Unexpected NSS Certificate DB popup open on Windows

[fazizian]

Before I can choose a certificate, an unexpected popup open ("Fortify - NSS Certificate DB"). Then I click on "OK" button, without enter any password, and the pop-up close. And I finally can see my certificates list.

Why this popup appear ? It is useless bacause we don't need to write any password.

OS : Windows 10 Fortify App : 1.8.0 (It was the same on 1.5.0 and 1.7.0)

[rmhrisk]

NSS. Is requiring the password to enumerate the certificates.

[fazizian]

Like I said, even if I let the textfield empty and click on "OK", I can see the enumeration of certificates. So I don't understand what this popup is it for. And It should be the password of what ?

[microshine]

Fortify prompts password if PKCS#11 slot has got a special flag CKF_LOGIN_REQUIRED. Looks like your 'NSS Certificate DB' provider returns that flag.

https://github.com/PeculiarVentures/node-webcrypto-p11/blob/cfe8b943a954553ec46600be692c1d1e51917535/src/crypto.ts#L86

[rmhrisk]

re: And It should be the password of what ? It is the password NSS's PKCS#11 implementation is requesting when the enumeration is done. It is possible you would see additional certificates if you also provided the password.

Fortify prompts for the password when the PKCS#11 provider says it needs a password, that is what is happening.

You can attach a Fortify log and I believe it will make it clearer for you.