6

Navigating to about:preferences#advanced in a recent version of Firefox presents a View Certificates button. Clicking that button brings up the Certificate Manager window. The Authorities tab in that window displays details of the certificate authorities (aka CAs) whose public certificates have been installed in the particular Firefox instance (or perhaps just the particular Firefox profile) currently in use.

This tab contains a table with two columns: Certificate Name and Security Device.

For each such CA, at least one entity exists in the table. At a glance, all the entities appear to be certificates, but I will continue to refer to them simply as "entities" here, as I have not (yet) checked them all. Each entity has an entry in both the Certificate Name and Security Device columns.

There appear to be only two valid values for entries in the Security Device column:

  • Builtin Object Token
  • Software Security Device

What is the (intended) difference between these two kinds of entity?

4

In response to a similar question posed by David E. Ross in 2011, Brian Smith (Mozilla developer) and Kathleen Wilson (Mozilla CA Program Manager) confirmed that:

  • Builtin Object Tokens are root certificates in the default Network Security Services (NSS) database as installed on the user's PC when the user installed the software (e.g., Firefox) that uses them.

  • A BuiltIn Object Token will continue to be [a Builtin Object Token], even if the user changes the trust bits.

  • A Software Security Device can hold all kinds of certificates, not just root certificates.

  • For the Authorities list in the Certificate Manager, the certs that are labeled "Software Security Device" are root and intermediate certs that have been imported (e.g. not in the default list). The intermediate certs are often automatically imported, such as when you visit a website with an SSL cert signed by an intermediate CA.

  • So in other words if I visit one site which has a LetsEncrypt certificate (for example) then the LetsEncrypt CA signing certificate gets stored in Firefox in the software security device (I just checked, it is). So then if I visit another LetsEncrypt certificate site it doesn't need to have the full certificate chain because the second site's signing certificate will be in my security device already. – delatbabel Jan 11 '17 at 3:53
  • 1
    Which is why visiting a site with your browser isn't a great test to see if the certificate is set up correctly -- if the chain is missing but I've previously visited a site where the certificate was signed by the same (non-builtin) CA, then my browser won't throw an error due to the missing chain, which another user may see. i.e. always do an SSL labs test or similar. – delatbabel Jan 11 '17 at 3:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.