1723493 - Personal certificate list with duplicates (they come from OS Certificates)

Status: RESOLVED DUPLICATE of bug 1721367

(Core :: Security: PSM, enhancement)

Description

[thywalls]

Attachment: FxCertList1.png

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:90.0) Gecko/20100101 Firefox/90.0

Steps to reproduce:

When you are prompted by a website for a personal certificate, the list shows more certificates, most of them duplicates.

(See FxCertInstalled.png for a censored list of my installed personal certificates and CertList1.png for the ones listed when prompted)

I made this test in my home computer that only have four certificates, but in my work i have more or less one hundred. And i have almost all of them repeated.

Actual results:

It could be related because since 75.0, reading the changelog https://www.mozilla.org/en-US/firefox/75.0/releasenotes/ says "Firefox will locally cache all trusted Web PKI Certificate Authority certificates known to Mozilla. This will improve HTTPS compatibility with misconfigured web servers and improve security."

However, i don't recall seeing the duplicates since a month or so.

I installed a certificate in the OS Cert Manager (Windows) and it shows in the certificate list when prompted (see CertList2.png) but it's not installed.

Expected results:

It's seems more as an enhancement, but that certificate list is gaving a lot of headache for a while.

The most desired fix it should be not shown duplicate certificates, only showing one (normally the Firefox installed one).

Also adding a search option as reported before https://bugzilla.mozilla.org/show_bug.cgi?id=1512476 and https://bugzilla.mozilla.org/show_bug.cgi?id=1226520 not only to easy the use when there are a lot of certificates, also can help with this.

Or including an option to not use OS certificates (but maybe can broke what since Fx 75.0 want to do).

The OS ones can be marked too in the list if they can't be hidden.

Thanks.

Comment 1

[thywalls]

Attachment: FxCertInstalled.png

Comment 2

[thywalls]

Attachment: FxCertList2.png

Comment 3

[thywalls]

I just noticed the Certificate order in the list is changed, i don't know if it happens every time you installed a new one or every time the list is showed... far worse without a search box or with all that duplicates.

Comment 4

[BugBot [:suhaib / :marco]]

The Bugbug bot thinks this bug should belong to the 'Core::Security: PSM' component, and is moving the bug to that component. Please revert this change in case you think the bot is wrong.

Comment 5

[Dana Keeler (she/her) [:keeler]]

Are you using a third-party PKCS#11 module? (about:preferences -> security devices)

Comment 6

[thywalls]

(In reply to Dana Keeler (she/her) (use needinfo) (:keeler for reviews) from comment #5)

Are you using a third-party PKCS#11 module? (about:preferences -> security devices)

Sorry i blurred that info from the original screenshots. In those, All my personal certificates in Firefox Certificate Manager says they use as security device "OS Client Cert Token (Modern)".

In Security Devices appears that one, and it's made by Mozilla (See CertSecDevices.png)

I want to put new screenshots because i realize something and did some extra testing. In my original post, i had just installed a certificate in the OS certificate manager that appeared in the certificate list prompt, but not in the certificate manager list. But when you restart firefox, it appears there too.

So, i did something else, now i have three certificate in both certificate manager (OS and Firefox), and two other either in each one (See CertInstalled2.png). All of them shows as Security device as "OS Client Cert Token (Modern)" except the one only installed in Firefox certificate manager, showing "Software Security Device", which is what is shows in the past with all personal certificates.

Then, when a certificate is in the OS and in Firefox, Firefox now put above the OS one above the installed one directly in the browser (I don't know, but maybe should be better the opposite).

However, when you are prompted for a certificate, the prompt list shows all the certificates, from one part and the other, including duplicates (See CertList3.png), so instead of showing the five certificates showing in the certificate manager in preferences, it showing eight because the three duplicates in both certificate stores.

That's why i posted this, those behaviours doesn't seems right:

• It shouldn't be showing duplicates in the certificate prompt list, especially if they are not showing in the certificate manager list. (*)
• It shouldn't be showing a certificate in the prompt list, when it's not showing it in the certificate manager because you just installed it in the OS certificate manager and you need to restart firefox to show it. In both or neither.
• It could be debatable, but it should be detect the Firefox installed certificates above the OS installed certificates.
• And also, i point out earlier, adding a search option in the certificate prompt list and in the certificate manager as reported before here https://bugzilla.mozilla.org/show_bug.cgi?id=1512476 and here https://bugzilla.mozilla.org/show_bug.cgi?id=1226520 , could be useful not only for this, also for the ones like me that work with dozens of certificates.

Thanks!

(*) If someone thinks "Ok, you should install the certificates in one or another", it not that easy... Some programs (including goverment software) use one or the other certificate store depending the use (the gov document auto-signer uses the Firefox one when you use Firefox), and to be sure everything works you need to have all certificates in both sides.

Comment 7

[thywalls]

Attachment: CertInstalled2.png

Comment 8

[thywalls]

Attachment: CertList3.png

Comment 9

[thywalls]

Attachment: CertSecDevices.png

Comment 10

[Dana Keeler (she/her) [:keeler]]

Thanks! This sounds like bug 1721367.