RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.

Description of problem:
When server has a certificate signed with rsa-pss algorithm, Firefox rejects it with SEC_ERROR_CERT_SIGNATURE_ALGORITHM_DISABLED error

Version-Release number of selected component (if applicable):
nss-3.34.0-0.1.beta1.el7.x86_64
firefox-52.4.0-1.el7_4.x86_64

How reproducible:
always

Steps to Reproduce:
1. Create a regular RSA CA
2. Sign a server certificate with PKCS#1 RSASSA-PSS algorithm (certutil --pss-sign)
3. Import CA to Firefox
4. Start a server with the certificate signed in step 2.
5. Connect Firefox to the server

Actual results:
Your connection is not secure

Error code: SEC_ERROR_CERT_SIGNATURE_ALGORITHM_DISABLED

Expected results:
Connection established, certificate accepted as valid

Additional info:
Note that support for RSA-PSS in certificates on NSS side was added in 3.34.

Hm, is that something on FF side?

See also reply of Brian Smith in upstream bug.

It's an issue in mozilla::pkix, and mozilla::pkix is not part of NSS.

According to upstream this is unlikely to happen in the RHEL 7.5 time frame. So essentially there's nothing to do for the Firefox maintainers at Red Hat, but this is rather a tracking bug for this feature becoming available. Let's at least post pone this bug to 7.6.

Sorry we don't have a fix for that.

As you can see the upstream bug are still open. We can have this opened for tracking purpose if you wish but don't expect it in upcoming Firefox 68 ESR rebase.