381911 - Can't import PEM or DER personal certificates (or certificates without private keys)

Status: RESOLVED DUPLICATE of bug 1031543

(Core :: Security: PSM, defect)

Description

[Phil Dibowitz]

User-Agent:       Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8.1.3) Gecko/20070310 Iceweasel/2.0.0.3 (Debian-2.0.0.3-2)
Build Identifier: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8.1.3) Gecko/20070310 Iceweasel/2.0.0.3 (Debian-2.0.0.3-2)

Firefox doesn't allow you to import PEM (or DER, for that matter) certificates for personal certs (or "Your Certificates"). It does allow PKCS#12, however, you can't create a PKCS#12 object without a private key.

This is problematic if I'm attempting to import just a certificate.

For example, it's possible for a webpage to kick off a keypair generation in the browser, which puts the private key only in the browser. If the resulting CSR is later approved and emailed to the user, they have no way of importing it. They cannot export the private key from firefox to make a PKCS#12 since Firefox doesn't allow access to a key unless there's already a certificate associated with it, and firefox doesn't allow a plain certificate to be loaded.


Reproducible: Always

Steps to Reproduce:
Take any certificate and attempt to import it under "Your Certificates" - it will fail.
Actual Results:  
Nothing is imported, and you have no access to your private key.

Expected Results:  
It should import the certificate and associate with a private key if possible. If not, note it in the UI and allow a private key to be imported later.

Comment 1

[Daniel Veditz [:dveditz]]

I'm pretty sure we should handle it. I don't know about PEM, but we've got DER routines

http://lxr.mozilla.org/mozilla/source/security/nss/lib/util/secasn1.h#106

But how are you serving the file, and can you attach a specific example so we can see whether there are variations in format that we're not supporting?

Comment 2

[Daniel Veditz [:dveditz]]

The "steps to reproduce" are lacking here, I've gotten certs just fine from Thawte, Verisign and others in just the way you've described so it's not "Take any cert". specific examples please.

Comment 3

[Phil Dibowitz]

Edit -> Preferences -> Advanced -> Encryption

Click "View Certificates"
Choose the "Your Certificates" tab
Choose "Import"

From here, by default it only shows PKCS#12 files - but if you choose to display "All Files" and then select a PEM- or DER- encoded certificate, it will prompt you for a passphrase to "decrypt" the certificate, even if you selected an UNencrypted PEM certificate.

If you choose not to enter a passphrase and hit enter, the error message states, 

   Failed to decode file. Either it is not in PKCS #12 format, has been corrupted, or the password you entered is not correct.

That seems to imply to me it _requires_ PKCS #12.

As to your point about DER routines - you have both DER and PEM routines, you support them elsewhere, just not for importing _personal_ certificates.

Comment 4

[Kai Engert [:KaiE:]]

I agree we probably only support import of p12 files into the personal tab.

Being able to import a separate private key PEM + associated cert PEM file might indeed currently not be support. This would be an enhancement request. However, it seems unusual for end users to have certs in that format. And power users should easily be able to use crypto command line tools to convert the PEM files into a p12 file...

However, the scenario of "create key pair in browser and receive cert by email" is a valid one. We do have an automatic import of trusted certs in the email code. In the old days where we had a single application (browser+mail) this would just work.

But now with FF+TB and separate profiles, delivery by email won't work.
If keypair creation was initiated by a web page, we'd require a web delivery to produce the combined personal cert.

Phil, have you tried to use the "other people" tab to import your cert-only-PEM-file? Does this make your cert show up in the personal certs tab?

(I know this is not obvious or user friendly, but I'm curious whether this works)

Comment 5

[Phil Dibowitz]

Kai,

Even web-delivery doesn't seem to work if by that you mean "click on a link with a PEM-encoded certificate." This doesn't work as you might expect - you can only seem to import it as a CA.

I'd never tried to import under "other people", but doing so now seems to just leave it under "other people".

Also, as a general point - when the key is in the browser (from a web-initiated key generation) but not the certificate, it would awesome if this was available from the UI as well. Currently that key is just hidden away somewhere never to be seen again (especially since I can't associate a certificate with it). This is a problem many browsers seem to suffer from.

And finally - yes, it's trivial for a PKI-savvy user to build a p12 out of a cert and key - but I don't think it should be a requirement to do so. And non-savvy users are liable to have trouble with that. Ideally a user could import a key at one point, a cert later (or vise-versa), and things would work. (It might be worth nothing that key-then-cert works in IE).

Let me know what else I can add. I'm happy to test patches as well.

- Phil

Comment 6

[Kai Engert [:KaiE:]]

(In reply to comment #5)
> Even web-delivery doesn't seem to work if by that you mean "click on a link
> with a PEM-encoded certificate." This doesn't work as you might expect - you
> can only seem to import it as a CA.

I'm quite sure this is working.

Are you aware the action is controlled by content-type?

You probably used application/x-x509-ca-cert, but for installing a user's certs you need to use application/x-x509-user-cert

Comment 7

[Phil Dibowitz]

Looking at the apache config, that is correct. This may be a useful work-around for the short term, I'll test this and report any problems back. Long-term, however, it'd be nice to be able to access all this through the Preferences pane. Thanks!

Comment 8

[Phil Dibowitz]

You're right. This is a good work-around for the time being. Thanks!

So at this point, it seems like what's missing is (a) GUI support for importing PEMs into the Personal Certificate store (b) Support for displaying and exporting lonely private keys not associated with a certificate.

Any idea what an ETA for those might look like?

Oh... should this be changed to 'confirmed' since you confirmed these two cases don't work?

Thanks again for all your help.

Comment 9

[Kai Engert [:KaiE:]]

reassign bug owner.
mass-update-kaie-20120918

Comment 10

[u363629]

I just tried to update my personal cert using a PEM file, and ran into the described problem:

I had a soon to expire personal certificate and its private key stored in Thunderbird already. I simply wanted to add a longer lasting cert corresponding to the already installed private key. At least for this very simple use case of updating your certificate this bug is very much valid.

Comment 11

[Martin]

Christian, try importing your cert through the 'Other People´s' tab. Worked for me.

Comment 12

[u363629]

(In reply to Martin from comment #11)
> Christian, try importing your cert through the 'Other People´s' tab. Worked
> for me.

Yes worked, thank you!

But ...

1) This is not straight forward.
2) There is no feedback that a successful imported happend
3) The new certificate is only shown after I closed the settings and reopenend them.

So all in all, this still needs some improvement. Maybe including a warning period to thell the you his certificate is soon running out.

Comment 13

[Dana Keeler (she/her) [:keeler]]

Importing certificates this way was added in bug 1031543.