4

We have a website that authenticates the user using a certificate. The certificate is installed by the IT department and I can't export it with the private key.

When I navigate the website with Chrome or MS Edge they prompt me to choose the certificate I want to use. I assume they query the Windows certificate storage for that. The Firefox doesn't "see" that certificate.

How can I use the certificate authentication with Firefox?

Improve this question

1 Answer 1

Reset to default
8
+100

If you want to use a certificate installed in the Windows certificate store you need some kind of connector between the CryptoAPI provided by Windows and the PKCS standard used by Firefox. One example is P11CAPI that was originally intended for smartcards but should work for any installed certificate in the Windows certificate store.

Once you download the DLL that matches the bitness of Firefox you use follow the instructions in the above link (paraphrased in part below) to use the Windows certificate store in Firefox:

  1. Inside Firefox, go to Options → Privacy & Security → Certificates → Security Devices → Load
  2. Enter a module name (I recommend "p11-capi") and browse to the .DLL file.
  3. Click OK enough times to close out the various dialogs that have been opened.

Edit: From v72 on: "Experimental support for using client certificates from the OS certificate store can be enabled by setting the preference security.osclientcerts.autoload to true."

Improve this answer
3
  • 1
    Can confirm the edit. This will allow Firefox to actually select a client certificate rather than displaying a meaningless SSL_ERROR_HANDSHAKE_FAILURE_ALERT after failing to provide the server with a certificate.
    – Lilienthal
    Commented Sep 9, 2020 at 14:54
  • 1
    @Lilienthal glad that could help. I haven't checked on newer versions to see if this feature is out of 'experimental' but it must be close. Thank you also for documenting the error; it's easy to forget what's clear to me (having seen it often) is meaningless to others.
    – Dan
    Commented Sep 9, 2020 at 15:54
  • 1
    To be clear it's more that it's an incredibly vague error compared to the similar error in IE or Chrome which will actually point towards failure to provide a (valid) certificate. The Firefox error can cover a lot of potential problems.
    – Lilienthal
    Commented Sep 9, 2020 at 17:48

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .