Join the AMA (Ask Me Anything) with the Firefox leadership team to celebrate Firefox 20th anniversary and discuss Firefox’s future on Mozilla Connect. Mark your calendar on Thursday, November 14, 18:00 - 20:00 UTC!

This site will have limited functionality while we undergo maintenance to improve your experience. If an article doesn't solve your issue and you want to ask a question, we have our support community waiting to help you at @FirefoxSupport on Twitter and/r/firefox on Reddit.

Avatar for Username

Search Support

Avoid support scams. We will never ask you to call or text a phone number or share personal information. Please report suspicious activity using the “Report Abuse” option.

Learn More

Echekwara usoro a. Biko jụọ ajụjụ ọhụrụ ma ọ bụrụ na ị chọrọ enyemaka.

Windows domain + GPO cert deployment + Firefox ESR + GPO "FF: use Windows cert store"

  • 5
  • 1 nwere nsogbu anwere nsogbu a
  • 13 views
  • Nzaghachi ikpeazụ nke buggrabber

buggrabber
buggrabber
more options

Hi,

so, policies are working like a charm so far.

Firefox picks changes up nicely, really like it.

Thanks for implementing that!!

- - - - - - -

As for the issue:

When browsing my site I still receive ""Peer’s Certificate issuer is not recognized. " SEC_ERROR_UNKNOWN_ISSUER" though. Chrome also uses Windows Store, works fine.

IE works fine.

The certificate is deployed via GPO, so it resides in HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\SystemCertificates\Root\Certificates

(note the "Policies" in the path!), which might be an indication for trouble depending on the implementation of "use windows store".

The environment is a corporate Windows domain.

The cert has been created with

CN -> HOST.something.local

alias -> CNAME.something.local, CNAME, HOST

Version 3

PKCS #1 SHA-256 With RSA Encryption

The site is called like this -> https://CNAME

Note: The local client's DNS settings will apply something.local.

- - - - - - -

Funnily enough, when calling CNAME, CNAME.something.local or HOST -> I only get SEC_ERROR_UNKNOWN_ISSUER

With HOST.something.local (so the CN in the cert) this gets emitted too,

as well as "The certificate is only valid for the following names: CNAME.something.local, CNAME, HOST".

Another issue?

SAN sounds very much like "additional" names to me?! So I don't get why this would occur at all.

- - - - - - -

Version is 60.1.0 x64.

Looking forward to ideas.

"Policy actually being applied?" Yep, I see it reflected in about:config and the setting is also correctly being locked :)

Best regards

Hi, so, policies are working like a charm so far. Firefox picks changes up nicely, really like it. Thanks for implementing that!! - - - - - - - As for the issue: When browsing my site I still receive ""Peer’s Certificate issuer is not recognized. " SEC_ERROR_UNKNOWN_ISSUER" though. Chrome also uses Windows Store, works fine. IE works fine. The certificate is deployed via GPO, so it resides in HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\SystemCertificates\Root\Certificates (note the "Policies" in the path!), which might be an indication for trouble depending on the implementation of "use windows store". The environment is a corporate Windows domain. The cert has been created with CN -> HOST.something.local alias -> CNAME.something.local, CNAME, HOST Version 3 PKCS #1 SHA-256 With RSA Encryption The site is called like this -> https://CNAME Note: The local client's DNS settings will apply something.local. - - - - - - - Funnily enough, when calling CNAME, CNAME.something.local or HOST -> I only get SEC_ERROR_UNKNOWN_ISSUER With HOST.something.local (so the CN in the cert) this gets emitted too, as well as "The certificate is only valid for the following names: CNAME.something.local, CNAME, HOST". Another issue? SAN sounds very much like "additional" names to me?! So I don't get why this would occur at all. - - - - - - - Version is 60.1.0 x64. Looking forward to ideas. "Policy actually being applied?" Yep, I see it reflected in about:config and the setting is also correctly being locked :) Best regards

Edeziri site na buggrabber

All Replies (5)

Wesley Branton
Wesley Branton
more options

To use the Windows certificate store in Firefox you have to set the security.enterprise_roots.enabled preference to true. It's set to false by default.

You can change this preference various different ways, the easiest of which is probably to set and lock it using an AutoConfig file.

Hope this helps.

buggrabber
buggrabber Jụọ onye nwe ya ajụjụ
more options

Seems you answered exactly when I added this snippet yesterday:

> "Policy actually being applied?" Yep, I see it reflected in about:config and the setting is also correctly being locked :)

buggrabber
buggrabber Jụọ onye nwe ya ajụjụ
more options

Any further ideas??

I can provide a TeamViewer session if necessary/desired.

Mike Kaply
Mike Kaply
  • Moderator
more options

Is this something you could possibly open a bug in bugzilla for?

We can get the team that worked on this feature involved to see if they can figure out what is going on.

buggrabber
buggrabber Jụọ onye nwe ya ajụjụ
more options

Sure

https://bugzilla.mozilla.org/show_bug.cgi?id=1489549