All extensions disabled due to expiration of intermediate signing cert

Re:All extensions disabled due to expiration of intermediate... by gpm on Saturday May 04, 2019 @05:47PM (#19829591)

Hey, so if you're going to do this, you're porting the wrong code. My code (which you ported) will need to be rerun every 24h to reset the signing state (assuming old firefox works like new firefox, it probably does). You should figure out how to make the following code (pulled from the .xpi mozilla created) work in firefox 56's browser console instead:

    /* eslint no-unused-vars: ["error", { "varsIgnorePattern": "skeleton" }]*/
    ChromeUtils.defineModuleGetter(this, "XPIDatabase", "resource://gre/modules/addons/XPIDatabase.jsm");

    var skeleton = class extends ExtensionAPI {
        getAPI(/* context */) {
            return {
                experiments: {
                    skeleton: {
                        async doTheThing() {
                            // first inject the new cert
                            try {
                                let intermediate = "MIIHLTCCBRWgAwIBAgIDEAAIMA0GCSqGSIb3DQEBDAUAMH0xCzAJBgNVBAYTAlVTMRwwGgYDVQQKExNNb3ppbGxhIENvcnBvcmF0aW9uMS8wLQYDVQQLEyZNb3ppbGxhIEFNTyBQcm9kdWN0aW9uIFNpZ25pbmcgU2VydmljZTEfMB0GA1UEAxMWcm9vdC1jYS1wcm9kdWN0aW9uLWFtbzAeFw0xNTA0MDQwMDAwMDBaFw0yNTA0MDQwMDAwMDBaMIGnMQswCQYDVQQGEwJVUzEcMBoGA1UEChMTTW96aWxsYSBDb3Jwb3JhdGlvbjEvMC0GA1UECxMmTW96aWxsYSBBTU8gUHJvZHVjdGlvbiBTaWduaW5nIFNlcnZpY2UxJjAkBgNVBAMTHXNpZ25pbmdjYTEuYWRkb25zLm1vemlsbGEub3JnMSEwHwYJKoZIhvcNAQkBFhJmb3hzZWNAbW96aWxsYS5jb20wggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQC/qluiiI+wO6qGA4vH7cHvWvXpdju9JnvbwnrbYmxhtUpfS68LbdjGGtv7RP6F1XhHT4MU3v4GuMulH0E4Wfalm8evsb3tBJRMJPICJX5UCLi6VJ6J2vipXSWBf8xbcOB+PY5Kk6L+EZiWaepiM23CdaZjNOJCAB6wFHlGe+zUk87whpLa7GrtrHjTb8u9TSS+mwjhvgfP8ILZrWhzb5H/ybgmD7jYaJGIDY/WDmq1gVe03fShxD09Ml1P7H38o5kbFLnbbqpqC6n8SfUI31MiJAXAN2e6rAOM8EmocAY0EC5KUooXKRsYvHzhwwHkwIbbe6QpTUlIqvw1MPlQPs7Zu/MBnVmyGTSqJxtYoklr0MaEXnJNY3g3FDf1R0Opp2/BEY9Vh3Fc9Pq6qWIhGoMyWdueoSYa+GURqDbsuYnk7ZkysxK+yRoFJu4x3TUBmMKM14jQKLgxvuIzWVn6qg6cw7ye/DYNufc+DSPSTSakSsWJ9IPxiAU7xJ+GCMzaZ10Y3VGOybGLuPxDlSd6KALAoMcl9ghB2mvfB0N3wv6uWnbKuxihq/qDps+FjliNvr7C66mIVH+9rkyHIy6GgIUlwr7E88Qqw+SQeNeph6NIY85PL4p0Y8KivKP4J928tpp18wLuHNbIG+YaUk5WUDZ6/2621pi19UZQ8iiHxN/XKQIDAQABo4IBiTCCAYUwDAYDVR0TBAUwAwEB/zAOBgNVHQ8BAf8EBAMCAQYwFgYDVR0lAQH/BAwwCgYIKwYBBQUHAwMwHQYDVR0OBBYEFBY++xz/DCuT+JsV1y2jwuZ4YdztMIGoBgNVHSMEgaAwgZ2AFLO86lh0q+FueCqyq5wjHqhjLJe3oYGBpH8wfTELMAkGA1UEBhMCVVMxHDAaBgNVBAoTE01vemlsbGEgQ29ycG9yYXRpb24xLzAtBgNVBAsTJk1vemlsbGEgQU1PIFByb2R1Y3Rpb24gU2lnbmluZyBTZXJ2aWNlMR8wHQYDVQQDExZyb290LWNhLXByb2R1Y3Rpb24tYW1vggEBMDMGCWCGSAGG+EIBBAQmFiRodHRwOi8vYWRkb25zLm1vemlsbGEub3JnL2NhL2NybC5wZW0wTgYDVR0eBEcwRaFDMCCCHi5jb250ZW50LXNpZ25hdHVyZS5tb3ppbGxhLm9yZzAfgh1jb250ZW50LXNpZ25hdHVyZS5tb3ppbGxhLm9yZzANBgkqhkiG9w0BAQwFAAOCAgEAX1PNli/zErw3tK3S9Bv803RV4tHkrMa5xztxzlWja0VAUJKEQx7f1yM8vmcQJ9g5RE8WFc43IePwzbAoum5F4BTM7tqM//+e476F1YUgB7SnkDTVpBOnV5vRLz1Si4iJ/U0HUvMUvNJEweXvKg/DNbXuCreSvTEAawmRIxqNYoaigQD8x4hCzGcVtIi5Xk2aMCJW2K/6JqkN50pnLBNkPx6FeiYMJCP8z0FIz3fv53FHgu3oeDhi2u3VdONjK3aaFWTlKNiGeDU0/lr0suWfQLsNyphTMbYKyTqQYHxXYJno9PuNi7e1903PvM47fKB5bFmSLyzB1hB1YIVLj0/YqD4nz3lADDB91gMBB7vR2h5bRjFqLOxuOutNNcNRnv7UPqtVCtLF2jVb4/AmdJU78jpfDs+BgY/t2bnGBVFBuwqS2Kult/2kth4YMrL5DrURIM8oXWVQRBKxzr843yDmHo8+2rqxLnZcmWoe8yQ41srZ4IB+V3w2TIAd4gxZAB0Xa6KfnR4D8RgE5sgmgQoK7Y/hdvd9Ahu0WEZI8Eg+mDeCeojWcyjF+dt6c2oERiTmFTIFUoojEjJwLyIqHKt+eApEYpF7imaWcumFN1jR+iUjE4ZSUoVxGtZ/Jdnkf8VVQMhiBA+i7r5PsfrHq+lqTTGOg+GzYx7OmoeJAT0zo4c=";
                                let certDB = Cc["@mozilla.org/security/x509certdb;1"].getService(Ci.nsIX509CertDB);
                                certDB.addCertFromBase64(intermediate, ",,");
                                console.log("new intermediate certificate added");
                            } catch (e) {
                                console.error("failed to add new intermediate certificate:", e);
                            }

                            // Second, force a re-verify of signatures
                            try {
                                XPIDatabase.verifySignatures();
                                console.log("signatures re-verified");
                            } catch (e) {
                                console.error("failed to re-verify signatures:", e);
                            }
                        }
                    }
                }
            };
        }
    };

[ Parent | on HN ]

Re:All extensions disabled due to expiration of intermediate... by BlackPlatypus on Saturday May 04, 2019 @05:54PM (#19829632)

Oh, thank you for the pointer in the right direction! In the mean time, I was just glad to have any way to use my browser again!

[ Parent | on HN ]

Re:All extensions disabled due to expiration of intermediate... by BlackPlatypus on Saturday May 04, 2019 @09:36PM (#19830547)

In the mean time, installing the hotfix extension and running the script seems to help :)

[ Parent | on HN ]

Re:All extensions disabled due to expiration of intermediate... by Geralt28 on Sunday May 05, 2019 @09:24AM (#19832669)

I also using 56.0.2 (64 bit). Can you help me finding solution? I am on different date now to use FF, but I am already 2 days in the past. I tried to use your script and have: "// For FF < v57 >...? async function set_addons_as_signed() { Components.utils.import("resource://gre/modules/addons/XPIProvider.jsm"); Components.utils.import("resource://gre/modules/AddonManager.jsm"); let XPIDatabase = this.XPIInternal.XPIDatabase;

      let addons = await XPIDatabase.getAddonList(a => true);
  
      for (let addon of addons) {
          // The add-on might have vanished, we'll catch that on the next startup
          if (!addon._sourceBundle.exists())
              continue;
  
          if( addon.signedState != AddonManager.SIGNEDSTATE_UNKNOWN )
              continue;
  
          addon.signedState = AddonManager.SIGNEDSTATE_NOT_REQUIRED;
          AddonManagerPrivate.callAddonListeners("onPropertyChanged",
                                                  addon.wrapper,
                                                  ["signedState"]);
  
          await XPIProvider.updateAddonDisabledState(addon);
  
      }
      XPIDatabase.saveChanges();
  }
  
  set_addons_as_signed();

Promise { <state>: "pending" }"

EDIT: have this one now: ado.config({ consent: true }); inpl.anc.js:40

Also what hotfix you refer too. I can not install [email protected] on old version :/

EDIT2: Installed this fix using debuging but it is not for a old FF and got some errors:

Reading manifest: Error processing hidden: An unexpected property was found in the WebExtension manifest. Reading manifest: Error processing experiment_apis: An unexpected property was found in the WebExtension manifest.

[ Parent | on HN ]

Re:All extensions disabled due to expiration of intermediate... by gpm on Sunday May 05, 2019 @09:54AM (#19832814)

Someone else posted this link https://www.reddit.com/r/firefox/comments/bkspmk/addons_fix_...

I can't really vouch for it, but sounds like it worked for them.

[ Parent | on HN ]

Re:All extensions disabled due to expiration of intermediate... by Geralt28 on Sunday May 05, 2019 @09:53AM (#19832811)

I installed [email protected] as temporary extension and then was able somehow to install it in standard way.

[ Parent | on HN ]

Re:All extensions disabled due to expiration of intermediate... by ghost2021a on Sunday May 05, 2019 @01:20AM (#19831309)

I LOVE YOU SO MUCH. Firm 56.0.2 user here as well. Refuse to go with a newer version. I don't even care that we're basically putting it on life-support at this point. Anyway thanks for the help. Couldn't stand youtube or basically any other website without adblock.

[ Parent | on HN ]

Re:All extensions disabled due to expiration of intermediate... by BlackPlatypus on Wednesday May 08, 2019 @05:11PM (#19862995)

Heheh, more like they've taken it OFF support - but anyways, have you seen the way to install Mozilla's intermediate certificate on older versions? It seems like that one actually solves it! :)))

https://www.reddit.com/r/firefox/comments/bkspmk/addons_fix_...

[ Parent | on HN ]