Firefox handling of certificate chains
I have a scenario where the website being connected to, has a three level chain (Intermediate1, Intermediate2, Root). Both Intermediate2 and root CA's are present in the Firefox default trusted CA store (They are Centrum based certs). However the Intermediate1 cert (SpaceSSL CA) is not in the Firefox default trusted CA store, and consequently flags a problem when connecting to this website.
From a usability perspective it is not feasible for users to manually install the untrusted CA intermediate cert into Firefox (although this overcomes the connectivity issues if manually imported to the FF store).
Therefore I was wondering whether if the website server supplies the full cert chain file to Firefox whether Firefox will use that to 'bypass' the lack of trust of the SpaceSSL certificate or whether the same trust issues will remain (since SpaceSSL CA is not in the trusted store of FF).
Many thanks for the help.
Paul
All Replies (4)
Hi Paul, Firefox expects websites to provide all intermediate certs needed to verify the site certificate up to a built-in root certificate. The certificate issuer typically provides a bundle file for that.
(Since Firefox caches intermediate certificates after verifying them, users may have different experiences with the site depending on whether they have used sites that have the same certificate chain.)
You can use the Qualys test page to verify that your chain is complete: https://www.ssllabs.com/ssltest/
Thanks very much @jscher2000.
Just to clarify my understanding. Does this mean that if Firefox receives the cert chain file from the server which includes the full intermediate/root chain (including an already trusted root) that FF will fully trust the connection and will not flag any trust errors - even if the signed certificate is signed by an untrusted intermediate CA in that chain?
Thanks again.
Hi Paul, trust is established on the fly by checking the certificate signatures. Firefox often has not seen an intermediate cert before, but it can be trusted as long as it was validly signed and can be verified up to a trusted root certificate. After verification, it will be cached and show up in the Certificate Manager dialog, Authorities tab, with the designation "Software Security Device" (instead of "Builtin Object Token").
The server doesn't need to send the root certificate that is already included with browsers, and probably shouldn't. I think the SSL Labs test views that as a configuration error. Your bundle only needs to include the intermediate certs. Your certificate issuer should tell you which ones you need to serve.
Great. Thanks very much. Understood. I appreciate the speedy assistance.