648836 - Firefox 4 doesn't load the opensc-pkcs11.so library

Status: RESOLVED INVALID

(NSS :: Libraries, defect)

Description

[Alfonso Martinez]

Since Firefox 4 it seems that everybody in Spain is unable to use our e-card (DNIe) to identify ourselves in government sites, banks, etc...

If everything was setup correctly for previous versions, then the user doesn't notice any request for the pin while trying to access a protected site like mentioned in https://bugzilla.mozilla.org/show_bug.cgi?id=543194. The test site provided by the Spanish government is https://av-dnie.cert.fnmt.es/compruebacert/compruebacert and it returns a ssl_error_bad_cert_alert for Firefox4

I've tried to un-install and reinstall all the opensc and DNIe libraries, and now when I try to add the Security device, I press "load", put in the path "/Library/OpenSC/lib/opensc-pkcs11.so" and then I get a simple alert "It's not possible to load the module" (in Spanish)

This is a major problem that it's forcing many people to keep using Firefox 3.6 and if they had already upgraded, then uninstall Firefox 4 and revert back to 3.6

Comment 1

[Kaspar]

(In reply to comment #0)
> This is a major problem that it's forcing many people to keep using Firefox 3.6
> and if they had already upgraded, then uninstall Firefox 4 and revert back to
> 3.6

Most likely a consequence of bug 571367. What does

  lipo -info /Library/OpenSC/lib/opensc-pkcs11.so

say on your system? And when you launch Firefox 4 with

  arch -i386 /Applications/Firefox.app/Contents/MacOS/firefox-bin

does this make the card work again?

Comment 2

[Alfonso Martinez]

(In reply to comment #1)
> (In reply to comment #0)
> > This is a major problem that it's forcing many people to keep using Firefox 3.6
> > and if they had already upgraded, then uninstall Firefox 4 and revert back to
> > 3.6
> 
> Most likely a consequence of bug 571367. What does
> 
>   lipo -info /Library/OpenSC/lib/opensc-pkcs11.so
> 
> say on your system? 

Architectures in the fat file: /Library/OpenSC/lib/opensc-pkcs11.so are: ppc i386 

> And when you launch Firefox 4 with
> 
>   arch -i386 /Applications/Firefox.app/Contents/MacOS/firefox-bin
> 
> does this make the card work again?

Yes, launching Firefox that way has allowed me to install the .so module and the test page now has worked correctly. Thanks, at least now we have a workaround :-)

I didn't state this in the initial report, but I've tested with 
http://www.opensc-project.org/files/sca/sca-0.2.8.dmg
and this additional module for DNIe:
http://www.dnielectronico.es/descargas/PKCS11_para_Sistemas_Unix/opensc.dnie-1.4.8.1.dmg

as they seemed to be the latest versions available.

Comment 3

[Kaspar]

(In reply to comment #2)
> Architectures in the fat file: /Library/OpenSC/lib/opensc-pkcs11.so are: ppc
> i386 

Ok, then this is definitely not an NSS issue (nor a Firefox one).

You basically need to install drivers which include support for the x86_64 architecture (for OpenSC, see http://www.opensc-project.org/opensc/wiki/MacInstaller).

Resolving as INVALID.

Comment 4

[Alfonso Martinez]

Thanks, we'll have to check how to make that work :-)

Anyway, I think that Firefox should have provided a better error message instead of a plain "It's not possible to load the module"
If it had checked that the library it's not x86_64 compatible and stated that in the error message it could have pointed us quickly to the underlaying problem.

Would it be worth to file a bug about that improvement?

Comment 5

[Kaspar]

(In reply to comment #4)
> Would it be worth to file a bug about that improvement?

There's already bug 490458, so you might want to follow up there (that one also has the proper Component - Security: PSM).