193739 - certificates lost from 1.3a to 1.3b (and 1.2 to 1.3a)

Status: VERIFIED FIXED

(Core Graveyard :: Security: UI, defect, P2)

Description

[yoav]

User-Agent:       Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; en-US; rv:1.3b) Gecko/20030212
Build Identifier: Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; en-US; rv:1.3b) Gecko/20030212

When switching from 1.3a to 1.3b, my cert8.db file is no longer used.

 I can't get to the password manager, and using the certificate manager
to attempt to import cert8.db is claiming that the file is either
not a PKCS#12 file or that it is corrupt.

  This happened previously when I switch to 1.3a from 1.2.  At that time I
re-entered all my passwords.  I'd really like to have to avoid doing this again.

  There is another report of a similar problem between 1.2 versions.  The
explanation for those doesn't make sense here (since both 1.3a and 1.3b are
using cert8.db files.

Reproducible: Always

Steps to Reproduce:
1. Use 1.3a, have some passwords managed by password manager
2. Install 1.3b
3. Try to access the passwords on PSM, or just log in to any secured website

Actual Results:  
Certificates that were known are no longer known.  Passwords that were known
are lost.  The master password has been 'reset' to nothing

Expected Results:  
None of the above.  It should have continued to use the certificates and
passwords that it had already.

I can only verify this on macOS.x   This may not apply to other versions
of mozilla.  I'm happy to help debug this if you can reply with instructions
on things I should try.  Last time this happened I built a seperate
version of mozilla that printed out all my passwords so I could re-enter them...
this is not something I'd like to repeat with every upgrade.

  Furthermore, I suspect a LOT of people will be very angry if updating mozilla
means they lose everything in their PSM.

Comment 1

[yoav]

Just one small correction:
  Exporting certificates from 1.3a to a file results in something
that IS importable into 1.3b  And then the certificates are
recognized, but the passwords are still not available.

Comment 2

[yoav]

This seems possibly related to bug 182607
  except that the 'workaround/fix' proposed there doesn't
seem to do the right thing.

Comment 3

[John Unruh]

Depends on bug 173369 being fixed. Reporter, for now I suggest going back to
1.3a on OSX.

Comment 4

[Kai Engert [:KaiE:]]

Please test using the build that will be available tomorrow morning. Thanks.

Comment 5

[Kai Engert [:KaiE:]]

Oh, i should probably provide a better explanation, because if you want to
verify the bug is fixed, you'll need to do some manual work on the files in your
Mozilla profile.

The problem is, the software produced for Mac OS X has recently changed to a
different build system. In the newer build system different filename are being
used for the files that store your certificates, and also stores the key that is
used to access your stored and encrypted passwords.

The fix we have just produced with bug 173369 only helps those users, that did
NOT use beta versions. But since you used alpha/beta versions, the patch won't
help you.


Instead of providing a lot of background information I'll explain what you can
do to make it work and test whether the problem is fixed for you:


First, make sure that you have backups of all your certificates.

Next, find the directory on your hard disk that contains the Mozilla profile, I
think it is in your home directory,
library/Mozilla/profiles/{profile-name}/{some-randomchars}/ or similar, I can
look it up for you if you don't find it.

In that directory, there is a subdirectory Security that contains your OLD
security files. Those files also contain the key that is used to access your
passwords. Make sure you don't delete them.

Directly in the directory (not the security subdir) you'll find some files name
key3.db, cert7.db, secmod.db, cert8.db. Those files have been created when you
first ran a Mozilla build from the new build system. At that time, we did not
have any conversion from the old filenames to the new filenames, so new files
were created.

While builds starting tomorrow can do a conversion, they will do a convsion ONLY
if no new files are yet present.

So, if you just run a new build tomorrow, you won't see any effect, because the
new files are already present.


In order to fix the problem, please do this:
- quit Mozilla
- remove your files cert7.db, cert8.db, key3.db, secmod.db from your profile
directory
- start the new build that is available tomorrow

By doing so, Mozilla will detect that you have old files in your security
subdir, and it will detect you don't yet have new files. It will do a conversion.

This should bring you back the ability to access your stored passwords, and it
should also give you all the certificates that you had in your older build.

Comment 6

[yoav]

I just tried the suggested fix using the daily snapshot and
it works.

Comment 7

[John Unruh]

Verified fixed.