Tránh các lừa đảo về hỗ trợ. Chúng tôi sẽ không bao giờ yêu cầu bạn gọi hoặc nhắn tin đến số điện thoại hoặc chia sẻ thông tin cá nhân. Vui lòng báo cáo hoạt động đáng ngờ bằng cách sử dụng tùy chọn "Báo cáo lạm dụng".

Tìm hiểu thêm

PKI / CAC certificate issue

  • 5 trả lời
  • 2 gặp vấn đề này
  • 619 lượt xem
  • Trả lời mới nhất được viết bởi guigs

CAC authentication has been enabled, and Firefox sees the certificates. When going to a site that requires this identification, the box does appear and a certificate can be chosen. The setting for "security.remember_cert_checkbox_default_setting:" has been set to "false" because different sites require different certificates (there are 2-3 on the card.)

The problem comes if a user checks the box to "Remember this decision" regardless of whether the correct certificate was chosen. Once the box is checked on a website that requires the identity, the browser stores that somewhere (that is a question I need answered), but that does not negate the need to choose a certificate as the user would think. Instead, it will open the selection window and it will have the remembered cert on top. That would not be bad, except the browser then opens the selection box many times. The one I'm working on now used to ask me to pick a cert one time, now I have to select one SEVEN TIMES before the site loads. Additionally, the site in question refreshes itself periodically and the user has to select the certificate multiple times again. Since we use Firefox due to slow performance of the site in IE, this issue negates the advantage gained.

So my question is how do we remove the decision remembered by the browser?

Things we have tried:

  • SSL cache cleared.
  • Remove personal certificates and restart browser.
  • Reload Certificate Authorities.
  • Reset browser to default state then reload the card readers.
  • Reinstall Firefox
  • Deleting C:\Users\(affected user)\AppData\Local\Mozilla\Firefox <and> C:\Users\(affected user)\AppData\Roaming\Mozilla\Firefox

Any thoughts? What file stores these decisions?

CAC authentication has been enabled, and Firefox sees the certificates. When going to a site that requires this identification, the box does appear and a certificate can be chosen. The setting for "security.remember_cert_checkbox_default_setting:" has been set to "false" because different sites require different certificates (there are 2-3 on the card.) The problem comes if a user checks the box to "Remember this decision" regardless of whether the correct certificate was chosen. Once the box is checked on a website that requires the identity, the browser stores that somewhere (that is a question I need answered), but that does not negate the need to choose a certificate as the user would think. Instead, it will open the selection window and it will have the remembered cert on top. That would not be bad, except the browser then opens the selection box many times. The one I'm working on now used to ask me to pick a cert one time, now I have to select one SEVEN TIMES before the site loads. Additionally, the site in question refreshes itself periodically and the user has to select the certificate multiple times again. Since we use Firefox due to slow performance of the site in IE, this issue negates the advantage gained. So my question is how do we remove the decision remembered by the browser? Things we have tried: *SSL cache cleared. *Remove personal certificates and restart browser. *Reload Certificate Authorities. *Reset browser to default state then reload the card readers. *Reinstall Firefox *Deleting C:\Users\(affected user)\AppData\Local\Mozilla\Firefox <and> C:\Users\(affected user)\AppData\Roaming\Mozilla\Firefox Any thoughts? What file stores these decisions?

Được chỉnh sửa bởi AKjackal vào

Giải pháp được chọn

You can check if you can find a security related pref on the about:config page.

You can try to rename the cert8.db file in the Firefox profile folder to cert8.db.old or delete the cert8.db file to remove intermediate certificates that Firefox has stored.

If that helped to solve the problem then you can remove the renamed cert8.db.old file. Otherwise you can rename (or copy) the cert8.db.old file to cert8.db to restore the previous intermediate certificates. Firefox will automatically store intermediate certificates when you visit websites that send such a certificate.

If that didn't help then remove or rename secmod.db (secmod.db.old) as well.

Đọc câu trả lời này trong ngữ cảnh 👍 1

Tất cả các câu trả lời (5)

There are two places I would check: Firstly go to about:permissions and search for the site. Clicking to forget the site will remove it from the cache. Secondly, please check the certificate manager, you may be able to remove the cert to reset the setting.

I am also asking in #security to see if we can find this preference.

Edit: Preferences -> Advanced -> Certificates -> View Certificates -> Servers

Thank you.

Được chỉnh sửa bởi guigs vào

Forgetting the site and removing certs did not fix this. I am thinking it is going to either be a setting in about:config or a cached file somewhere on the hard disk.

Giải pháp được chọn

You can check if you can find a security related pref on the about:config page.

You can try to rename the cert8.db file in the Firefox profile folder to cert8.db.old or delete the cert8.db file to remove intermediate certificates that Firefox has stored.

If that helped to solve the problem then you can remove the renamed cert8.db.old file. Otherwise you can rename (or copy) the cert8.db.old file to cert8.db to restore the previous intermediate certificates. Firefox will automatically store intermediate certificates when you visit websites that send such a certificate.

If that didn't help then remove or rename secmod.db (secmod.db.old) as well.

Ok, I did a bad thing. I did two changes at one time while troubleshooting. While renaming the cert8.db file to a .old extension, I noticed another possible culprit just above it. The file was cert_override.txt and I put a .old on that one also.

So far, I have not gotten the annoying identity checks I was experiencing before. Marked this as answered. Thank you guys/gals!

Yes that is the file that stores the preferences: cert_override.txt

  1. security irc channel confirmed earlier today. cheers!