8

How can I get Firefox to use the Windows certificate store to look for client certificates?

Use case: Web authentication with a client certificate that is stored in the Windows certificate store and secured with TPM. The certificate is visible there and automatically unlocked (by PIN) when accessed via the certificate store. The private key cannot be exported (for non-administrators).

Improve this question

2 Answers 2

Reset to default
5

How can I get Firefox to use the Windows certificate store to look for client certificates?

It does not appear that this is possible according to Wiki Mozilla. This article does talk about how to get the CA's into Firefox though so it may be worth reading entirely. I also posted another article at the bottom with potential workaround, etc.

Installing Certificates Into Firefox

There are lots of organizations that use their own certificate authority to issue certificates for their internal servers. Since Firefox does not use the Windows certificate store (bug 432802, bug 472113), these have to be manually added into Firefox. This page will cover how to get those CAs into Firefox.

Update

Source

Using the PKCS#11 module in Firefox and Thunderbird

After installation of OpenSC you must register the PKCS11 module in Firefox:

  1. Open the Firefox preferences dialog. Choose “Advanced” > “Encryption” > “Security Devices”
  2. Choose “Load”
  3. Enter a name for the security module, such as “OpenSC”
  4. Choose “Browse…” to find the location of the PKCS11 module on your local computer (Usually c:\WINDOWS\System32\opensc-pkcs11.dll or /usr/local/lib/opensc-pkcs11.so)

Other Potential Resources

Further Clarification

If you're wondering where to find the security.enterprise_roots.enabled setting, form the Firefox address bar, you can type in About:Config, and then press Enter.

Important: If you get the warning that "This might void your warranty" you will need to select the I accept the risk (enter image description here) option.

In the Search field, type in "security" and press Enter to see the setting and attributes from there.

enter image description here

Improve this answer
7
  • 1
    The problem are not CA's, but client certificates. These come from SmartCards or Virtual SmartCards but the middlewareallows to treat them as standard client certificates that are stored in the Windows Certificate Store. You can add PKCS#11 cryptography modules in Firefox, but which dll do In have to chosse here? If there is one?
    – Fragmentation Needed
    Commented Jan 18, 2016 at 11:29
  • @FragmentationNeeded I added an update section to my answer, take a look over it and its links and let me know if that helps any.
    – Vomit IT - Chunky Mess Style
    Commented Jan 23, 2016 at 5:45
  • Installing OpenSC in Firefox works, but it seems not to support a TPM-secured VirtualSmartcard. And I don't have a glue which dll to choose or if M$ even provides a library fort hat. Thanks, in any case!
    – Fragmentation Needed
    Commented Jan 23, 2016 at 16:21
  • 1
    @FragmentationNeeded I would think it's be opensc-pkcs11.dll as long as your smart card is supported by OpenSC for authentication, signing and decryption. Let me know if they helps you get it to work as expected or not.
    – Vomit IT - Chunky Mess Style
    Commented Jan 23, 2016 at 20:16
  • That first link to the Wiki Mozilla article says to set 'security.enterprise_roots.enabled' but I cannot find this setting anywhere
    – riqitang
    Commented Aug 23, 2016 at 12:06
1

The accepted answer is no longer accurate.

As of v90, Firefox will use client certificates available to the OS by default. If your certs work from other browsers that integrate with MSCAPI (anything Chromium-based), they should now work from Firefox as well.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .