1717817 - SSL_ERROR_HANDSHAKE_FAILURE_ALERT when trying to ID prepaid card

Status: RESOLVED INCOMPLETE

(Core :: Security: PSM, defect)

Description

[Gian-Carlo Pascutto [:gcp]]

www.proximus.be/identificeren

This is a required ID procedure to use my phone. Trying to do this with Nightly proceeds to reading my national eID card, but then fails with an "incorrect phone number" message.

The same procedure works with Chrome, so I tested release 89.0.2. It doesn't even get that far, but fails almost immediately with SSL_ERROR_HANDSHAKE_FAILURE_ALERT.

I notice we have unconfirmed bugs like bug 1271618 and bug 1563835 that link the same error to PIN code/smartcard usage, so this might not be a pure SSL issue.

Comment 1

[Dana Keeler (she/her) [:keeler]]

(In reply to Gian-Carlo Pascutto [:gcp] from comment #0)

www.proximus.be/identificeren

This is a required ID procedure to use my phone.

Are you on your phone when you do this or on another device? (as in, are you using desktop Firefox or Firefox for Android or something?)

Trying to do this with Nightly proceeds to reading my national eID card

What does this mean? Does Nightly ask you to use a client certificate to access that site?

, but then fails with an "incorrect phone number" message.

Is this a message from the website or Firefox?

I notice we have unconfirmed bugs like bug 1271618 and bug 1563835 that link the same error to PIN code/smartcard usage, so this might not be a pure SSL issue.

Is Firefox asking you to enter a PIN?

Comment 2

[Gian-Carlo Pascutto [:gcp]]

Are you on your phone when you do this or on another device?

This is on a Windows desktop.

What does this mean? Does Nightly ask you to use a client certificate to access that site?

Yes.

Is this a message from the website or Firefox?

The website. (The error is weird, i.e. it working on Chrome seems to indicate that phone number validation failure only happens in Firefox)

Is Firefox asking you to enter a PIN?

Yes, the PIN is asked (and it looks like it's accepted, as it's not asked again), but then the phone number error happens.

Comment 3

[Dana Keeler (she/her) [:keeler]]

Thanks for your patience with my slow response. Can you get a packet trace (using e.g. wireshark) of the Chrome TLS handshake with that site vs. the Firefox handshake with that site?

Comment 4

[Gian-Carlo Pascutto [:gcp]]

Attachment: eid.png

Comment 7

[Gian-Carlo Pascutto [:gcp]]

Attached packet traces - I hope I got the right stream. From eyeballing, Firefox fails to include the client certificate, while Chrome does. At the place where Firefox fails, Chrome displays the dialog as in the screenshot.

Comment 8

[Gian-Carlo Pascutto [:gcp]]

Yes, the PIN is asked (and it looks like it's accepted, as it's not asked again), but then the phone number error happens.

I didn't get asked a pin this time. Instead, Firefox displayed a dialog with only 1 certificate - not the right one and not the one from the card in the reader. If I cancel, I get the error from the description. Firefox never again shows or asks for which certificate I want.

Comment 9

[Gian-Carlo Pascutto [:gcp]]

My experience matches the "see also" bug, where that user reports:

Before upgrade Firefox was prompting users to choose Certificates. After upgrade, user is never prompted to choose.

Comment 10

[Gian-Carlo Pascutto [:gcp]]

Marking S2: This is a required ID procedure to use my phone. The only workaround is to switch to Chrome.

Comment 11

[Dana Keeler (she/her) [:keeler]]

In about:preferences -> View Certificates... -> Authorities, do you see either Belgium Root CA3 or Citizen CA?
If you can go through the authentication process again with the environment variable MOZ_LOG set to pipnss:4 and get the logging output, that would help too. The easiest way I know of to do this is in powershell:

$env:MOZ_LOG = 'pipnss:4'
Start-Process -FilePath 'C:\Program Files\Mozilla Firefox\firefox.exe' -RedirectStandardError $HOME\Desktop\log.txt

Thanks!

Comment 12

[Gian-Carlo Pascutto [:gcp]]

Resetting the needinfo, I "resolved" this by going to a physical store and have them read in my ID card but I'd like to investigate this deeper still.