Safari client certificate problem w/ Canada Post website

Question

Level 1

8 points

Safari client certificate problem w/ Canada Post website

I am using OSX 10.8.5 and Safari 6.1.1

I'm trying to use the Canada Post website for online shipping (ship-in-a-click) via the site:

http://www.canadapost.ca/personal/tools/cst/intro-e.asp

When I choose my option (in this case INTERNATIONAL) a pop-up opens asking to select a client certificate. A list of five certificates, which are all apparently valid and not expired, is given. No matter which certificate I select I cannot get past this pop up window. It just pops back up again.

The certificates are all in the form:

com.apple.idms.appleid.prd. then a very lengthy alpha numeric string

From what I have read with certificate problems you can just delete them and next time you visit the site will ask you to select a new one. However, in this case, with all the certificates seemingly being valid, I don't think that will be the solution. Although, I am a complete novice when it comes to these issues.

Can anybody suggest something other than using Firefox/Chrome etc. although if that is the ONLY choice then so be it. But surely this can be solved within Safari, no? The rest of the Canada Post site seems to behave OK with Safari.

Thank you.

OS X Mountain Lion (10.8.5)

Posted on Dec 18, 2013 6:19 AM

Reply

Answer 1

Jan 9, 2017 6:39 AM in response to RiverdaleMAC

I would quit Safari, launch the application "Keychain Access" and search for "com.apple.idms.appleid.prd".

Delete the results and then relaunch Safari and go to the website again. See if that works for you. I had the same issue with a website (that did an update under the hood) that kept asking me for a certificate. Haven't had issues since.

Reply

Answer 2

RiverdaleMAC Author

Level 1

8 points

Jan 14, 2017 8:47 AM in response to RiverdaleMAC

Well, it seems Canada Post no longer allows for online postage purchase/printing when shipping to international destinations. Thus, the problem hasn't really been resolved in as much as it no longer exists. Thanks for the advice and suggestions along the way though.

Reply

Answer 3

Jan 8, 2014 11:43 AM in response to RiverdaleMAC

This is actualy a bug in Safari. When you connect to a SSL protected site (HTTPS) the site can also authenticate you with a certificate file. This is not widley used and you don't need it if you don't know about it.

The problem is: the server is telling Safari that it *can* accept a client certificate and safari is trying to send (a wrong) one.

I ran into this while adding SSL Client Authentication to our corporate website (to identify our employees, not customers).

To make matters worse if you only have one com.apple.idms.appleid.prd.xxxx certificate then Safari will silently send THAT certificate which will fail the authentication check, effectivly locking you out of the server.

In my testing it appears that chrome and firefox do handle this situation as appropriate (they do not send a client certificate if they don't have one matching what the server says it will accept).

Reply

Answer 4

RiverdaleMAC Author

Level 1

8 points

Jan 12, 2014 3:19 PM in response to ErebusBat

Thanks for letting me know it is a bug. I'm about to update to Mavericks, any chance the version of Safrai that works with that has had the bug fixed? Or does that introcue another whole level of issues?

Thanks again.

Reply

Answer 5

Jan 12, 2014 3:43 PM in response to RiverdaleMAC

Neither. I am on Mavericks and it shows the exact same issue, so it neither fixes the problem or intoduces new ones, at least with my site.

I also noticed that it is somewhat based on the loction (IP) of the server because on my local laptop (During development) and on our QA server would try and send a certificate that it should not send. HOWEVER once we implemented the SSL client certificate on our production server it would no longer send the certificate. I have no idea why and speculate that it is because our production server has a public IP.

If you want you can use my site and see if the problem persists for you there (http://whf.to); however given the seemingly random why Safari decides to send certificates you may or may not see the issue. If Safari does indeed send a certificate you should get an error page that details what happened (in somewhat lay-terms).

Sorry that Mavericks doesn't fix the issue for you.

Reply

Answer 6

Pitasso

Level 1

0 points

Jul 15, 2014 7:27 PM in response to ErebusBat

You mentioned that you faced this problem while adding SSL Client Authentication to your website. Is there any fix on a website level?

Some of my customers have the same problem on my website and asking them to use chrome/firefox or change any settings in Safari is not a solution=( Could you give any advice on that?

Thanks!

Reply

Answer 7

Sep 25, 2014 2:30 AM in response to ErebusBat

In our case it comes as soon as you start using iCloud. If you are logged in as an admin, then the certificate (com.apple.idms.appleid.prd...) gets into the keyChain without asking for permission. And Safari tries to use this certificate to access any other web-page you might call. But strangely, if you are logged in with a normal user account, you do not have the problem at all. I guess the keyChain might be locked or in that case the certificate goes into the correct container where it does no harm or where it can be used for iCloud access only. I would have to verify and test this latter case.

As our users want to access our Exchange-2010 Mail-Server through OWA, I tried even disabling/ignoring client certificates in the IIS-Server of our CAS&HUB servers, but with no avail.

So for the moment being the only workaround is to delete the com.apple.idms.appleid.prd certificate from the keychain and delete it again as soon as it is introduced again, or not using iCloud at all.

Any other hints? Or is it still a bug? Rosario

Reply