Firefox is configured to ask which certificate to present to a web site when a certificate is required.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-57583	DTBF-0005	SV-71993r1_rule		Medium

Description
When a web site asks for a certificate for user authentication, Firefox must be configured to have the user choose which certificate to present. Websites within DOD require user authentication for access which increases security for DoD information. Access will be denied to the user if certificate management is not configured.

STIG	Date
Mozilla Firefox	2017-03-22

Details

Check Text ( C-58415r3_chk )
Procedure: In about:config, verify that the setting for the following Preference Name’s are set and locked. "security.default_personal_cert", set to "Ask Every Time". Criteria: If the value of "security.default_personal_cert" is set incorrectly or is not locked, then this is a finding.

Fix Text (F-62783r3_fix)
Set and lock the following preferences using the “Mozilla.cfg” file: "security.default_personal_cert”, set to "Ask Every Time".