Bug 1509953 - Firefox doesn't accept server certificates with RSA-PSS signatures
Summary: Firefox doesn't accept server certificates with RSA-PSS signatures
Keywords:
Status: CLOSED WONTFIX
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: firefox
Version: 7.5
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: rc
: ---
Assignee: Martin Stransky
QA Contact: Desktop QE
URL:
Whiteboard:
Depends On: rhel7-rsa-pss-in-nss
Blocks:
TreeView+ depends on / blocked
 
Reported: 2017-11-06 12:29 UTC by Hubert Kario
Modified: 2019-08-23 12:14 UTC (History)
1 user (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2019-08-23 06:28:01 UTC
Target Upstream Version:


Attachments (Terms of Use)


Links
System ID Priority Status Summary Last Updated
Mozilla Foundation 1005084 None None None 2019-03-14 17:02:27 UTC
Mozilla Foundation 1088140 None None None 2019-03-14 17:02:27 UTC

Description Hubert Kario 2017-11-06 12:29:37 UTC
Description of problem:
When server has a certificate signed with rsa-pss algorithm, Firefox rejects it with SEC_ERROR_CERT_SIGNATURE_ALGORITHM_DISABLED error

Version-Release number of selected component (if applicable):
nss-3.34.0-0.1.beta1.el7.x86_64
firefox-52.4.0-1.el7_4.x86_64

How reproducible:
always

Steps to Reproduce:
1. Create a regular RSA CA
2. Sign a server certificate with PKCS#1 RSASSA-PSS algorithm (certutil --pss-sign)
3. Import CA to Firefox
4. Start a server with the certificate signed in step 2.
5. Connect Firefox to the server

Actual results:
Your connection is not secure

Error code: SEC_ERROR_CERT_SIGNATURE_ALGORITHM_DISABLED

Expected results:
Connection established, certificate accepted as valid

Additional info:
Note that support for RSA-PSS in certificates on NSS side was added in 3.34.

Comment 1 Martin Stransky 2017-11-06 12:36:16 UTC
Hm, is that something on FF side?

Comment 2 Hubert Kario 2017-11-06 15:41:33 UTC
See also reply of Brian Smith in upstream bug.

It's an issue in mozilla::pkix, and mozilla::pkix is not part of NSS.

Comment 3 Kai Engert (:kaie) (inactive account) 2017-11-28 15:30:17 UTC
According to upstream this is unlikely to happen in the RHEL 7.5 time frame. So essentially there's nothing to do for the Firefox maintainers at Red Hat, but this is rather a tracking bug for this feature becoming available. Let's at least post pone this bug to 7.6.

Comment 4 Martin Stransky 2019-08-23 06:28:01 UTC
Sorry we don't have a fix for that.

Comment 6 Martin Stransky 2019-08-23 12:14:37 UTC
As you can see the upstream bug are still open. We can have this opened for tracking purpose if you wish but don't expect it in upcoming Firefox 68 ESR rebase.


Note You need to log in before you can comment on or make changes to this bug.