X
Tap here to go to the mobile version of the site.

ஆதரவு மன்றம்

Firefox handling of certificate chains

  • 4 replies
  • 1 இந்த பிரச்சனை உள்ளது
  • Last reply by paul46
பதிவிடப்பட்டது

I have a scenario where the website being connected to, has a three level chain (Intermediate1, Intermediate2, Root). Both Intermediate2 and root CA's are present in the Firefox default trusted CA store (They are Centrum based certs). However the Intermediate1 cert (SpaceSSL CA) is not in the Firefox default trusted CA store, and consequently flags a problem when connecting to this website.

From a usability perspective it is not feasible for users to manually install the untrusted CA intermediate cert into Firefox (although this overcomes the connectivity issues if manually imported to the FF store).

Therefore I was wondering whether if the website server supplies the full cert chain file to Firefox whether Firefox will use that to 'bypass' the lack of trust of the SpaceSSL certificate or whether the same trust issues will remain (since SpaceSSL CA is not in the trusted store of FF).

Many thanks for the help.

Paul

I have a scenario where the website being connected to, has a three level chain (Intermediate1, Intermediate2, Root). Both Intermediate2 and root CA's are present in the Firefox default trusted CA store (They are Centrum based certs). However the Intermediate1 cert (SpaceSSL CA) is not in the Firefox default trusted CA store, and consequently flags a problem when connecting to this website. From a usability perspective it is not feasible for users to manually install the untrusted CA intermediate cert into Firefox (although this overcomes the connectivity issues if manually imported to the FF store). Therefore I was wondering whether if the website server supplies the full cert chain file to Firefox whether Firefox will use that to 'bypass' the lack of trust of the SpaceSSL certificate or whether the same trust issues will remain (since SpaceSSL CA is not in the trusted store of FF). Many thanks for the help. Paul
மேற்கோள்

Additional System Details

நிறுவப்பட்ட நிரல்கள்

None

பயன்பாடு

  • User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.121 Safari/537.36

கூடுதல் தகவல்

jscher2000
  • Top 10 Contributor
8638 தீர்வுகள் 70669 பதில்கள்
பதிவிடப்பட்டது

Hi Paul, Firefox expects websites to provide all intermediate certs needed to verify the site certificate up to a built-in root certificate. The certificate issuer typically provides a bundle file for that.

(Since Firefox caches intermediate certificates after verifying them, users may have different experiences with the site depending on whether they have used sites that have the same certificate chain.)

You can use the Qualys test page to verify that your chain is complete: https://www.ssllabs.com/ssltest/

Hi Paul, Firefox expects websites to provide all intermediate certs needed to verify the site certificate up to a built-in root certificate. The certificate issuer typically provides a bundle file for that. (Since Firefox caches intermediate certificates after verifying them, users may have different experiences with the site depending on whether they have used sites that have the same certificate chain.) You can use the Qualys test page to verify that your chain is complete: https://www.ssllabs.com/ssltest/
இது உங்களுக்கு பயனுள்ளதாக இருந்ததா?
மேற்கோள்
பதிவிடப்பட்டது

கேள்வியின் உரிமையாளர்

Thanks very much @jscher2000.

Just to clarify my understanding. Does this mean that if Firefox receives the cert chain file from the server which includes the full intermediate/root chain (including an already trusted root) that FF will fully trust the connection and will not flag any trust errors - even if the signed certificate is signed by an untrusted intermediate CA in that chain?

Thanks again.

Thanks very much @jscher2000. Just to clarify my understanding. Does this mean that if Firefox receives the cert chain file from the server which includes the full intermediate/root chain (including an already trusted root) that FF will fully trust the connection and will not flag any trust errors - even if the signed certificate is signed by an untrusted intermediate CA in that chain? Thanks again.
இது உங்களுக்கு பயனுள்ளதாக இருந்ததா?
மேற்கோள்
jscher2000
  • Top 10 Contributor
8638 தீர்வுகள் 70669 பதில்கள்
பதிவிடப்பட்டது

Hi Paul, trust is established on the fly by checking the certificate signatures. Firefox often has not seen an intermediate cert before, but it can be trusted as long as it was validly signed and can be verified up to a trusted root certificate. After verification, it will be cached and show up in the Certificate Manager dialog, Authorities tab, with the designation "Software Security Device" (instead of "Builtin Object Token").

The server doesn't need to send the root certificate that is already included with browsers, and probably shouldn't. I think the SSL Labs test views that as a configuration error. Your bundle only needs to include the intermediate certs. Your certificate issuer should tell you which ones you need to serve.

Hi Paul, trust is established on the fly by checking the certificate signatures. Firefox often has not seen an intermediate cert before, but it can be trusted as long as it was validly signed and can be verified up to a trusted root certificate. After verification, it will be cached and show up in the Certificate Manager dialog, Authorities tab, with the designation "Software Security Device" (instead of "Builtin Object Token"). The server doesn't need to send the root certificate that is already included with browsers, and probably shouldn't. I think the SSL Labs test views that as a configuration error. Your bundle only needs to include the intermediate certs. Your certificate issuer should tell you which ones you need to serve.
இது உங்களுக்கு பயனுள்ளதாக இருந்ததா?
மேற்கோள்
பதிவிடப்பட்டது

கேள்வியின் உரிமையாளர்

Great. Thanks very much. Understood. I appreciate the speedy assistance.

Great. Thanks very much. Understood. I appreciate the speedy assistance.
இது உங்களுக்கு பயனுள்ளதாக இருந்ததா?
மேற்கோள்
கேள்வி எழுப்பு

You must log in to your account to reply to posts. Please start a new question, if you do not have an account yet.