I deleted SSL security certificates from Thunderbird. How can I replace them?
I've done my due diligence in an effort to find my answers on my own, but I have simply failed -- kind of like deleting many SSL security certificates was evidently its own failure. I'll accept any deserved ragging that comes with earnest attempts at help :-P . (I've spent the afternoon answering and replying to a number of others' questions in an attempt to, first of all help them, and then maybe even build up some measure of "good karma" to deserve help from others a little more *wink*. But now, I need to get my question asked after days of off and on searching.) This isn't the worst problem in the world right now, and I'm hoping the solution is actually easy for someone to provide.
I deleted SSL security certificates from Thunderbird. How can I replace them? (Even just the ones that should come pre-installed in Thunderbird? I don't expect anyone to know how or where I got any others, if I have.)
I tried copying cert8.db from a fresh install of Thunderbird, hoping that would reinstall the "base" certificates that come with it. I've read about Mozilla's own security store but have not found a way to download or import from there.
Problems include:
- Getting the 'Add Security Exception' dialog box for Gmail accounts -- which would not be a problem IF the 'Get Certificate' button worked, or IF the 'Confirm Security Exception' button (not ideal, but...) worked permanently with the 'Permanently store this exception' checkbox checked.
- Some e-mail from restaurants and another source that have been sending me mail for a while just won't display their images any more, even after making an appropriate selection in the tooltip-yellow bar that asks about allowing resources to be downloaded. I think the same thing happens in some USPS notifications as well.
That's all I can think of to add at this point. By all means, please do prompt me for more information that might help, if needed. You can write to me as someone versed in tech support and much general IT. (I already said I'd accept deserved ragging, right?
All Replies (3)
Hi c.v. I am no expert and am answering partly to welcome you to the TB team! I have been reading your answers, and wanted to thank you. I know you searched already and I may be way off base - but I did find something that might be of use. https://knowledge.digicert.com/solution/SO4292.html and https://knowledge.digicert.com/solution/SO6395.html Not directly applicable but suggests there is a way to export certificates from Firefox to import to TB. This comes with absolutely no guarantees and might be an Alice rabbit-hole. Fair warning. Agnes
Chosen Solution
I tried copying cert8.db from a fresh install of Thunderbird, hoping that would reinstall the "base" certificates that come with it.
cert8.db is obsolete. cert9.db is the new file used for security certificates. It works together with key4.db, and should be copied together.
If you delete both, cert9.db and key4.d built-in certificates get restored upon next Thunderbird restart. So you'd loose personal certs and remembered passwords. If you do this, make sure you know all your account passwords.
Any personal certs would need to be imported again from a backup. You did not indicate what certs got lost.
Alternatively copy over both, cert9.db and key4.d from a different profile if that's feasible.
Getting the 'Add Security Exception' dialog box for Gmail accounts
What is the exact error code? Please post a screenshot.
https://support.mozilla.org/kb/how-do-i-create-screenshot-my-problem
AgnesRM and christ1, I thank you both from the bottom of my keyboard *winky emoji*. [When I included the actual Windows emoji, then had reason to edit my reply, everything I typed after the emoji had disappeared. Sigh, I had been so eloquent, too *laughs*. So I'm starting over.] AngesRM, I truly appreciate your warm welcome back, and sincere efforts to help as well, even potential "rabbit-holes" -- I was already in the warrens, anyway, in fact, searching anywhere DuckDuckGo.com would reach :) . Everywhere I looked just got too cluttered with other security certificate-related information. I'm glad I looked, but glad I finally asked for help directly.
SOLVED! Christ1, yours was the solution, and is so marked now. I am convinced. When I restarted after copying the cert9.db & key4.db files from a backup to my main installation (... and deleting the obsolete pair of files cert8.db & key3.db, and also deleting cert_override.txt [1]), Thunderbird restarted without a hitch -- no surprise, it always did. But I also got no "confirm security exception" dialogs on initial mail-fetch, or on subsequent manual or automatic individual mail fetches, or on use of 'Get All Mail Accounts'. And more immediately telling to me, images are again visible in the same letters I referred to earlier (from restaurants and other businesses including the USPS), letters containing remote resources from the 'net that weren't being displayed in spite of permissions.
[1] The optional file cert_override.txt contains security certificate exceptions -- see <http://kb.mozillazine.org/Files_and_folders_in_the_profile_-_Thunderbird>, last modified 05:45, 1 June 2019 as of my writing.
christ1, I also appreciate your well-placed warnings about passwords and personal certificates. I myself don't have to worry about either, but the warnings are good for future readers. (I never save passwords, or write them on post-it notes or scribble them in permanent marker on my display screen ..., so I know them all. And I have never had any certificates created for me or knowingly downloaded any additional ones, so I'll be just fine there.) When I did a quick search to learn about cert9.db and key4.db, that's when I found the "files and folders in the profile" article, and found out about the optional file cert_override.txt as well. I deleted that because I knew that I had tried to confirm security exceptions for Google A LOT since having the problem, and figured it was best to clear out anything that MIGHT even be there, even though they didn't seem to "stick"; if I *had* ever had reason to allow others that were still needed, I figured I'd just be prompted again and make appropriate choices going forward. (Even with problems, I was still able to get and send all my mail, and nothing I couldn't see was *critical* so far.) As it turns out, though, the only exceptions listed in my backup's cert_override.txt file were from an old defunct mail service that I don't use anymore, so I just deleted that file in both my main and backup installations.
note: I was getting the "confirm security exception" dialog from Thunderbird repeatedly, but no actual error codes or messages, and nothing from mail servers. Since the root problem is solved, and they wouldn't inform the solution, I'm not bothering with creating and attaching screenshots.
Good thing including instructions for taking a screenshot, too, christ1, thoughtful. I knew how already, but your thoughtfulness and thoroughness are appreciated. You appreciate them, too, future readers!
Modified by C.V.