458161 - "Failed to restore the PKCS #12 file for unknown reason" is bad error message

Status: NEW

(Core :: Security: PSM, defect, P5)

Description

[Igor Velkov]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1b1pre) Gecko/20081001 Minefield/3.1b1pre
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1b1pre) Gecko/20081001 Minefield/3.1b1pre

trying to import personal certificate in pkcs12 format, got "Failed to restore the PKCS #12 file for unknown reason" message.
This error occurs only on one of my computer. This file successful imports on 2 other computers with firefoxes.

This error message is not informative and not helps to find and resolve problem. More informative error messages required.

Reproducible: Didn't try

Comment 1

[Kai Engert [:KaiE:]]

Mass change owner of unconfirmed "Core:Security UI/PSM/SMime" bugs to nobody.
Search for kaie-20100607-unconfirmed-nobody

Comment 2

[Brian Smith (:briansmith, :bsmith, use NEEDINFO?)]

May be related to bug 515663.

Comment 3

[Brian Smith (:briansmith, :bsmith, use NEEDINFO?)]

My previous comment was regarding 458161, which is related to this.

Comment 4

[Stefan Kleeschulte]

I get the same error message when entering a wrong password while trying to import a password protected private key from a .p12-file. This message is not helpful and should instead include something like "wrong password".

When supplying a wrong password while trying to import a .p12-File with Windows' Certificate Import Wizard, it says that the password is incorrect. Thus it seems to be possible to recognize a wrong password.

User agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0

This is a german Firefox version. The message "Failed to restore the PKCS #12 file for unknown reason" translates to "Die PKCS#12-Operation ist aus unbekannten Gründen fehlgeschlagen." in german Firefox.

Comment 5

[Ján Hluzák]

This general error message is displayed also when you are trying to import user Certificate and another (Server) certificate has assigned same serial number by the same CA.

Reproduction:
Visit site with self signed certificate
Add exception for this certificate
Open Certificate Manager in preferences
Try to import User certificate(.pfx) signed by the same CA as previous server certificate and the same serial number
Error message 'The PKCS #12 operation failed for unknown reasons' is displayed

Expected behavior:
Show more descriptive message about encountered error while importing PKCS #12 user certificate

Tested on:
Mozilla Firefix 52.0.2 (64-bit), Ubuntu 16.04.2 LTS (Xenial Xerus)

Comment 6

[Eliot Jacobs]

Attachment: Bug 458161 - Enhance PKCS12 export with additional error messages r=keeler

Comment 7

[BugBot (nomail) [:suhaib / :marco/ :calixte]]

The bug assignee is inactive on Bugzilla, so the assignee is being reset.

Comment 8

[Ralf Hauser]

see also https://bugzilla.mozilla.org/show_bug.cgi?id=1922185

Comment 9

[Christoph Anton Mitterer]

Just for the records:

I've seen this bug happening amongst other occasions when Firefox assume conflicting certificate serial numbers.

It sees that when following many guides on how to create a private CA with OpenSSL and then self-signed certs with that, OpenSSL might use e.g. 00 as the serial number for the CA and also for the first signed non-CA cert.

Also for the records... it's ridiculous that bugs like these aren't fixed in over 15 years. It's not that you don't accept such certs, but FF must know why it doesn't and could give a usable error message to the user. And this is by far not the only instance where TLS/cert related error messages are completely for the torch and/or where users should be allowed to override whatever FF may consider safe or not.