NSS does not like colons in token label #2725
Comments
|
Replacing colons with e.g. "_" seems the best. Using more generic "CAC" instead seems acceptable, though not as good. |
Jakuje
added a commit
to Jakuje/OpenSC
that referenced
this issue
Apr 24, 2023
The NSS can not handle tokens with colons in token info labels because it is using colon as a separator for token info label and object label. Fixes: OpenSC#2725 More information available in the following SS bug: https://bugzilla.mozilla.org/show_bug.cgi?id=1817553
Jakuje
added a commit
to Jakuje/OpenSC
that referenced
this issue
Apr 24, 2023
The NSS can not handle tokens with colons in token info labels because it is using colon as a separator for token info label and object label. Fixes: OpenSC#2725 More information available in the following SS bug: https://bugzilla.mozilla.org/show_bug.cgi?id=1817553
5 tasks
Jakuje
added a commit
to Jakuje/OpenSC
that referenced
this issue
Apr 24, 2023
The NSS can not handle tokens with colons in token info labels because it is using colon as a separator for token info label and object label. Fixes: OpenSC#2725 More information available in the following SS bug: https://bugzilla.mozilla.org/show_bug.cgi?id=1817553
Jakuje
added a commit
to Jakuje/OpenSC
that referenced
this issue
Apr 25, 2023
The NSS can not handle tokens with colons in token info labels because it is using colon as a separator for token info label and object label. Fixes: OpenSC#2725 More information available in the following SS bug: https://bugzilla.mozilla.org/show_bug.cgi?id=1817553
Jakuje
added a commit
to Jakuje/OpenSC
that referenced
this issue
Apr 26, 2023
The NSS can not handle tokens with colons in token info labels because it is using colon as a separator for token info label and object label. Fixes: OpenSC#2725 More information available in the following NSS bug: https://bugzilla.mozilla.org/show_bug.cgi?id=1817553
frankmorgner
pushed a commit
that referenced
this issue
Apr 28, 2023
The NSS can not handle tokens with colons in token info labels because it is using colon as a separator for token info label and object label. Fixes: #2725 More information available in the following NSS bug: https://bugzilla.mozilla.org/show_bug.cgi?id=1817553
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Problem Description
I was made aware of the following NSS bug https://bugzilla.mozilla.org/show_bug.cgi?id=1817553 with new CAC cards containing colons in CN of certificates, which is being propagated to the token labels.
From there the NSS composes the certificate "nicknames" in format of "token label":"certificate label" and depends on the "token label" not having any colons in it.
Proposed Resolution
We are discussing some workarounds in NSS, but other option might be to provide a bit more flexibility using configuration options (on NSS quirks similar to #2681) to either replace colons from CN or use more generic "Common Access Card" or something.
Steps to reproduce
Logs
no logs available
The text was updated successfully, but these errors were encountered: