192095 - Not all S/MIME certificates is visible on smartcard device

Status: RESOLVED INCOMPLETE

(MailNews Core :: Security: S/MIME, defect)

Description

[Anders Larsson]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.3b) Gecko/20030205
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.3b) Gecko/20030205

I use a smartcard from http://eid.posten.se with 2 s/mime certs and im only able
to use one or rather i can only choose one since i don´t see the other.

I use OmniKey Cardman 2020(hardware) with SmartTrust Personal3.1(software with
PKCS#11 module) to manage the certificates in windows.
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.2.1) Gecko/20021130

I have verified with a nightly build that the bug i have is still there since
1.2.1 i use normally is a little bit old..
Verified with: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.3b)
Gecko/20030205

Reproducible: Always

Steps to Reproduce:
1.Import PKCS#11 module
2.In mail newsgroup account settings choose security and the select button
3.

Actual Results:  
Only 1 S/MIME certificate is visible :-(

Expected Results:  
Shown every usable S/MIME certificate, or produce an error message if Mozilla
thinks one of the certificates is unusable.

Both certificates is almost identical except time created and end, e-mail and
key usage value.
SmartTrust Personal Administration Utility can view both certificates.

Comment 1

[John G. Myers]

Mass reassign ssaux bugs to nobody

Comment 2

[Søren Thing Pedersen]

Bug still present in Firefox 1.0.1 and Mozilla 1.7.

This problem also affects eTokens. I have 2 different certificates on an eToken
with duplicate names (my full name), but Firefox, Mozilla whatever Gecko product
only shows one of the certificates in all selection dialogs.

I guess the security module cannot handle duplicate names for different
certificates. I suggest this summary to elaborate that:
"Only one certificate on a smartcard device is available even though additional
S/MIME certificates with the same name are also stored on the device"

Comment 3

[Julien RANC]

Bug still present on thunderbird 2.0 beta 2

Using an Aladdin eToken with opensc-pkcs11: only S/MIME certificate with ID=45 on the smartcard (this seems to be the default ID for the first certificate) can be used.

Comment 4

[Martin Paljak]

If you use OpenSC, could you please provide the output of pkcs15-tool -D and pkcs11-tool -L/-O to see what exactly is on the card.

Comment 5

[Kai Engert [:KaiE:]]

We'd need to see real examples to analyze.

No update was given since comment 4 ten years ago. Marking incomplete.