Spletno mesto bo delovalo z omejenimi zmožnostmi, medtem ko na njem izvajamo vzdrževalna dela za vas. Če članki ne rešijo vaše težave in želite zastaviti vprašanje, naša skupnost za podporo čaka na vas na @FirefoxSupport na Twitterju in na /r/firefox na Redditu.

Avatar for Username

Iskanje po podpori

Izogibajte se prevarantski tehnični podpori. Nikoli vam ne bomo naročili, da pokličete telefonsko številko ali nam pošljete osebne podatke. Sumljivo dejavnost prijavite z gumbom »Prijavi zlorabo«.

Več o tem

Ta tema je arhivirana. Postavite prosim novo vprašanje, če potrebujete pomoč.

How to enable SHA3 Certificate Signature Algorithm in Thunderbird and FF ?

  • 4 odgovori
  • 1 ima to težavo
  • 1 ogled
  • Zadnji odgovor od Matt

kokoro1
kokoro1
more options

How to enable SHA3 Certificate Signature Algorithm in Thunderbird and Firefox, please ?

In this sample, i imported a RSA certificate generated by openssl with default_md=sha3-512.

But Thunderbird and FF do not accept them with these errors : - "Could not verify this certificate because it was signed using a signature algorithm that was disabled because that algorithm is not secure" - the missing algorithm name substituted by the related OID.

Best Regards, kokoro

Reminder: SHA3 is the new hash adopted by NIST on 2015/08/05, being a more secure alternative to SHA2. It should be supported by FF/Thunderbird to take the immediate backup of SHA2.

How to enable SHA3 Certificate Signature Algorithm in Thunderbird and Firefox, please ? In this sample, i imported a RSA certificate generated by openssl with default_md=sha3-512. But Thunderbird and FF do not accept them with these errors : - "Could not verify this certificate because it was signed using a signature algorithm that was disabled because that algorithm is not secure" - the missing algorithm name substituted by the related OID. Best Regards, kokoro Reminder: SHA3 is the new hash adopted by NIST on 2015/08/05, being a more secure alternative to SHA2. It should be supported by FF/Thunderbird to take the immediate backup of SHA2.
Priloženi posnetki zaslona

Spremenil kokoro1

Vsi odgovori (4)

Matt
Matt
  • Moderator
  • Top 10 Contributor
more options

any certificate less that 2400 bit has been deprecated and as you see generates an error because they are no more secure than having no certificate.

openSSL will not generate a certificate you can install in any case as there is no certifying authority recognized for self signed certificates.

christ1
christ1
  • Top 25 Contributor
more options

Firefox 67 currently supports these signature algorithms: SHA256/ECDSA, SHA384/ECDSA, SHA512/ECDSA, RSA_PSS_SHA256, RSA_PSS_SHA384, RSA_PSS_SHA512, SHA256/RSA, SHA384/RSA, SHA512/RSA, SHA1/ECDSA, SHA1/RSA

I don't see SHA-3 there, so I don't expect Thunderbird to support it either.

kokoro1
kokoro1 Lastnik vprašanja
more options

FF/Thunderbird (NCC) "policy" should support SHA3, as openssl is supporting it since the latest release about one year ago.

Thank you for your 2 gentle inputs. One may not compare PK size and signature strength, moreover each algorithm has its own size references about strength. If you want to compare strength for signature, checkout for instance https://en.wikipedia.org/wiki/Template:Comparison_of_SHA_functions. Self-sign is an unrelated topic, my certificates being CA signed indeed :)

Matt
Matt
  • Moderator
  • Top 10 Contributor
more options

The bug indicates it is not yet supported. All we can do here is advise you of the status of the bug and remind you this is a support forum, not a point of advocacy as to what features the product should implement

See bug https://bugzilla.mozilla.org/show_bug.cgi?id=1342546