Monday, July 14, 2008

Installing DOD CLASS 3 CA-7 security certificate into Firefox 3.0

Superseded by http://cheesehead-techblog.blogspot.com/2015/10/cac-on-firefox-using-ubuntu-1504.html

The US Army has a plethora of websites to keep it's mighty bureaucracy chugging along. Unfortunately, the security certificate they all require is not included in Firefox 3.0 (under Ubuntu 8.04). Here's how to get it and install it.
NOTE: The certificate is worthless to non-DOD people. It doesn't give you access, you still need an account. It's really boring, anyway, and none of the cool secret stuff is in these websites. All the certificate really does for most people is prevent the annoying message: This website has a certificate that I don't trust.
  1. Download the following three files to the desktop:
    • http://dodpki.c3pki.chamb.disa.mil/rel3_dodroot_1024.p7b
    • http://dodpki.c3pki.chamb.disa.mil/rel3_dodroot_2048.p7b
    • http://dodpki.c3pki.chamb.disa.mil/dodeca.p7b


    The easy way in linux is to use curl -O http://dodpki.c3pki.chamb.disa.mil/rel_dodroot_1024.p7b -O http://dodpki.c3pki.chamb.disa.mil/rel3_dodroot_1024.p7b -O http://dodpki.c3pki.chamb.disa.mil/dodeca.p7b

  2. Go to the Firefox Certificate Manager
    • Open Firefox
    • Edit Menu --> Preferences
    • Advanced settings
    • Encryption tab
    • View Certificates button

  3. Import the three new certificates
    (Repeat for each certificate)
    • Authorities tab
    • Click the 'Import' button
    • Show firefox where the downloaded certificate is and click 'OK'

  4. Fix a bug with the CLASS 3 CA-7 Certificate
    • In the Certificate Manager, Authorities Tab, scroll down to the new 'US Government' entries
    • Select DOD CLASS 3 CA-7, and click the 'Edit' button
    • Two of the certificate boxes should be checked. Check them if they are not:

      This certificate can identify web sites

      This certificate can identify mail users

  5. Whew. You're done. Close the windows, restart Firefox and test it.
Importing the same certificates to Evolution is a similar method.

No comments: