How import SSL cert in Tor Browser? In Firefox I import my self signed cert in Setting -> Advanced -> Certificates -> Authorities. In TB I can't add cert as in FF, because if I add a cert it is not added.

I copy profiles from FF to TB, but nothing happends. TB ignores the certificates database (cert8.db, key3.db) from my profile. Any ideas?

migrated from security.stackexchange.com Dec 20 '16 at 12:48

This question came from our site for information security professionals.

  • Problem sloved by changing in about:config – Jake Michel Dec 20 '16 at 19:44
  • security.nocertdb true -> false If you use sekf signed SSL cert, generated with option -sha256 , change also security.pki.sha1_enforcement_level 2 -> 0 (not recommended by) or regenerate with -sha512. – Jake Michel Dec 20 '16 at 19:49
  • Which system? If you've solved the problem, please post it as an answer. – kenorb Dec 21 '16 at 13:19

The OP gave the answer in the comments. I'll add the answer for completeness:

Tor Browser has set security.nocertdb in about:config to true. This means that the intermediate certificate store is only in memory. If you change this value to false, it will be possible to add new certificates.

  • IMHO it can be a possibility for data leak and fingerprinting. The possible attack vector is: using custom certs we can trick browser to load ssl-ciphered content with a client certificate previously imported. Also there's a possibility to elaborate JS and try to open different HTTPS urls and see if it will be valid, and if it will be - then the cert imported can indicate a group of users at least. For second attack vector we need multiple "import me" SSL certificate spots. But it's just a hypothetical screinario – Alexey Vesnin Jan 20 '17 at 16:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.