We're calling on all EU-based Mozillians with iOS or iPadOS devices to help us monitor Apple’s new browser choice screens. Join the effort to hold Big Tech to account!

본 사이트는 여러분의 사용자 경험을 개선하기 위해 유지 보수를 진행하는 동안 기능이 제한됩니다. 도움말로 문제가 해결되지 않고 질문을 하고 싶다면 Twitter의 @FirefoxSupport 및 Reddit의 /r/firefox 채널을 활용하세요.

Mozilla 도움말 검색

고객 지원 사기를 피하세요. 저희는 여러분께 절대로 전화를 걸거나 문자를 보내거나 개인 정보를 공유하도록 요청하지 않습니다. "악용 사례 신고"옵션을 사용하여 의심스러운 활동을 신고해 주세요.

자세히 살펴보기

Client certificate selection seems to be broken in Firefox 70

  • 5 답장
  • 2 이 문제를 만남
  • 4 보기
  • 최종 답변자: mstrap

more options

Until version 69, I was happily working with two client certificates for the same server using *Select one automatically* option; Firefox was choosing the correct certificate for either of the two server-side applications. Since version 70, it doesn't seem to do so anymore. It seems to choose a random(?) certificate out of the two which makes one application work, the other one fails with an SSL error: either SSL_ERROR_UNKNOWN_CA_ALERT or SSL_ERROR_CERTIFICATE_UNKNOWN_ALERT.

When selecting *Ask you every time* option, I can select the appropriate certificate and connect to both application. However, it's not remembering the corresponding certificate and after restarting Firefox, it will suggest the first certificate again (which is correct for one application but wrong for the other). This is another indication that Firefox is not able anymore to choose an appropriate certificate when requested by the server.

Did the *Select one automatically* option or underlying certificate selection mechanisms change with version 70?

How exactly is the certificate selection *supposed to work*? Which parameters of the server's certificate request are used to select the appropriate certificate from my local database?

Is there some debug logging I can turn on to further investigate this problem?

Thanks for any ideas!

-Marc

Until version 69, I was happily working with two client certificates for the same server using *Select one automatically* option; Firefox was choosing the correct certificate for either of the two server-side applications. Since version 70, it doesn't seem to do so anymore. It seems to choose a random(?) certificate out of the two which makes one application work, the other one fails with an SSL error: either SSL_ERROR_UNKNOWN_CA_ALERT or SSL_ERROR_CERTIFICATE_UNKNOWN_ALERT. When selecting *Ask you every time* option, I can select the appropriate certificate and connect to both application. However, it's not remembering the corresponding certificate and after restarting Firefox, it will suggest the first certificate again (which is correct for one application but wrong for the other). This is another indication that Firefox is not able anymore to choose an appropriate certificate when requested by the server. Did the *Select one automatically* option or underlying certificate selection mechanisms change with version 70? How exactly is the certificate selection *supposed to work*? Which parameters of the server's certificate request are used to select the appropriate certificate from my local database? Is there some debug logging I can turn on to further investigate this problem? Thanks for any ideas! -Marc

모든 댓글 (5)

more options

To clear your SSL session state in Firefox choose History -> Clear Recent History... and then select "Active Logins" and click "Clear Now". Then the next time you connect to your SSL server Firefox will prompt for which certificate to use.

more options

Unfortunately my problem is exactly the opposite: I don't want to be prompted but Firefox should select the correct certificate automatically.

As written above, to me it seems that something changed (or even broke?) here with Firefox 70.

-Marc

more options

this is about the user interface and preferences if TLS/SSL is used for client authentication.

may help: https://bugzilla.mozilla.org/show_bug.cgi?id=356060

more options

Thanks, Senali. Unfortunately I can't see how that applies to my problem.

more options

A document related to client certificate selection: https://wiki.mozilla.org/PSM:CertPrompt