4 ms·

I remember having this conversation with other Firefox security devs (I'm a Firefox dev myself). While I don't remember exactly why they are not supported, I re

by Yoric 7y ago

I remember having this conversation with other Firefox security devs (I'm a Firefox dev myself). While I don't remember exactly why they are not supported, I remember that there was a very good security reason for this. Also, while it's off by default, Firefox can be configured to support them: https://support.mozilla.org/en-US/questions/1175296 https://support.mozilla.org/en-US/questions/1175296

lenkite 7y ago
That method doesn't work for client certificate authentication. Thousands of organisations in the world generate client certificates for their users and populate them into the OS certificate store. Those certificates are then expected to be presented at the time of client-certificate authentication to the hundreds of apps that expect them. The OS certificate in any enterprise company is "locked down" with extensive policies provided by the OS vendor. It is far harder to import/export certificate and key material from it than from Firefox's own certificate store. I know that my company runs has scripts that run regular background checks to validate certificates in the OS certificate store. If you want dev/test certificates, we even have an internal app that generates 'trusted' certificates for various purposes. There was a reason that Chrome chose to move to the OS certificate store. They realised it would increase their market share in the enterprise. Firefox is a no-go because it continues to cling to its own custom store.