243092 - Mozilla repeatably prompts for my client cert when it doesn't need to

Status: RESOLVED INCOMPLETE

(MailNews Core :: Networking, defect)

Description

[Jason Haar]

User-Agent:       Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7b) Gecko/20040316
Build Identifier: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7b) Gecko/20040316

I use Mozilla Mail over IMAPS which requires a client cert. I have 3 client certs.

When I first connect, Mozilla prompts me to choose the cert. I choose the
correct one, and off Mozilla goes. I then change IMAP folders - Mozilla asks me
to choose a cert again!

Reproducible: Always
Steps to Reproduce:
1.start MailNews, prompted to choose cert
2. read mail in folder, then change folder
3.prompted to choose cert again




Expected Results:  
It should remember my previous choice.



It should treat client certs like passwords - each server has one. So once one
is chosen, stick to it.

Comment 1

[Bruce Davidson]

This isn't quite a dupe but is related (I think) to bug 98972.

Comment 2

[David :Bienvenu]

the mailnews code isn't prompting you for a cert - it's the underlying network
code, prompting for each new connection. The mailnews code has no idea that's
going on...the only thing I can think for you to do is change the number of
connections we'll cache, in the advanced imap server settings, from 5 to 1. Then
we'll only ever make one connection to your imap server.

Comment 3

[Jason Haar]

Can this be reassigned to the correct area then if this isn't a MailNews issue?

As far as dropping back to 1 connection goes, that can't be the only solution. I
mean, I only use one password when talking to one backend IMAP server, and
MailNews manages to not have to prompt me multiple times - once for each
connection - so why can't client-cert choice?

I have several certs in Mozilla, and can't use "Automatic" as it's defaulting to
the wrong one - so I have to use manual - or delete certs (yeah, right).
Konqueror allows you to set what cert to use with which backend server, maybe
something like that (although I think that's a bit more than is needed). Of
course, konqueror can't be used as a template as although its client cert
support looks pretty snazzy, it doesn't work MAJORLY. :-)

Jason

Comment 4

[David :Bienvenu]

the mailnews code handles the passwords - the security cert code handles the
certs. My guess is that you've chosen the "ask me every time" option for certs
and the security code is asking you every time we make a connection to the imap
server. It would seem like the cert code should notice that we're making a
connection to the same server and use the same cert, as I imagine it does for
https...I agree with you completely...

Comment 5

[David :Bienvenu]

I suspect this is a dup

Comment 6

[Wayne Mery (:wsmwk)]

Hi Jason. Do you still see this problem?

Comment 7

[Jason Haar]

sorry, we no longer use client certs, so I cannot answer this