Bugzilla – Bug 1073146
Extensions update check fails due to "Certificate issuer is not built-in"
Last modified: 2017-12-17 16:08:47 UTC
The extension update mechanism fails in the openSUSE build of Firefox, obviously due to not having included the (correct) built-in certificates.
This works fine in the Mozilla build, so it is definitely an openSUSE issue.
Please see https://bugzilla.mozilla.org/show_bug.cgi?id=1424478 for all the details. Thanks for fixing!
I have recently observed this issue as well, with MozillaFirefox-57.0.1-1.8.x86_64 from the openSUSE Mozilla repo for TW and Leap 42.3. However, sometimes it works. I have definitly not seen this issue on my Windows machine so far.
How can I observe the failure?
I opened the "Browser console" and tried to manually update the extensions. There was no error though.
Hm, what can I say? I provided all the details in https://bugzilla.mozilla.org/show_bug.cgi?id=1424478 already.
The only thing I could imagine is some legacy from former Firefox versions or extensions, since my Firefox profile is 11 years old and has undergone many changes. On the other hand, I tried this with a fresh testing profile and also experienced the error. Are there any other files outside of profiles that could have an effect?
Do you experience any other certificate issues?
Please list your installed packages
rpm -qa | grep -E '-nss|freebl|softokn'
The above line misses the escape for -nss -> \-nss
I don't experience other certificate issues.
machine:~ # rpm -qa | grep -E 'freebl|softokn|-nss' | sort
Do you have that issue with Firefox 57 or 52.x?
The upstream bug is about 57 so I guess it's that.
In that case I think the explanation is simple.
You have a mixed installation of 3.33 and 3.28.6 NSS.
Every single package above should be on the same version level.
This is not enforced from dependencies because technically it's possible to mix in some boundaries but at least the mozilla-nss-certs-3.28.6-44.1.x86_64 is most likely your problem.
Please update all packages and check again and reopen if you still can reproduce afterwards.
(In reply to Wolfgang Rosenauer from comment #7)
Thanks, Wolfgang! I removed the 32-bit libraries, updated everything else to 3.33, and now it works nicely.
Perhaps it would be helpful to wire this into the package dependencies.
> Do you have that issue with Firefox 57 or 52.x?
> The upstream bug is about 57 so I guess it's that.
> In that case I think the explanation is simple.
> You have a mixed installation of 3.33 and 3.28.6 NSS.
> Every single package above should be on the same version level.
> This is not enforced from dependencies because technically it's possible to
> mix in some boundaries but at least the mozilla-nss-certs-3.28.6-44.1.x86_64
> is most likely your problem.
> Please update all packages and check again and reopen if you still can
> reproduce afterwards.