We're calling on all EU-based Mozillians with iOS or iPadOS devices to help us monitor Apple’s new browser choice screens. Join the effort to hold Big Tech to account!

为提升您的使用体验，本站正在维护，部分功能暂时无法使用。如果本站文章无法解决您的问题，您想要向社区提问的话，请到 Twitter 上的 @FirefoxSupport 或 Reddit 上的 /r/firefox 提问，我们的支持社区将会很快回复您的疑问。

Avatar for Username

搜索 | 用户支持

防范以用户支持为名的诈骗。我们绝对不会要求您拨打电话或发送短信，及提供任何个人信息。请使用“举报滥用”选项报告涉及违规的行为。

详细了解

话题已存档。 如果需要帮助请提出新问题。

Certificate Based Authentication and SmartCard requirements

  • 1 个回答
  • 1 人有此问题
  • 1 次查看
  • 最后回复者为 ygini

ygini
ygini
more options

Hello,

We are using Firefox on macOS to access web services that require Certificate Based Authentication. Our certificates are stored on YubiKeys PIV slots.

If we plug the token, open Firefox and access the website, it works just fine. The Certificate picker is shown and the OS ask for the PIV PIN to validate the access.

However, if we do the request when the token isn't plugged, Firefox does not ask for it, the website deny the authentication and the context is kept in cache. Requesting again the web site with the token added in between does not restart the certificate lookup and we are forced to close Firefox or move to a private window to make it works.

What is the proper way to avoid this issue? Is it a known bug? Is there a way to configure Firefox to always show the certificate picker even if no certificate are found and then reload the list of certificate based on connections events?

Thanks

Hello, We are using Firefox on macOS to access web services that require Certificate Based Authentication. Our certificates are stored on YubiKeys PIV slots. If we plug the token, open Firefox and access the website, it works just fine. The Certificate picker is shown and the OS ask for the PIV PIN to validate the access. However, if we do the request when the token isn't plugged, Firefox does not ask for it, the website deny the authentication and the context is kept in cache. Requesting again the web site with the token added in between does not restart the certificate lookup and we are forced to close Firefox or move to a private window to make it works. What is the proper way to avoid this issue? Is it a known bug? Is there a way to configure Firefox to always show the certificate picker even if no certificate are found and then reload the list of certificate based on connections events? Thanks

所有回复 (1)

ygini
ygini 提问者
more options

Hello

Thanks for your answer but we are running 91.5.1esr and this feature isn't linked to the issue we describe.

This feature is a long waited support that allow Firefox to works with native OS certificate store. Which mean the certificate picker that I talk in my post is finally able to see certificate distributed by enterprise policies. Which is great.

But the issue I describe isn't here.

The issue I describe is that Firefox doesn't show this certificate picker if it cannot find any suitable option.

Which does not let the opportunity for the user to connect a SmartCard.