Firefox doesn't ask me for a certificate when visiting a site that needs one

Question

I use Firefox 44.0.2 on a Linux Xubuntu system. I'm trying to access a company website that requires a certificate.

I can confirm I have the correct certificate in Preferences->Advanced->Certificates->View Certifacates->Your Certificates

It's there and it's the same certificate I successfully use on my Chrome browser on my Windows machine. When I try to access the website from the Windows Chrome, I get a pop up asking me to select one of my certs, I select the correct one and everything works.

My issue is that Firefox on my Linux never prompts me to select a certificate when I try to access the website. I just get a "400 No required SSL certificate was sent."

How can I get Firefox to prompt me for a cert? Or how can I tell him which cert to use?

Solution 1

I have just been experimenting with this myself. It seems that Firefox will only prompt if you have already imported a certificate signed by the same issuer who has signed site's SSL certificate.

So get your CA to sign both the server and client certificates, then import the client certificate into Firefox (via the Preferences window.) The next time you visit the site, Firefox will notice that it has a client certificate signed by the same CA as the server's SSL certificate, so it will prompt you whether to use this or not.

Solution 2

I encountered this problem with Firefox, where it would only offer the certificate in a Private Browsing window.

I suspect this happened because I initially clicked Cancel on the User Identification Request dialog, with the Remember this decision box checked, as in this screenshot.

(Don't do this.)

I fixed this by going to Clear Recent History (CtrlShiftDel) and clearing the Site Preferences.

You might also be able to go to about:preferences#privacy -> View Certificates... -> Authentication Decisions, and Delete it from there:

Comments

[Craig Hicks]

Most people/organizations would use a public trusted CA for their main public facing URLs, and a private self-issued certificate for private/admin-related URLs. So that is not an option, and it certainly shouldn't be a requirement.

[Malvineous]

@CraigHicks: Hey don't shoot the messenger, I'm not a Firefox dev so I didn't make the rules! I just found out through experimentation that this is what it took to make it work. I would've suggested logging an issue for it but Mozilla stopped caring what its users wanted a long time ago so the chances of getting this fixed are basically zero.

[Craig Hicks]

:) Your effort is appreciated! However, I did succeed in loading in a privately created certificate to my Firefox browser following these instructions: knowledge.digicert.com/solution/SO5437.html. This was not a digicert certificate, but one I created myself.

[Seweryn Niemiec]

This answer is wrong. I'm using different CAs for server and client and it works without problems.

[Malvineous]

@SewerynNiemiec: You're commenting on an answer that is four years old, things have probably changed since then. Instead of telling people they are wrong, perhaps let everyone know the improvements that have been made since the answer was originally posted so long ago.

[Seweryn Niemiec]

@Malvineous I'm using this for years. I've just tested it on clean profile in Firefox 52 ESR and it works: server has cert from Let's Encrypt, user has cert from my private CA. Most probably your case is a result of SSL configuration on server side, not the logic of cert selection in FF.

[Malvineous]

@SewerynNiemiec Well the OP mentioned Firefox 44, but good to know that even in 52 ESR it has been fixed. If it is due to a server issue rather than a bug fixed in Firefox, it'd be good to post a new answer with details on what causes the problem.

[Emil Vatai]

"Authentication Decisions" did the trick for me. deleting cache/cookies/etc was not needed.