Az oldal korlátolt funkcionalitással fog rendelkezni, amíg elvégezzük a felhasználói élményt javító karbantartást. Ha egy leírás nem oldja meg a problémáját, és kérdést tenne fel, akkor a támogatási közösségünk a @FirefoxSupport Twitter oldalon tud segíteni, vagy az /r/firefox oldalon a Redditen.

Avatar for Username

Támogatás keresése

Kerülje el a támogatási csalásokat. Sosem kérjük arra, hogy hívjon fel egy telefonszámot vagy osszon meg személyes információkat. Jelentse a gyanús tevékenységeket a „Visszaélés bejelentése” lehetőséggel.

További tudnivalók

A témacsoportot lezárták és archiválták. Tegyen fel új kérdést, ha segítségre van szüksége.

Firefox handling of certificate chains

  • 4 válasz
  • 1 embernek van ilyen problémája
  • 19 megtekintés
  • Utolsó üzenet ettől: paul46

paul46
paul46
more options

I have a scenario where the website being connected to, has a three level chain (Intermediate1, Intermediate2, Root). Both Intermediate2 and root CA's are present in the Firefox default trusted CA store (They are Centrum based certs). However the Intermediate1 cert (SpaceSSL CA) is not in the Firefox default trusted CA store, and consequently flags a problem when connecting to this website.

From a usability perspective it is not feasible for users to manually install the untrusted CA intermediate cert into Firefox (although this overcomes the connectivity issues if manually imported to the FF store).

Therefore I was wondering whether if the website server supplies the full cert chain file to Firefox whether Firefox will use that to 'bypass' the lack of trust of the SpaceSSL certificate or whether the same trust issues will remain (since SpaceSSL CA is not in the trusted store of FF).

Many thanks for the help.

Paul

I have a scenario where the website being connected to, has a three level chain (Intermediate1, Intermediate2, Root). Both Intermediate2 and root CA's are present in the Firefox default trusted CA store (They are Centrum based certs). However the Intermediate1 cert (SpaceSSL CA) is not in the Firefox default trusted CA store, and consequently flags a problem when connecting to this website. From a usability perspective it is not feasible for users to manually install the untrusted CA intermediate cert into Firefox (although this overcomes the connectivity issues if manually imported to the FF store). Therefore I was wondering whether if the website server supplies the full cert chain file to Firefox whether Firefox will use that to 'bypass' the lack of trust of the SpaceSSL certificate or whether the same trust issues will remain (since SpaceSSL CA is not in the trusted store of FF). Many thanks for the help. Paul

Összes válasz (4)

jscher2000 - Support Volunteer
jscher2000 - Support Volunteer
  • Top 25 Contributor
more options

Hi Paul, Firefox expects websites to provide all intermediate certs needed to verify the site certificate up to a built-in root certificate. The certificate issuer typically provides a bundle file for that.

(Since Firefox caches intermediate certificates after verifying them, users may have different experiences with the site depending on whether they have used sites that have the same certificate chain.)

You can use the Qualys test page to verify that your chain is complete: https://www.ssllabs.com/ssltest/

paul46
paul46 Kérdés tulajdonosa
more options

Thanks very much @jscher2000.

Just to clarify my understanding. Does this mean that if Firefox receives the cert chain file from the server which includes the full intermediate/root chain (including an already trusted root) that FF will fully trust the connection and will not flag any trust errors - even if the signed certificate is signed by an untrusted intermediate CA in that chain?

Thanks again.

jscher2000 - Support Volunteer
jscher2000 - Support Volunteer
  • Top 25 Contributor
more options

Hi Paul, trust is established on the fly by checking the certificate signatures. Firefox often has not seen an intermediate cert before, but it can be trusted as long as it was validly signed and can be verified up to a trusted root certificate. After verification, it will be cached and show up in the Certificate Manager dialog, Authorities tab, with the designation "Software Security Device" (instead of "Builtin Object Token").

The server doesn't need to send the root certificate that is already included with browsers, and probably shouldn't. I think the SSL Labs test views that as a configuration error. Your bundle only needs to include the intermediate certs. Your certificate issuer should tell you which ones you need to serve.

paul46
paul46 Kérdés tulajdonosa
more options

Great. Thanks very much. Understood. I appreciate the speedy assistance.