After playing around a bit with openssl, I created a PKCS12 certificate which imports flawlessly in Firefox while Thunderbird "Could not verify this certificate for unknown reasons". Talk about a helpful error message here. While I managed to solve the problem (the certificate had an extendedKeyUsage of emailProtection,clientAuth while the signing CA had emailProtection only - why did Firefox import it then?!) in this case, I'd like to know about a less trial-and-error way to figure out why a specific certificate fails.

I could find a large number of threads and bug reports, e.g. this, which suggest whatever library is internally used does actually provide more meaningful error messages, but I don't have an idea where to start calling it or whether some simple command line tools exist to achieve this. So in summary:

How to figure out why a Mozilla product rejects importing a certificate "for unknown reasons"

1 Answer 1


Last I had to do something like that, I ploughed through NSS source code. NSS is the library which Mozilla products use for all things crypto. Ultimately, you could compile your own Thunderbird and run it in a debugger (or spread printf() calls throughout the NSS code, for some old-style analysis).

Apart from that, it is mostly guesswork. You did it quite well: by importing the same certificate into Firefox and Thunderbird, both using the same NSS code, you actually showed that the detail you were after had to be something about emails -- which then points to extended key usage and "usage rules" that NSS can attach to a given root.

At least, NSS is opensource. Try doing the same for Windows/IE next time...

  • Oh dear, that sounds like fun... I'm especially confused since that certificate should have been rejected by Firefox (it's CA doesn't have the clientAuth extension, and what would Firefox do about email?) and maybe tolerated by Thunderbird (why should it bother about clientAuth anyway). In one of the posts about this error "message" someone mentioned pk12util, but that only lists the contents, and certtool doesn't seem to cope with pkcs12 files. But why doesn't Mozilla simply output the error message that apparently is generated? Feb 15, 2013 at 17:08
  • 1
    To some extent, Firefox does not need to care about whatever certificate you give it to play with, because that certificate is not for it; it is for the SSL server who asks for it. Theoretically, you never have to validate or trust your own certificate. Feb 15, 2013 at 18:06
  • Good point, that makes sense. Though the same should then be true for Thunderbird, since it's in the recipient's interest to validate a sent certificate... Feb 16, 2013 at 19:19

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .