Firefox 57 logins not working anymore with latest opensc-pkcs11.

[hsanjuan]

I compiled and installled opensc with the latests fixes OpenSC/OpenSC#1185

Then loaded opensc-pkcs11.so on Firefox etc.

With Firefox 53 ESR things worked. However with Firefox 57 (Quantum) I get "unknown" errors when logging in. The error comes from the eesti.ee and other sites.

Firefox does recognize the card, the certificates, and correctly asks for unlock pins, but unlike before, it does not show the certificate selection window for login.

I know this quite doesn't belong here, but is there a place non-Ubuntu Linux open-eid users can support each other or obtain support? Can someone else reproduce this?

(yes, my certs are valid and updated to elliptic-curve ones)

@metsma any ideas?

[metsma]

Can you provide opensc logs.
And FF 57 does not support anymore pkcs11 autoloading you must load PKCS11 manually.
https://github.com/OpenSC/OpenSC/wiki/Installing-OpenSC-PKCS%2311-Module-in-Firefox,-Step-by-Step

[hsanjuan]

@metsma I'll try to get some logs, but do you think it's opensc? Note that I was using the same opensc on both Firefox 53 ESR and 57 (perhaps it was not clear from my comment above). And yes, I always manually install the module.

[metsma]

Which linux distribution?

[hsanjuan]

openSUSE

[metsma]

Can you test official binary build from Firefox site.
I got confirmation that openSUSE Firefox build does not work.
Probably NSS library is built without ECC support.

[hsanjuan]

@metsma ah, will do! Do you have a link for that ?

[metsma]

No sorry, just figured out with other user trial and error.

[MagicFab]

Firefox 57 introduces important changes to its plugins framework. Can you confirm using an ESR version still works and which one?

[metsma]

Firefox 58 will have support to configure PKCS11 with WebExtension framework
https://github.com/open-eid/firefox-pkcs11-loader/releases/tag/v3.13.0

[hsanjuan]

Hi, I confirm that the official build from the Firefox website works. Looking into why OpenSUSE builds don't. mozilla-nss seems to be built with ECC support :S

[hsanjuan]

The psck11-spy.so trace between the official and the opensuse version is virtually the same until the moment comes to show the user the window where the authentication certificate is chosen. The opensuse build of firefox does not show this window. The official build does.

Both versions can read the certificates successfully and log-in to the cards (and ask for the pin when necessary).

[hsanjuan]

Replacing mozilla-nss libs with the system ones in the offical build of firefox does not result in broken logins, so it doesn't look like a NSS issue.

[hsanjuan]

After lots of tinkering, it appears my issues were due to a bad/legacy opensc.conf. Making sure that the one installed by the latest OpenSC was the one used solved the problem.