Mozilla's Firefox Invalid, Yet Valid Certificate

In my line of work I get to work with a lot of security devices which run self-signed certificates. Those certificates are most of the time generated when the device / appliance is installed, or configured for the very first time. When you connect to one of those devices with a web browser, you tend to see the warnings displayed by the browser that the connection is not to be trusted.

In Firefox, you can add an exception in the browser. When you've done that, the next time you go to the website, the browsers treats the website as trusted.

Click to read more ...

Unable to Upgrade Firefox on OS X

Today I tried to upgrade Firefox 5.0.1 on my iMac to version Firefox 6, but it failed with some 'weird' error;

The operation can't be completed because the item libsmime3.dylib" is in use.

Weird because I didn't have FireFox running at the time. Removing Firefox didn't work either, since I couldn't remove it from the Trash (same error).

Turned out that I had the Cisco AnyConnect VPN installed on my system (process name: vpnagentd). To 'unload' this process enter the following in Terminal:

sudo launchctl unload /Library/LaunchDaemons/com.cisco.anyconnect.vpnagentd.plist

Install Firefox, and enable the vpnagent again by entering the following in Terminal:

sudo launchctl load /Library/LaunchDaemons/com.cisco.anyconnect.vpnagentd.plist

And all should be well.

Microsoft Internet Explorer and IP Addresses in Certificate SAN

A fairy long title, but it describes exactly what this post is about. Once again a post about a Microsoft product and the way it works (or rather doesn't work) with your average Internet standard.

This week I was busy with RADIUS, 802.1x, PKI and the protection of websites with SSL encryption. For the implementation of 802.1x, I needed a PKI environment, so I used the Microsoft Certificate Services for that purpose. Along the way, I needed an SSL certificate for an internal website, but this particular website needed to work properly based on different FQDN's and or IP addresses without throwing warining or errors regarding the SSL connection.

The way to do this is to add Subject Alternative Names (SAN) to the certificate. This enables you to access the website in different ways, e.g.;

• Access a webmail host from the internet based on its official FQDN (https://webmail.somedomain.com)
• Access the same webmail host from the inside of the corporate lan based on its internal name (https://webmail.acme.local)
• And access the host from legacy DNS-unaware software on its IP address (https://192.168.1.254)

Click to read more ...

Firefox indexes Fonts

While I was looking for a particular song I heard on the radio on several top-whatever websites I got this Firefox warning;

Firefox wants to use the font "HelveticaTStd-Roman" on the volume "xxx"

A couple of remarks;

• Why is Firefox indexing the fonts on my system? This particular font sits in a directory not used by my fontbook.
• Fail on the part of the top 40 website for using a very specific (and obviously) non-default font in their design.

Redelijkheid.com as a FireFox Search Engine

While the content on my website increases, it's getting (a bit) harder to find certain content. Sure, there's this search form in the top right of the website, but this means that you have to open the website first, enter the keyword and hit 'Enter'.

To speed things up I created a custom FireFox search engine. Using this I can search for content on my website directly from the browser. No matter what site I'm currently on.

The custom search engines are located in the profiles directory.

OSX: ~/Library/Application Data/Firefox/profiles/<random>/searchplugins/<searchengine>.xml

Windows: c:\Documents and Settings\<username>\Application Data\Mozilla\Firefox\Profiles\<random>\searchplugins\<searchengine>.xml

By adding the following XML file (right-click - Save As) to the directory listed above, you add the Redelijkheid.com search engine to your Firefox search engines.

Click to read more ...

Screengrabbing in FireFox

On Windows PC's I use SnagIt from TechSmith for screencaptures etc. On OSX I use the built-in capabilities of OSX for capturing screens, windows, or areas, but there was something missing...

SnagIt can capture large windows within *cough*Internet Explorer*cough* or Firefox as one image. So no need for a capture, scroll down, capture again etc. This feature isn't available in OSX, or any (commercial) capturing software I could get my hands on. Until I ran into Screengrab.

Screengrab is a FireFox extension which allows you to save an entire webpage as an image (jpg or png). Excellent extension if I may say so.

OSX and Aladdin eToken

Due to the nature of my work, and my fondness of Apple products I wasn't able to get my Aladdin eTokens working with OSX. After several months of not trying to crack this I decided to try it again.
The trigger for me was stumbling on the possibility of adding so-called keyfiles to the eToken for accessing TrueCrypt volumes.

First challenge was the eToken PKI software for OSX... Thankfully I'm a Certified eToken guru, so I've got access to their download area (you will have to get your own software). The current version of the eToken software for OSX is v4.55. I installed the Aladdin software on OSX 10.5.5.

Click to read more ...

FireFox 3 Color Management

In the 'old' days, Safari was probably the only Internet browser with some decent color management. The problem was that images displayed in Firefox and Internet Explorer looked a bit desaturated and lighter.

Now, in FireFox 3 you have the opportunity of enabling color management. Just set the following configuration option to 'true' (by double clicking) in the FireFox configuration settings (to access the config-part of FireFox, just type about:config in the address bar).

gfx.color_management.enabled

This feature is turned off by default. Restart firefox and be amazed by the colors in your photos on the Internet

FireFox 3 Bug??

Like most security conscious people I use Firefox (FF) for my everyday browsing on the Internets. So when the Mozilla guys released version 3 I installed it on all my machines (2 Windows and 2 OSX platforms).

It was a bit getting used to. The underlying FF part had been changed. Bookmarks, history etc are all stored in sqlite databases. So no more flatfiles. This took me a couple of hours to figure it out, but finally I got 'there'.

Using FF was business as usual... Apart from one very annoying bug; Opening new windows (not new tabs) results often in an empty bookmarks bar. And this is happening on Windows and OSX versions of FF.
The bookmarks are 'there' but not click-able. Using the right mouse button (on OSX: ctrl-mouse click) on the bookmarks bar and selecting 'Open All in Tabs', FF opens every bookmark in the bar.

The only way of restoring the proper bar is the completely shutdown FF and restart it. After that it works for a certain amount of time.

The problem isn't isolated to my environment. Just google on the issue, and you'll find more people. There's one suggestion I haven't tried yet. Starting with a fresh/clean profile, but I do need my settings/passwords/bookmarks. I'm lost without those :(

UPDATE: I tried a new profile, and this seemed to work. After this I started to repopulate the new profile with the old settings, etc. Everything went fine until the point where I added the extensions. It seems that even old / not active extensions (SwitchProxy in my case) are still able to f*ck things up.

FireFox 3 Dialog Boxes

Firefox is the default browser on all my platform, and every once in a while I run into strange dialog boxes.
E.g., this evening I updated some digital certificates for the test environment of VeriSign MPKI backend. These certificates are issued by a (private) VeriSign CA. So there's no trust by default.

After generating the keypair in FireFox 3 I got the positive dialog box as showed below.

No problem so far, but the next dialog box 'scared' me a little;

This dialog box, or at least the result, would remove (or delete) the certificate I just generated. The issueing CA is not installed in FireFox (or on the machine itself for all it matters). But in fact the certificate was installed in the Crypto/Certificate store of FireFox, and I could use it to access the VeriSign test backend.

So, eventhough, FireFox warns the user that the content will be deleted (or not added), it doesn't exactly does that at all. Let's see if I can file a bug report, because this occured on all 4 certificates I generated/imported.