94499 - Error restoring a PKCS#12 file generated with OpenSSL using Manage Certificates

Status: VERIFIED FIXED

(Core Graveyard :: Security: UI, defect, P1)

Description

[Aleix Conchillo]

From Bugzilla Helper:
User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:0.9.3) Gecko/20010801
BuildID:    2001080104

I get the message: "Failed to restore PKCS#12 file for unknown reasons". I have
tried on other browsers like Netscape 4.78 and works properly, it doesn't work
on Netscape 6 either.

Reproducible: Always
Steps to Reproduce:
1.Open the certificate manager
2.Restore a .p12 file generated with openssl 0.9.6b


Actual Results:  I get the message: Failed to restore PKCS#12 file for unknown
reasons

Expected Results:  Import the certificate correctly

I'm running Mozilla under a Debian GNU/Linux system with all libraries updated
almost every day.

Comment 1

[ckritzer (gone)]

Confirming.  I see this on Win98SE as well.

Updating Platform, OS to ALL and updating summary to

"Error restoring a PKCS#12 file generated with OpenSSL using Manage
Certificates" for clarity.

Comment 2

[Stephane Saux]

Chris (or reporter), can you attach a p12 file with a cert so that we have a
test case?

-> javi
P2

Comment 3

[ckritzer (gone)]

Stéphane, I just used the valid cert (*.p12 file) exported from 4.x, and tried
to import it into the 2001-08-08 trunk build by clicking on the 'Restore'
Button.  It would not restore to my cert database or 'cardware'.

Comment 4

[Stephane Saux]

Chris, so any p12 file fails to load?
->p1

Comment 5

[Javier Delgadillo]

I just tried this on Linux and it worked for me with a build updated this morning.

What build/platforms are you running?  What was the length of the password you
chose?

Ideally, I'd like to get a copy of the .p12 files in question.

Comment 6

[Javier Delgadillo]

I generated a PKCS#12 file using 4.78 and successfully imported the file into my
build from this morning.

To reporters, I say 

1) Make sure you've got the password right
2) Make sure FIPS mode is *off* (You can enable/disable FIPS mode by going to
Edit->Preferences->Privacy and Security->Certificates->Manage Security Devices.

Until someone gives me a p12 file that shows this behavior, I can't work on this
any longer.

Comment 7

[ckritzer (gone)]

Javi, 

On today's (2001-08-09-07-trunk) Win32 build [Win98SE], with the file you
supplied me (test.p12) & disabling FIPS & verifying I am using the correct
password for my device[s], attempting to restore test.p12 is SUCCESSFUL for the
Software Security Device, but FAILS (see error message below) for iButton.

Error Message:

"Failed to restore the PKCS #12 file for unknown reasons."
I will test LinRH6.2, MacOS X, and MacOS 9.0 next.

Comment 8

[ckritzer (gone)]

LinRH6.2, MacOS 9 & X all restore with no problems to the Software Security
Device on today's (2001-08-09-xx-trunk) bits using test.p12.

I do not have iButton or a reasonable facsimile on these platforms, so I could
not test the restore to cardware.

Comment 9

[Stephane Saux]

Chris, Ibuttons fill up. You may have encountered that.
I'm going to add the p12 file as an attachment to this bug.
I'll also try to load it up on my hardware device.

Comment 10

[Stephane Saux]

Attachment: test p12 file with pwd test1

Comment 11

[Stephane Saux]

Was able to import the test p12 file provided as an attachment successfully in
an IButton hardware device.
Marking worksforme.

Comment 12

[Aleix Conchillo]

Attachment: PKCS#12 file created with openssl 0.9.6b to reproduce the error

Comment 13

[Aleix Conchillo]

passowrd for attachment file is    mozilla

Comment 14

[Javier Delgadillo]

supplied p12 file works with Netscape 4.76 and not with Mozilla

Comment 15

[Javier Delgadillo]

Attachment: Patch to fix the import problem.

Comment 16

[David P. Drinan]

The variable count is initialized to 1 and there is a check for count > 1 but I 
can't figure out where count is updated in the while(1) loop. Also, a comment 
would be useful to describe what's happening in the while(1) loop.

Comment 17

[Javier Delgadillo]

Attachment: Updated patch (Also fixes a compiler warning)

Comment 18

[David P. Drinan]

r=ddrinan.

Comment 19

[Stephane Saux]

If you import the same p12 file repeatedly, will you end up with the same cert
added multiple times to the db with different nicknames?  Is that ok?

Comment 20

[Javier Delgadillo]

If you import the same file, you will get an error that says "This key already
exists in your database."  So that's not an issue.

Comment 21

[Christopher Blizzard (:blizzard)]

Yuck.

sr=blizzard

Comment 22

[Javier Delgadillo]

Patch checked in.

Comment 23

[ckritzer (gone)]

Marking VERIFIED FIXED on:
- MacOS91 2001-08-14-04-trunk (commercial)
- MacOS_X 2001-08-14-05-trunk (commercial)
- LinRH62 2001-08-14-07-trunk (commercial)
- Win98SE 2001-08-14-06-trunk (commercial)