Chrome, Linux, headless, using client certificates

Dave Gray 0
Viewed 16

I am having a problem passing my test user's PKI certificates in the headless mode. I am using Java Selenium WebDriver 4.3.0. When I run my test suite in normal mode, my profile and certificates are picked up perfectly. Profile users are selected by the ChromeOptions class by identifying the --user-data-dir= . I have different profiles for each of my test users. Then the certificate is selected by the policy setting (i.e, AutoSelectCertificateForUrls). That also works perfectly. As I navigate to different URL locations my test certificates are presented and accepted correctly when I run in the normal mode.

When I change the mode to Headless=true (i.e., ChromeOptions.addArguents("--headless"), it all falls apart and no certificate is presented when I open a Chrome browser and hit any webpage.

I found that Firefox was extremely simple to manage profiles and PKI test certificates!!! When a test runs in normal mode and works perfectly, all I have to do is set the FirefoxOptions.addCommandLineOptions("--headless"); and it still works perfectly in the headless mode. Not so with Chrome!!!

Does anyone know the correct solution? I could use the information. I am really stuck here.... Is there a way to still make Chrome present PKI certificates in headless mode or does anyone know that this feature really does not work for Chrome/Chromium? Then I could stop wasting my time!

Thanks in advance for your help!

google-chrome ssl selenium
1 Answers

Well I actually found my own answer.
Unfortunately, it does not work!!!

It is all explained in the following issue.
Issue 1310715: Headless Chrome not using installed client (authentication) certificates from the store.

This issue shows the steps to reproduce.

UserAgent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.82 Safari/537.36

Steps to reproduce the problem:

  1. Have a website behind a webserver that has browser client authentication with an SSL certificate.
  2. Install the certificate in the certificate store of Chrome under $HOME/pki/nssdb folder. My certificate was in pk12 format, so I used pk12util to install it.
  3. The installation must exit with: 'pk12util: PKCS12 IMPORT SUCCESSFUL' message.
  4. Add a policy to your website under /etc/opt/chrome/policies/managed, so that Chrome provides the certificate automatically to the site's webserver.
  5. Open the website.

What is the expected behavior? When the browser is started in headless or headful mode, the browser should provide the certificate to the webserver and proceed further.

What went wrong? Only in headful mode does the browser provide the certificate to the webserver. Headless mode does not. There's this error in the logs:

The issue response states the following:

Headless Chrome doesn't currently implement client certs. Switching this to a feature request that the headless folks can triage. Mechanically, client certs are come out of //content via CreateClientCertStore and SelectClientCertificate. Headless doesn't have a way to show UI, so it always continues without a client certificate.

https://bugs.chromium.org/p/chromium/issues/detail?id=1310715&q=component%3AInternals%3EHeadless&can=2

Dave Gray0
Related