1684245 - [Flatpak] Firefox flatpak does not trust self-signed certificates that the OS does

Status: RESOLVED WONTFIX

(Firefox :: Security, defect)

Description

[Nikolaos Perrakis]

User Agent: Mozilla/5.0 (X11; Linux x86_64; rv:84.0) Gecko/20100101 Firefox/84.0

Steps to reproduce:

I am trying to open a webpage that is signed with a self-signed certificate. In my case the page is my openwrt router's web admin UI.

Actual results:

Firefox shows me a warning regarding
MOZILLA_PKIX_ERROR_SELF_SIGNED_CERT

Expected results:

The webpage should be loading without a security warning. I am running Fedora Silverblue and followed the proper documentation to make sure the OS trusts the certificate
https://docs.fedoraproject.org/en-US/quick-docs/using-shared-system-certificates/

I have also verified that the certificate is trusted and cleared browsing data and cache, as well as restarting firefox.

There is a relevant flatpak github issue but it is claimed that this is a firefox issue:
https://github.com/flatpak/flatpak/issues/2721#issuecomment-546994464

Comment 1

[BugBot [:suhaib / :marco/ :calixte]]

Bugbug thinks this bug should belong to this component, but please revert this change in case of error.

Comment 2

[Dana Keeler (she/her) [:keeler]]

Are you using a version of Firefox provided by Mozilla or built by another organization? (e.g. RedHat)

Comment 3

[Nikolaos Perrakis]

I am using the flathub version, that is created by mozilla.

Comment 4

[Dana Keeler (she/her) [:keeler]]

Thanks! In about:preferences, in Security Devices, what do you see? (you can just attach a screenshot)

Comment 5

[Nikolaos Perrakis]

Attachment: Screenshot of Security Devices in about:preferences

Sorry I missed the email notifying of your request. I am attaching the screenshot requested for Security Devices.

Comment 6

[Dana Keeler (she/her) [:keeler]]

Thanks! Mozilla builds of Firefox don't trust OS certificates by default. On Windows, macOS, and Android, the preference security.enterprise_roots.enabled would do what you want, but that's not available on Linux. You could try loading the system nssckbi which I think lives at /usr/lib64/libnssckbi.so. Another option would be p11-kit-proxy.
I'm going to close this bug as wontfix since this isn't something we're planning to address at the moment.