1835103 - When attempting to authenticate using a CPS (French Healthcare Professional's Card) smartcard Firefox's 'Certificate Selection' dialog is not displayed therefore authentication cannot proceed.

Status: RESOLVED FIXED

(Core :: Security: PSM, defect, P1)

Description

[Paul]

Attachment: FF_mozregression_Output.txt

Steps to reproduce:

On macOS Big Sur and Ventura (not tested on Monterey):
Navigate to an https page that requires client certificate authentication. The certificate is smartcard based.

Actual results:

No Certificate Selection dialog is displayed.

Expected results:

The Certificate Selection dialog should be displayed in order to select the authentication certificate on the smartcard.

Comment 1

[Paul]

Attachment: FF114b8 Failed authentication log

Debug log from failed authentication attempt.

Comment 2

[Paul]

Attachment: FF113-0-2 Successful authentication log

Debug log from Firefox 13.0.2 with successful authentication

Comment 3

[BugBot [:suhaib / :marco/ :calixte]]

The Bugbug bot thinks this bug should belong to the 'Core::Security: PSM' component, and is moving the bug to that component. Please correct in case you think the bot is wrong.

Comment 4

[Dana Keeler (she/her) (use needinfo) [:keeler]]

If you disable speculative connections (try setting browser.urlbar.speculativeConnect.enabled to false and network.http.speculative-parallel-limit to 0 in about:config), does it work?

Comment 5

[Paul]

Hello Dana.

Setting 'browser.urlbar.speculativeConnect.enabled' to false and 'network.http.speculative-parallel-limit to 0' as you suggested does allow the authentication to succeed.

The fact that Firefox 114 requires changes to its configuration in order for authentication via CPS smartcard to work is a problem in itself.

Can this issue be resolved, there will be many healthcare professionals affected by this change once Firefox 113.X starts to automatically upgrade to 114.

Comment 6

[Dana Keeler (she/her) (use needinfo) [:keeler]]

Thanks for testing that out. We're looking into this bug, but I can't guarantee a specific time it'll be fixed or addressed. In the meantime, I recommend you use Firefox ESR if you need more of a long-term support version of Firefox.

Comment 7

[Pascal Chevrel:pascalc]

I am raising the severity and setting it as a release blocker, we'll build a RC3 tonight with a backout of bug 1813618

Paul, would you be able to test our release candidate if I send you the link tomorrow? Thanks

Comment 8

[Paul]

Hi Pascal.

I am on leave from tonight and return on Tuesday. You can send the release candidate to my colleaque Alvaro (who is copied on this Bugzilla ticket) by posting a reply/link here and he will be able to perform tests for you.

Comment 9

[Pascal Chevrel:pascalc]

Fixed on the 114 branch by the backout of bug 1813618:
https://hg.mozilla.org/releases/mozilla-release/rev/defb5e07935c

Comment 10

[Pascal Chevrel:pascalc]

Our new release candidate is available here:
https://ftp.mozilla.org/pub/firefox/candidates/114.0-candidates/build3/

Here are the French Windows build installers
https://ftp.mozilla.org/pub/firefox/candidates/114.0-candidates/build3/win64/fr/

Alvaro, could you confirm that these builds work for you? Thanks!

Comment 11

[Alvaro]

Successfully tested with this Firefox release candidate 114.0 on :

• macOS with TokenDriver
• macOS with PKCS#11 library
• Windows with CAPI (Mindidriver/CSP)
• Windows with PKCS#11 library

Comment 12

[Pascal Chevrel:pascalc]

(In reply to Alvaro from comment #11)

Successfully tested with this Firefox release candidate 114.0 on :

• macOS with TokenDriver
• macOS with PKCS#11 library
• Windows with CAPI (Mindidriver/CSP)
• Windows with PKCS#11 library

Awesome, thanks Alvaro!

Comment 13

[Dana Keeler (she/her) (use needinfo) [:keeler]]

Hi Paul, this is a build with a potential fix: https://firefox-ci-tc.services.mozilla.com/api/queue/v1/task/GmVLELuoS_y6H90mPkfcOA/runs/0/artifacts/public/build/target.dmg
Could you test it out? Thanks!

Comment 14

[Dana Keeler (she/her) (use needinfo) [:keeler]]

Attachment: Bug 1835103 - reset speculative connections where the peer asks for a client authentication certificate r?jschanck!,kershaw!

Speculative connections to servers that request a client authentication
certificate can't make progress, because PSM buffers the "select a client
authentication certificate" dialog (otherwise, the dialog would show up
unexpectedly), but Necko won't claim the connection until the TLS handshake has
completed (which it won't, because the user needs to select a client
authentication certificate first). So, the only option is to cancel the
connection and have Necko make a new non-speculative connection.

Comment 15

[Paul]

Hello Dana.

That Nightly version works OK for us. Tested with our PKCS#11 and Tokendriver on Monterey.
Thanks.

Comment 16

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/b050ec8a3a18
reset speculative connections where the peer asks for a client authentication certificate r=jschanck,kershaw

Comment 17

[Iulian Moraru]

https://hg.mozilla.org/mozilla-central/rev/b050ec8a3a18

Comment 18

[BugBot [:suhaib / :marco/ :calixte]]

The patch landed in nightly and beta is affected.
:keeler, is this bug important enough to require an uplift?

• If yes, please nominate the patch for beta approval.
• If no, please set status-firefox115 to wontfix.

For more information, please visit BugBot documentation.

Comment 19

[Dana Keeler (she/her) (use needinfo) [:keeler]]

Comment on attachment 9337746 [details]
Bug 1835103 - reset speculative connections where the peer asks for a client authentication certificate r?jschanck!,kershaw!

Beta/Release Uplift Approval Request

• User impact if declined: French physicians won't be able to log in to websites necessary to do their jobs.
• Is this code covered by automated tests?: Yes
• Has the fix been verified in Nightly?: Yes
• Needs manual test from QE?: Yes
• If yes, steps to reproduce:
• List of other uplifts needed: None
• Risk to taking this patch: Low
• Why is the change risky/not risky? (and alternatives if risky): This patch is very small, and there are automated tests.
• String changes made/needed: none
• Is Android affected?: Yes

Comment 20

[Donal Meehan [:dmeehan]]

Comment on attachment 9337746 [details]
Bug 1835103 - reset speculative connections where the peer asks for a client authentication certificate r?jschanck!,kershaw!

Approved for 115.0b5.

Comment 21

[Donal Meehan [:dmeehan]]

https://hg.mozilla.org/releases/mozilla-beta/rev/1c46ab65b0b7

Comment 22

[Camelia Badau [:cbadau], Desktop Test Engineering]

Paul, could you please verify on your end if the issue is fixed on Firefox 115 Beta 5?
Thank you!

Comment 23

[Paul]

Hi Camelia,

We have tested FF 115 Beta 5 and authentication works OK on macOS Monterey and Windows.

Thanks.