Join the AMA (Ask Me Anything) with the Firefox leadership team to celebrate Firefox 20th anniversary and discuss Firefox’s future on Mozilla Connect. Mark your calendar on Thursday, November 14, 18:00 - 20:00 UTC!

Este site está com funcionalidades limitadas enquanto realizamos manutenção para melhorar sua experiência de uso. Se nenhum artigo resolver seu problema e você quiser fazer uma pergunta, nossa comunidade de suporte pode te ajudar em @FirefoxSupport no Twitter e /r/firefox no Reddit.

Avatar for Username

Pesquisar no site de suporte

Evite golpes de suporte. Nunca pedimos que você ligue ou envie uma mensagem de texto para um número de telefone, ou compartilhe informações pessoais. Denuncie atividades suspeitas usando a opção “Denunciar abuso”.

Saiba mais

Esta discussão foi arquivada. Faça uma nova pergunta se precisa de ajuda.

Client certificate authentication with certificiates issued with Root CA without CN

  • 2 respostas
  • 1 tem este problema
  • 18 visualizações
  • Última resposta de cor-el

blazmalnersic
blazmalnersic
more options

Hi,

we are experiencing issues with client certificate authentication in Firefox and we suspect issue could be related to "badly" formatted root CA certificate. The root CA certificate (issued in 2003) contains Subject without CN (only OU, O and C). Also the value of extension 2.5.29.19 parameter "Path Lenght Constraint" is set to string value "None" - usually should be numeric, e.g. 0.

The issue occurs when web server requires client certificate authentication - Internet Explorer and Chrome will offer client certificate issued with such CA while Firefox won't. We tested with two web servers, Apache, which sends the CTL to browser and IIS, which does not (checked with openssl s_client) and results were the same - Firefox will not offer client certificate issued with mentioned CA. We tested scenarios with certificate (and root CA certificate) stored in Software security device and on smart card.

Is this behaviour by design?

Best regards, 

    Blaz
Hi, we are experiencing issues with client certificate authentication in Firefox and we suspect issue could be related to "badly" formatted root CA certificate. The root CA certificate (issued in 2003) contains Subject without CN (only OU, O and C). Also the value of extension 2.5.29.19 parameter "Path Lenght Constraint" is set to string value "None" - usually should be numeric, e.g. 0. The issue occurs when web server requires client certificate authentication - Internet Explorer and Chrome will offer client certificate issued with such CA while Firefox won't. We tested with two web servers, Apache, which sends the CTL to browser and IIS, which does not (checked with openssl s_client) and results were the same - Firefox will not offer client certificate issued with mentioned CA. We tested scenarios with certificate (and root CA certificate) stored in Software security device and on smart card. Is this behaviour by design? Best regards, Blaz

Todas as respostas (2)

John99
John99
more options

Are you still looking for an answer to this ? I do not know the answer, but may be able to find someone who can help.

cor-el
cor-el
  • Moderator
  • Top 10 Contributor
more options

See this page for contact information: