1

After playing around a bit with openssl, I created a PKCS12 certificate which imports flawlessly in Firefox while Thunderbird "Could not verify this certificate for unknown reasons". Talk about a helpful error message here. While I managed to solve the problem (the certificate had an extendedKeyUsage of emailProtection,clientAuth while the signing CA had emailProtection only - why did Firefox import it then?!) in this case, I'd like to know about a less trial-and-error way to figure out why a specific certificate fails.

I could find a large number of threads and bug reports, e.g. this, which suggest whatever library is internally used does actually provide more meaningful error messages, but I don't have an idea where to start calling it or whether some simple command line tools exist to achieve this. So in summary:

How to figure out why a Mozilla product rejects importing a certificate "for unknown reasons"

|improve this question
2

Last I had to do something like that, I ploughed through NSS source code. NSS is the library which Mozilla products use for all things crypto. Ultimately, you could compile your own Thunderbird and run it in a debugger (or spread printf() calls throughout the NSS code, for some old-style analysis).

Apart from that, it is mostly guesswork. You did it quite well: by importing the same certificate into Firefox and Thunderbird, both using the same NSS code, you actually showed that the detail you were after had to be something about emails -- which then points to extended key usage and "usage rules" that NSS can attach to a given root.

At least, NSS is opensource. Try doing the same for Windows/IE next time...

|improve this answer
  • Oh dear, that sounds like fun... I'm especially confused since that certificate should have been rejected by Firefox (it's CA doesn't have the clientAuth extension, and what would Firefox do about email?) and maybe tolerated by Thunderbird (why should it bother about clientAuth anyway). In one of the posts about this error "message" someone mentioned pk12util, but that only lists the contents, and certtool doesn't seem to cope with pkcs12 files. But why doesn't Mozilla simply output the error message that apparently is generated? – Tobias Kienzler Feb 15 '13 at 17:08
  • 1
    To some extent, Firefox does not need to care about whatever certificate you give it to play with, because that certificate is not for it; it is for the SSL server who asks for it. Theoretically, you never have to validate or trust your own certificate. – Thomas Pornin Feb 15 '13 at 18:06
  • Good point, that makes sense. Though the same should then be true for Thunderbird, since it's in the recipient's interest to validate a sent certificate... – Tobias Kienzler Feb 16 '13 at 19:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.