7

I use Firefox 44.0.2 on a Linux Xubuntu system. I'm trying to access a company website that requires a certificate.

I can confirm I have the correct certificate in Preferences->Advanced->Certificates->View Certifacates->Your Certificates

It's there and it's the same certificate I successfully use on my Chrome browser on my Windows machine. When I try to access the website from the Windows Chrome, I get a pop up asking me to select one of my certs, I select the correct one and everything works.

My issue is that Firefox on my Linux never prompts me to select a certificate when I try to access the website. I just get a "400 No required SSL certificate was sent."

How can I get Firefox to prompt me for a cert? Or how can I tell him which cert to use?

4 Answers 4

6

I have just been experimenting with this myself. It seems that Firefox will only prompt if you have already imported a certificate signed by the same issuer who has signed site's SSL certificate.

So get your CA to sign both the server and client certificates, then import the client certificate into Firefox (via the Preferences window.) The next time you visit the site, Firefox will notice that it has a client certificate signed by the same CA as the server's SSL certificate, so it will prompt you whether to use this or not.

7
  • 4
    Most people/organizations would use a public trusted CA for their main public facing URLs, and a private self-issued certificate for private/admin-related URLs. So that is not an option, and it certainly shouldn't be a requirement. Jun 14, 2018 at 22:33
  • 1
    @CraigHicks: Hey don't shoot the messenger, I'm not a Firefox dev so I didn't make the rules! I just found out through experimentation that this is what it took to make it work. I would've suggested logging an issue for it but Mozilla stopped caring what its users wanted a long time ago so the chances of getting this fixed are basically zero.
    – Malvineous
    Jun 17, 2018 at 4:26
  • 1
    :) Your effort is appreciated! However, I did succeed in loading in a privately created certificate to my Firefox browser following these instructions: knowledge.digicert.com/solution/SO5437.html. This was not a digicert certificate, but one I created myself. Jun 17, 2018 at 18:47
  • This answer is wrong. I'm using different CAs for server and client and it works without problems. Apr 25, 2020 at 22:53
  • @SewerynNiemiec: You're commenting on an answer that is four years old, things have probably changed since then. Instead of telling people they are wrong, perhaps let everyone know the improvements that have been made since the answer was originally posted so long ago.
    – Malvineous
    Apr 26, 2020 at 1:43
3

I encountered this problem with Firefox, where it would only offer the certificate in a Private Browsing window.

I suspect this happened because I initially clicked Cancel on the User Identification Request dialog, with the Remember this decision box checked, as in this screenshot.

User Identification Request

(Don't do this.)

I fixed this by going to Clear Recent History (CtrlShiftDel) and clearing the Site Preferences.

You might also be able to go to about:preferences#privacy -> View Certificates... -> Authentication Decisions, and Delete it from there:

Certificate Manager - Authentication Decisions

1
  • 1
    "Authentication Decisions" did the trick for me. deleting cache/cookies/etc was not needed.
    – Emil Vatai
    Apr 22 at 3:55
0

In my case the web server (nginx) has SPDY enabled. I disabled it and now Firefox works as expected and prompts for certificate.

0

I just had the same problem. I use a Lets Encrypt server certificate, and a self signed client certificate, in a .NET 5 project.

Firefox did not prompt for my certificate, but Chrome did.

My solution was to include the following flags to my self created client certificate:

TlsWebClientAuthentication
DataEncipherment
KeyEncipherment
DigitalSignature
EMailProtection

At first I only had the first one. I have not tried to see which one, if only one, did the trick.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.