431957 - Since 2.0.0.14 prompts for certificate on every signed mail send

Status: RESOLVED DUPLICATE of bug 431819

(Thunderbird :: Security, defect)

Description

[Paul Scott]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.14) Gecko/20080404 Firefox/2.0.0.14
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.14) Gecko/20080404 Firefox/2.0.0.14

Since I upgraded to 2.0.0.14 today, every e-mail I send that has a signature (certificate) is prompting me to select the certificate. This is already set in the account preferences, and did not prompt me prior to upgrading.

Reproducible: Always

Steps to Reproduce:
1. Compose e-mail
2. Send it
3. prompt for certificate occurs 
Actual Results:  
see above

Expected Results:  
should *NOT* prompt. I already have a default certificate established for the account, and it never prompted before this upgrade.

*NOT* PROMPT

Comment 1

[Eddy Nigg (StartCom)]

I think the issue is not the selection of a client certificate (S/MIME), but the server requesting client authentication. This bug might be a duplicate of bug 431819.

Please test and confirm duplicate.

Comment 2

[Paul Scott]

Confirmed that this is a duplicate of 431819. Sorry for the dup.

Comment 3

[Daniel Veditz [:dveditz]]

Just checking to be sure:

1) do you connect to your SMTP server over SSL?

2) if you send an unsigned mail do you still get the prompt or not?

If the answer to both of those is yes then this is, indeed, a duplicate of bug 431819. If you don't get prompted for unsigned mail then this is a different problem, but one I cannot reproduce. For me signed mail is still using the cert chosen in the Security section of my account setup without asking me every time.

Comment 4

[Paul Scott]

Indeed, the answer to both *is* yes. Which surprises me because I would *not* expect that an SSL connection requires a pre-determined-CA-signed certificate on the client side. In my experience, this has never been the case. What is going on here? 

Comment 5

[Eddy Nigg (StartCom)]

In practice it always sent a client client certificate without you knowing. That's what I think happens here. Do you have a client certificate installed in TB?

Comment 6

[Daniel Veditz [:dveditz]]

(In reply to comment #4)
> What is going on here? 

It's just another way to log on to a server to prove you're you: instead of typing a password into a login form or dialog you can present a certificate. If the server is looking for a certificate that it did not issue then it's just snooping, and that's exactly the privacy issue we were trying to prevent when changing the default.

Comment 7

[Eddy Nigg (StartCom)]

(In reply to comment #6)
> the server is looking for a certificate that it did not issue then it's just
> snooping, and that's exactly the privacy issue we were trying to prevent when
> changing the default.
> 

Oh no, these are mail servers the user configured and most likely want to work with. That is, the selection was TLS and not unsecured. I guess you want that, don't you? Mail server aren't like web sites which can really track where you go. This is certainly not the same.

Besides, does certificate authentication work with the HTML capabilities of TB? That would be the only place where such a limitation should be in place.