7

I'm currently testing a free personal SSL certificate (S/MIME client / authentication) from https://www.startssl.com, which installed directly into Firefox. Now when I store backup, I have to enter a password. But how is the certificate stored in Firefox itself secured? Shouldn't I have to enter a password at some point?

Improve this question
0

2 Answers 2

Reset to default
4

The "master password" that Firefox allows you to set, when remembering passwords for sites, is also used to protect the private keys for personal certificates (that is, they are encrypted with a key derived from that master password). Firefox may fail to suggest setting such a password when generating a new key if you instructed it not to use one.

Note that some other browsers let the operating system handles such things (e.g. under MacOS X, Chrome uses the OS-provided "Keychain" system for private key storage). Firefox, out of tradition, is self-contained in that respect.

Improve this answer
3
  • So since I never allowed Firefox to store passwords and therefore I didn't have to setup a master password, the certificate is currently unprotected :-/ Could I NTFS encrypt a specific file instead of setting up a master password?
    – Tobias Kienzler
    Oct 16, 2012 at 11:43
  • 1
    Tobias, just set a masterpassword and it will encrypt everything.
    – Lucas Kauffman
    Oct 16, 2012 at 12:38
  • 1
    I am not sure about NTFS encryption; however, the relevant files are in your Firefox profile (see your Application Data/Mozilla/Firefox/Profiles/... ; the files are cert8.db and key3.db).
    – Thomas Pornin
    Oct 16, 2012 at 12:40
3

The SSL certificate to authenticate to startSSL is like a key, FF does provide a way for someone with access to the machine to export the keys, unless you set the password manager's password. (see Thomas Pornin)

If that password is not set you will be dependable on your OS security.

Improve this answer
11
  • So it is stored unencrypted? That doesn't sound very secure... Is there at least a file which I could/should NTFS-encrypt then?
    – Tobias Kienzler
    Oct 16, 2012 at 9:39
  • Well yea, it relies on the OS security I think (as I said it might be that the master password also will encrypt private keys) I just always use full disk encryption to protect my OS, so if I loose my laptop or someone gets physical access to they would not be able to access my private key.
    – Lucas Kauffman
    Oct 16, 2012 at 9:48
  • 1
    Firefox doesn't rely on the OS at all for managing certificates and private keys. It uses its own Software Security Device (Option -> Advanced -> Encryption -> Security Devices) or PKCS#11 modules. If you don't use a master password on it, someone will be able to extract and save the private key and the certificate (export to .p12) (e.g. when FF is running or after copying the user's profile). Hence, it's important to use a master password.
    – Bruno
    Oct 16, 2012 at 12:44
  • @Bruno That sounds pretty annoying, especially the fact that there is not a single warning on this. But could I also use NTFS encryption of my Firefox profile instead?
    – Tobias Kienzler
    Oct 16, 2012 at 12:55
  • @TobiasKienzler, you can use NTFS encryption if you want, but it's certainly better (or complementary) to use FF's encryption by setting a master password in your FF settings. This should encrypt key3.db as Thomas said.
    – Bruno
    Oct 16, 2012 at 13:05

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .