<div dir="ltr"><div dir="ltr">On Fri, Aug 2, 2019 at 5:46 PM Hoang (US), Victor T <<a href="mailto:victor.t.hoang@boeing.com">victor.t.hoang@boeing.com</a>> wrote:<br></div><div class="gmail_quote"><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div lang="EN-US">
<div class="gmail-m_4697797121275789455WordSection1">
<p class="MsoNormal"><span style="font-size:11pt;font-family:"Calibri",sans-serif;color:rgb(31,73,125)">I forgot to show an example of what I will be trying.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:"Calibri",sans-serif;color:rgb(31,73,125)"><u></u> <u></u></span></p>
<pre><span style="font-size:11pt;font-family:"Calibri",sans-serif;color:rgb(31,73,125)"> </span>{<u></u><u></u></pre>
<p class="MsoNormal"><span style="font-size:10pt;font-family:"Courier New""> "policies": {<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:10pt;font-family:"Courier New""> "Certificates": {<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:10pt;font-family:"Courier New"">
</span><span style="font-size:11pt;font-family:"Calibri",sans-serif;color:rgb(31,73,125)">"Install": ["C:\\Program Files (x86)\\Mozilla Firefox\\cck2\\resources\\certs\\ cert1.cer", "C:\\Program Files (x86)\\Mozilla Firefox\\cck2\\resources\\certs\\cert2.cer", Firefox\\cck2\\resources\\certs\\cert3.cer",
"C:\\Program Files (x86)\\Mozilla Firefox\\cck2\\resources\\certs\\cert4.crt"]<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:10pt;font-family:"Courier New""> }<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:10pt;font-family:"Courier New""> }<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:10pt;font-family:"Courier New"">}<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:"Calibri",sans-serif;color:rgb(31,73,125)"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:"Calibri",sans-serif;color:rgb(31,73,125)">Something like that? (I’m currently just testing so I’m installing from a directory in which cck still exists where my certificates are stored locally on the
device. I will change it once I can get the certs installed the first time)</span></p></div></div></blockquote><div><br></div><div>Yes, that should work. <br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div lang="EN-US"><div class="gmail-m_4697797121275789455WordSection1"><p class="MsoNormal"><span style="font-size:11pt;font-family:"Calibri",sans-serif;color:rgb(31,73,125)"><u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:"Calibri",sans-serif;color:rgb(31,73,125)"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:"Calibri",sans-serif;color:rgb(31,73,125)">Also, once I save this in the json file, I’m guessing it will create the directories for me? E.g.:<u></u><u></u></span></p>
<p class="MsoNormal">%USERPROFILE%\AppData\Local\Mozilla\Certificates<u></u><u></u></p>
<p class="MsoNormal">%USERPROFILE%\AppData\Roaming\Mozilla\Certificates<u></u><u></u></p></div></div></blockquote><div><br></div><div>Nope, you'll need to create the Certificates subdir <br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div lang="EN-US"><div class="gmail-m_4697797121275789455WordSection1"><p class="MsoNormal"></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:"Calibri",sans-serif;color:rgb(31,73,125)"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:"Calibri",sans-serif;color:rgb(31,73,125)">Will it need to be a fresh install of firefox, or can I just use my currently existing one and it will be created on start up?</span></p></div></div></blockquote><div><br></div><div>Doesn't need to be a fresh install. If the policy is updates, it will add the new certs/ <br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div lang="EN-US"><div class="gmail-m_4697797121275789455WordSection1"><p class="MsoNormal"><span style="font-size:11pt;font-family:"Calibri",sans-serif;color:rgb(31,73,125)"><u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:"Calibri",sans-serif;color:rgb(31,73,125)"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:"Calibri",sans-serif;color:rgb(31,73,125)">Thanks again,<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:"Calibri",sans-serif;color:rgb(31,73,125)">Victor<u></u><u></u></span></p>
<div>
<div style="border-color:rgb(225,225,225) currentcolor currentcolor;border-style:solid none none;border-width:1pt medium medium;padding:3pt 0in 0in">
<p class="MsoNormal"><b><span style="font-size:11pt;font-family:"Calibri",sans-serif">From:</span></b><span style="font-size:11pt;font-family:"Calibri",sans-serif"> Hoang (US), Victor T
<br>
<b>Sent:</b> Friday, August 2, 2019 3:39 PM<br>
<b>To:</b> 'Mike Kaply' <<a href="mailto:mkaply@mozilla.com" target="_blank">mkaply@mozilla.com</a>><br>
<b>Cc:</b> <a href="mailto:enterprise@mozilla.org" target="_blank">enterprise@mozilla.org</a><br>
<b>Subject:</b> RE: [Mozilla Enterprise] Inquiry: Firefox error using policy to pull from windows certificate store<u></u><u></u></span></p>
</div>
</div>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:"Calibri",sans-serif;color:rgb(31,73,125)">I’m giving tinker with this and will get back with my findings. Silly me. Thanks!<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:"Calibri",sans-serif;color:rgb(31,73,125)"><u></u> <u></u></span></p>
<p class="MsoNormal"><b><span style="font-size:11pt;font-family:"Calibri",sans-serif">From:</span></b><span style="font-size:11pt;font-family:"Calibri",sans-serif"> Mike Kaply <<a href="mailto:mkaply@mozilla.com" target="_blank">mkaply@mozilla.com</a>>
<br>
<b>Sent:</b> Friday, August 2, 2019 2:30 PM<br>
<b>To:</b> Hoang (US), Victor T <<a href="mailto:victor.t.hoang@boeing.com" target="_blank">victor.t.hoang@boeing.com</a>><br>
<b>Cc:</b> <a href="mailto:enterprise@mozilla.org" target="_blank">enterprise@mozilla.org</a><br>
<b>Subject:</b> Re: [Mozilla Enterprise] Inquiry: Firefox error using policy to pull from windows certificate store<u></u><u></u></span></p>
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<div>
<p class="MsoNormal">It should just be about putting them in the right location and setting the Certificates->Install policy (if they aren't being imported from the window store).<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">See:<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal"><a href="https://github.com/mozilla/policy-templates/blob/master/README.md#certificates--install" target="_blank">https://github.com/mozilla/policy-templates/blob/master/README.md#certificates--install</a><u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">Are these client certificates?<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">Mike Kaply<u></u><u></u></p>
</div>
</div>
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<div>
<p class="MsoNormal">On Fri, Aug 2, 2019 at 4:18 PM Hoang (US), Victor T <<a href="mailto:victor.t.hoang@boeing.com" target="_blank">victor.t.hoang@boeing.com</a>> wrote:<u></u><u></u></p>
</div>
<blockquote style="border-color:currentcolor currentcolor currentcolor rgb(204,204,204);border-style:none none none solid;border-width:medium medium medium 1pt;padding:0in 0in 0in 6pt;margin:5pt 0in 5pt 4.8pt">
<div>
<div>
<p class="MsoNormal">Hello,<u></u><u></u></p>
<p class="MsoNormal"> <u></u><u></u></p>
<p class="MsoNormal">My name is Victor. I was wondering if anyone could share any experience/expertise/solutions with switching over to policy for managing certificates to pull from the windows store.
I’m running into some issues even after following some of the guides about how to try and pull from my organizations windows store locations from
<a href="https://support.mozilla.org/en-US/kb/setting-certificate-authorities-firefox" target="_blank">
https://support.mozilla.org/en-US/kb/setting-certificate-authorities-firefox</a>. It seems like the instructions might be a little broad/high level so I could be missing some things. Following the guide, I have security.enterprise_roots.enabled set to true
and checked the windows store certificate location in regedit.exe and mmc and they seem to already exist (perhaps not in the right directory?). I asked someone in my organization and they mentioned that all the stores can be found on the console root (Local
Computer) under trusted root certification Authorities <span style="font-family:Wingdings">
à</span> Certificates and it all seems to be there as well.<u></u><u></u></p>
<p class="MsoNormal"> <u></u><u></u></p>
<p class="MsoNormal">My question:<u></u><u></u></p>
<p class="gmail-m_4697797121275789455gmail-m-1141010715319064534msolistparagraph"><span style="font-family:Symbol">·</span><span style="font-size:7pt">
</span>It seems like firefox checks HKLM\SOFTWARE\Microsoft\SystemCertificates according to the support page. I’m using regedit.exe to navigate to the directory, but I don’t see any sort of “Import” option for the certificates I want to embed. I’m wondering
how I can add my certificates into the location required by firefox? This is what I speculate to be the culprit.
<u></u><u></u></p>
<p class="MsoNormal"> <u></u><u></u></p>
<p class="MsoNormal">Background:<u></u><u></u></p>
<p class="gmail-m_4697797121275789455gmail-m-1141010715319064534msolistparagraph"><span style="font-family:Symbol">·</span><span style="font-size:7pt">
</span>Switching from FF 60.8 ESR cck2 over to FF 68.0.1 ESR with policy.json<u></u><u></u></p>
<p class="gmail-m_4697797121275789455gmail-m-1141010715319064534msolistparagraph"><span style="font-family:Symbol">·</span><span style="font-size:7pt">
</span>Able to do majority of things such as setting up proxy, changing home page, and Trusted Devices installed (for CSSI Library badge authentication, etc)<u></u><u></u></p>
<p class="gmail-m_4697797121275789455gmail-m-1141010715319064534msolistparagraph"><span style="font-family:Symbol">·</span><span style="font-size:7pt">
</span>Unable to have certificates be read from the windows store via policy unless I manually add them to the Certificate Manager in firefox. (Secure Connection Failed: SSL_ERROR_HANDSHAKE_FAILURE_ALERT)<u></u><u></u></p>
<p class="MsoNormal"><span style="color:rgb(31,73,125)">Thanks all,<br>
Victor Hoang </span><u></u><u></u></p>
<p class="MsoNormal"> <u></u><u></u></p>
</div>
</div>
<p class="MsoNormal">_______________________________________________<br>
Enterprise mailing list<br>
<a href="mailto:Enterprise@mozilla.org" target="_blank">Enterprise@mozilla.org</a><br>
<a href="https://mail.mozilla.org/listinfo/enterprise" target="_blank">https://mail.mozilla.org/listinfo/enterprise</a><br>
<br>
To unsubscribe from this list, please visit <a href="https://mail.mozilla.org/listinfo/enterprise" target="_blank">
https://mail.mozilla.org/listinfo/enterprise</a> or send an email to <a href="mailto:enterprise-request@mozilla.org" target="_blank">
enterprise-request@mozilla.org</a> with a subject of "unsubscribe"<u></u><u></u></p>
</blockquote>
</div>
</div>
</div>
</blockquote></div></div>