate didn't appear under Tools -> Options -> Manage Certificates -> Authorities. According to procmon the file was read by Thunderbird.

Expected results:

According to https://github.com/drlellinger/thunderbird-policies#certificates--install this should be a supported way to import CA certificates.

Comment 1

[Magnus Melin [:mkmelin]]

I think we're missing a bunch of adjustments to the Policies.jsm. I'll attach the diff I happen to obtain in another bug, before I forget.

Comment 2

[Magnus Melin [:mkmelin]]

Attachment: Diff of changes in policies

Comment 3

[Wayne Mery (:wsmwk)]

John, you are the assignee on bug 1707210. Are you intended to be the assignee here as well?

Comment 4

[John Bieling (:TbSync)]

I was not aware I was assigned in the other bug, that somehow slipped. So yes, let me do this.

Comment 5

[Geoff Lankow (:darktrojan)]

Need to port bug 1578534 and bug 1603221. I'll do it since I'm already working in the area.

Comment 6

[Geoff Lankow (:darktrojan)]

Attachment: Bug 1668192 - Port bug 1578534 and bug 1603221 - changes to the Certificates enterprise policy. r=john.bieling

Depends on D120577

Comment 7

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/comm-central/rev/3c46cc3b045d
Port bug 1578534 and bug 1603221 - changes to the Certificates enterprise policy. r=john.bieling

Comment 8

[John Bieling (:TbSync)]

Comment on attachment 9232563 [details]
Bug 1668192 - Port bug 1578534 and bug 1603221 - changes to the Certificates enterprise policy. r=john.bieling

[Approval Request Comment]
Regression caused by (bug #):
User impact if declined:
Group policies do not support new options introduced in m-c.

Testing completed (on c-c, etc.):
Risk to taking this patch (and alternatives if risky):
Low.

Comment 9

[Wayne Mery (:wsmwk)]

Comment on attachment 9232563 [details]
Bug 1668192 - Port bug 1578534 and bug 1603221 - changes to the Certificates enterprise policy. r=john.bieling

[Triage Comment]
Approved for beta

Comment 10

[Rob Lemley [:rjl]]

Thunderbird 91.0b4:
https://hg.mozilla.org/releases/comm-beta/rev/e423ce5850cd