Firefox uses its own version of NSS, incompatible with system version

[dwmw2]

Because of bug 1647285 I need to install corporate SSL CAs into the database of each NSS-using application individually. Unfortunately it doesn't seem to work for Firefox. Not only does Firefox ship with its *own* version of NSS instead using the system's version, but it even seems to be configured very differently.

Firefox appears to use the legacy Berkeley DB database for its softokn, in key3.db/cert8.db. However, the system's certutil won't work with that legacy format:

$ certutil -d ~/.mozilla/firefox/default.default/ -L
certutil: function failed: SEC_ERROR_LEGACY_DATABASE: The certificate/key database is in an old, unsupported format.

I can force it to use the SQL database in key4.db/cert9.db by running with NSS_DEFAULT_DB_TYPE=sql, and then I *can* install trusted CAs with certutil. But actually, it's much simpler to just make a symlink from firefox's own special copy of the SSL trust roots in libnssckbi.so, to the system's p11-kit-trust.so — thus making Firefox honour the system trust configuration.

[Chris Coulson (chrisccoulson)]

The Firefox we ship is deliberately as close as possible to what Mozilla provides, so this isn't going to change

[dwmw2 (dwmw2)]

Setting aside the wisdom of that response, and my surprise at discovering that the distribution even *permits* you to ship your own copy of certain libraries — *especially* security-critical libraries — in your own package instead of using the system's version.... doesn't that mean you should be shipping your own version of things like certutil and modutil, given that you now not only have your own copy of the libraries, but you even have a speshul different database format to the one that the system NSS uses, so you aren't even compatible with /usr/bin/certtool.

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.