Hack 17. Manage Digital Certificates

Who gives Firefox trustworthy advice? You can change that set of advisors.

All content from a web site that advertises itself as secure has to be checked. Secure content must be accompanied by a digital signature and by a certificate that says whom the digital signature belongs to. The certificate must originate from a Certificate Authority (an organization) that Firefox knows. This hack explains how to change the certificates and Certificate Authorities (CAs) that Firefox knows about.

2.8.1. Examining Existing Certificates and Authorities

The Firefox Options dialog box lets you manage digital certificates. Click the Advanced icon to display that panel, expand the Certificates item, and click the Manage Certificates... button. Figure 2-3 shows that window, with the fourth tab in front.

Figure 2-3. Default certificate authority certificates in Firefox

If you click on any of the rows labeled Builtin Object Token, you can then examine the certificate by pressing the View button or limit its use via the Edit button. All of the certificates listed are bundled with the standard Firefox install. There's little reason to delete them, but you can if you want. If you do so, that will restrict the number of secure web sites that Firefox can successfully visit.

You can also list these certificates from outside Firefox. Copy these files from the current Firefox profile to a temporary directory:

cert8.db key3.db secmod.db

All three files (cert8.db, key2.db, and secmod.db) are required. To see their contents, use signtool [Hack #18], like this:

signtool -L -d"."

These three files contain, respectively, certificates, public-key encryption keys, and a list of security modules that provide enabling regimes for browser security. An enabling regime is just a starting point for security. The alphabet soup that describes such regimes includes PKCS #11 and PSM standards. Implementations of those standards make up the default (built-in) security regime for Firefox. Other regimes that could be added (via additional software libraries) include systems that support smart cards and dongles.

The other tabs in this dialog box contain these details:

Your certificates

Certificates you might use to sign email or other outward-bound information. Firefox does not use these certificates, but it might share its profile with another application, such as Thunderbird. They are sourced locally or from a smart card.

Other people's certificates

Certificates received from inbound information, such as signed email. Firefox does not use these certificates, but it might share its profile with another application, such as Thunderbird.

Web site certificates

Certificates stored by user action. If a web site presents a certificate to the user, and the user both accepts it and tells Firefox to allow that site in future, then the certificate will be copied here.

2.8.2. Adding More CA Certificates

Certificates are defined by a range of standards, collectively called X.509. You can add authoritative CA certificates to Firefox at any time. The first step is to establish the credibility of the CA you're going to add. Don't assume that all CAs are credible. Free software exists that lets anyone set themselves up as a CA. Once the CA has delivered (for free) its root certificate, import it.

To import via the GUI, click the Import button in Figure 2-3 and supply the certificate file. Firefox thinks files with the following extensions are certificates, but you can identify the file by hand (the extension isn't important):

.crt .cert .cer .pem .der

The file should be in either in DER or (old Netscape) Base-64 encoding. Firefox can handle chained certificates stored together in one file, but it might not display all of them before final import.

To import direct from the Web, make sure the CA certificate is served up with this content type:

application/x-x509-ca-cert

Use this alternate type for web server certificates:

application/x-x509-server-cert

To import certificates using the command line, work on copies of the cert8.db, key3.db, and secmod.db security files with the certutil tool that is bundled with signtool. Here's a suitable command-line argument:

certutil -A -n "nickname" -t c -d "." [ -a ] -i new_ca.cert

Use the -a option for Base-64-encoded certificates only. Note that the -d option requires a space before its argument. Copy the files back to Firefox afterward.

2.8.3. Rejecting Certificates with CRLs and OSCP

If a certificate owner loses his credibility, he shouldn't be allowed to use his certificate anymore. Somehow, the browser user needs to find this out. The browser displays a warning if it detects a trust request that uses a bad certificate. But how does the browser know?

Certificate Rejection Lists (CRLs) are one solution. CRLs are files with formats defined in RFC 2459. Each list is a set of certificates that a particular CA wishes they could revoke. Firefox checks all installed CRLs when signed content requests user trust. None are installed by default. If you have all the CRLs from all of the CAs Firefox knows about, then the number of bad folks you'll accidentally trust is much reduced.

One problem with CRLs is that they get out of date. Every CRL should be brought up to date frequently. Firefox can do that either at set expiry times in the future or at a fixed regular frequency. The default frequency if any CRLs are installed is 30 seconds. Some update information is also stored in the preferences system, but the details are too gory for this hack.

To collect all the CRLs you need, visit the web sites of all CAs known by Firefox. Click on all the links to CRLs at those sites. CRLs are then downloaded and installed. They're detected using this content type:

application/x-x509-crl

You can also import a CRL from a file if the CA delivers it to you as an email attachment.

A second solution to bad certificates is Online Certificate Status Protocol (OCSP). If it's enabled, Firefox won't check CRLs each time trust is requested by signed content. Instead, Firefox will send a request to the URL specified when OCSP was turned on. The server at the other end (or a proxy server) will report if the trust request includes a safe certificate or not. If it is, the original content will be trusted. That's a lot of extra network overhead for a dial-up connection, though.