PKI / CAC certificate issue
CAC authentication has been enabled, and Firefox sees the certificates. When going to a site that requires this identification, the box does appear and a certificate can be chosen. The setting for "security.remember_cert_checkbox_default_setting:" has been set to "false" because different sites require different certificates (there are 2-3 on the card.)
The problem comes if a user checks the box to "Remember this decision" regardless of whether the correct certificate was chosen. Once the box is checked on a website that requires the identity, the browser stores that somewhere (that is a question I need answered), but that does not negate the need to choose a certificate as the user would think. Instead, it will open the selection window and it will have the remembered cert on top. That would not be bad, except the browser then opens the selection box many times. The one I'm working on now used to ask me to pick a cert one time, now I have to select one SEVEN TIMES before the site loads. Additionally, the site in question refreshes itself periodically and the user has to select the certificate multiple times again. Since we use Firefox due to slow performance of the site in IE, this issue negates the advantage gained.
So my question is how do we remove the decision remembered by the browser?
Things we have tried:
- SSL cache cleared.
- Remove personal certificates and restart browser.
- Reload Certificate Authorities.
- Reset browser to default state then reload the card readers.
- Reinstall Firefox
- Deleting C:\Users\(affected user)\AppData\Local\Mozilla\Firefox <and> C:\Users\(affected user)\AppData\Roaming\Mozilla\Firefox
Any thoughts? What file stores these decisions?
Modified by AKjackal
Chosen solution
You can check if you can find a security related pref on the about:config page.
You can try to rename the cert8.db file in the Firefox profile folder to cert8.db.old or delete the cert8.db file to remove intermediate certificates that Firefox has stored.
If that helped to solve the problem then you can remove the renamed cert8.db.old file. Otherwise you can rename (or copy) the cert8.db.old file to cert8.db to restore the previous intermediate certificates. Firefox will automatically store intermediate certificates when you visit websites that send such a certificate.
If that didn't help then remove or rename secmod.db (secmod.db.old) as well.
Read this answer in context 👍 1All Replies (5)
There are two places I would check: Firstly go to about:permissions and search for the site. Clicking to forget the site will remove it from the cache. Secondly, please check the certificate manager, you may be able to remove the cert to reset the setting.
I am also asking in #security to see if we can find this preference.
Edit: Preferences -> Advanced -> Certificates -> View Certificates -> Servers
Thank you.
Modified by guigs
Forgetting the site and removing certs did not fix this. I am thinking it is going to either be a setting in about:config or a cached file somewhere on the hard disk.
Chosen Solution
You can check if you can find a security related pref on the about:config page.
You can try to rename the cert8.db file in the Firefox profile folder to cert8.db.old or delete the cert8.db file to remove intermediate certificates that Firefox has stored.
If that helped to solve the problem then you can remove the renamed cert8.db.old file. Otherwise you can rename (or copy) the cert8.db.old file to cert8.db to restore the previous intermediate certificates. Firefox will automatically store intermediate certificates when you visit websites that send such a certificate.
If that didn't help then remove or rename secmod.db (secmod.db.old) as well.
Ok, I did a bad thing. I did two changes at one time while troubleshooting. While renaming the cert8.db file to a .old extension, I noticed another possible culprit just above it. The file was cert_override.txt and I put a .old on that one also.
So far, I have not gotten the annoying identity checks I was experiencing before. Marked this as answered. Thank you guys/gals!
Yes that is the file that stores the preferences: cert_override.txt
- security irc channel confirmed earlier today. cheers!