426394 - Mozilla does not remember chosen certificate

Status: RESOLVED DUPLICATE of bug 149673

(Core :: Security: PSM, defect)

Description

[Xypron]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; de-AT; rv:1.8.1.13) Gecko/20080313 SeaMonkey/1.1.9
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; de-AT; rv:1.8.1.13) Gecko/20080313 SeaMonkey/1.1.9

Some servers (e.g. http://service.sap.com) use certificates for global sign on. Each individual request is served by a different server. New in version 1.1.9 mozilla shows a dialogue to select which certificate shall be exposed to which server. Unfortunately Mozilla does not remember which certificate is used for which server if in the meanwhile another server has responded to a request, e.g.:

Server 1 asks for a certificate
User chooses a certificate
Server 2 asks for the same certificate
User chooses a certificate
Server 1 asks for a certificate
User again is unnecessarily asked again to choose a certificate.

Mozilla should at least remember which certificate is used for which server until the main window is closed.

If it safe to do so Mozilla should only asks once to choose a certificate for each "organization".

Reproducible: Always

Steps to Reproduce:
Server 1 asks for a certificate
User chooses a certificate
Server 2 asks for the same certificate
User chooses a certificate
Server 1 asks for a certificate
Actual Results:  
User again is unnecessarily asked again to choose a certificate.

Expected Results:  
Mozilla should at least remember which certificate is used for which server until the main window is closed.

If it safe to do so Mozilla should only asks once to choose a certificate for each "organization".

Comment 1

[Andrew Schultz]

See bug 295922 and bug 395399

Comment 2

[Xypron]

The problem described appears only if 
Menu -> Edit -> Preferences -> Privacy & Security -> Certificates -> Client Certificate Selection
is set to "Ask Every Time".

Comment 3

[Andrew Schultz]

right.  the default for that pref was changed in 1.1.9

Comment 4

[Daniel Veditz [:dveditz]]

bug 149673 has an explanation of what's going on, the servers don't have a long enough SSL session cache. There is also an RFE, bug 32010, requesting an explicit "tie this cert to this server" option.