6

How can I get Firefox to use the Windows certificate store to look for client certificates?

Use case: Web authentication with a client certificate that is stored in the Windows certificate store and secured with TPM. The certificate is visible there and automatically unlocked (by PIN) when accessed via the certificate store. The private key cannot be exported (for non-administrators).

5

How can I get Firefox to use the Windows certificate store to look for client certificates?

It does not appear that this is possible according to Wiki Mozilla. This article does talk about how to get the CA's into Firefox though so it may be worth reading entirely. I also posted another article at the bottom with potential workaround, etc.

Installing Certificates Into Firefox

There are lots of organizations that use their own certificate authority to issue certificates for their internal servers. Since Firefox does not use the Windows certificate store (bug 432802, bug 472113), these have to be manually added into Firefox. This page will cover how to get those CAs into Firefox.



Update

Source

Using the PKCS#11 module in Firefox and Thunderbird

After installation of OpenSC you must register the PKCS11 module in Firefox:

  1. Open the Firefox preferences dialog. Choose “Advanced” > “Encryption” > “Security Devices”
  2. Choose “Load”
  3. Enter a name for the security module, such as “OpenSC”
  4. Choose “Browse…” to find the location of the PKCS11 module on your local computer (Usually c:\WINDOWS\System32\opensc-pkcs11.dll or /usr/local/lib/opensc-pkcs11.so)

Other Potential Resources


Further Clarification

If you're wondering where to find the security.enterprise_roots.enabled setting, form the Firefox address bar, you can type in About:Config, and then press Enter.

Important: If you get the warning that "This might void your warranty" you will need to select the I accept the risk (enter image description here) option.

In the Search field, type in "security" and press Enter to see the setting and attributes from there.

enter image description here

8
  • The problem are not CA's, but client certificates. These come from SmartCards or Virtual SmartCards but the middlewareallows to treat them as standard client certificates that are stored in the Windows Certificate Store. You can add PKCS#11 cryptography modules in Firefox, but which dll do In have to chosse here? If there is one? – Fragmentation Needed Jan 18 '16 at 11:29
  • @FragmentationNeeded I added an update section to my answer, take a look over it and its links and let me know if that helps any. – Drink More Pimp Juice IT Jan 23 '16 at 5:45
  • Installing OpenSC in Firefox works, but it seems not to support a TPM-secured VirtualSmartcard. And I don't have a glue which dll to choose or if M$ even provides a library fort hat. Thanks, in any case! – Fragmentation Needed Jan 23 '16 at 16:21
  • 1
    @FragmentationNeeded I would think it's be opensc-pkcs11.dll as long as your smart card is supported by OpenSC for authentication, signing and decryption. Let me know if they helps you get it to work as expected or not. – Drink More Pimp Juice IT Jan 23 '16 at 20:16
  • That first link to the Wiki Mozilla article says to set 'security.enterprise_roots.enabled' but I cannot find this setting anywhere – riqitang Aug 23 '16 at 12:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.