Firefox add-ons disabled en masse after Mozilla certificate issue
An expired certificate on the Mozilla Add-ons infrastructure is disabling Firefox add-ons for millions of users, and is also preventing users from re-activating or (re-)installing extensions.
The issue doesn't impact all Firefox users, but it impacted enough to trigger a massive surge of complaints on Twitter, Reddit, and other social media sites.
At the time of writing, the issue is still impacting Firefox users. The browser maker has formally acknowledged the issue in an email to ZDNet, on Twitter, in a status page, and in a bug report.
"We're sorry that there is currently an issue where existing and new add-ons are failing to run or be installed on Firefox," a Mozilla spokesperson said. "We know what the issue is and are working hard to restore add-on functionality to Firefox as soon as possible."
"We'll continue to provide updates via our Twitter channels. Please bear with us while we get the problem fixed," the browser maker said.
Users of all Firefox versions, old and new, and Stable and Nightly, are impacted. The issue also impacts the Tor Browser, which supports Firefox add-ons.
For Firefox users that are currently impacted by this bug, an easy workaround would be to visit the about:config section and set xpinstall.signatures.required to false. This disables the extension signing mechanism in Firefox, the system through which the browser verifies that the local extension is one that's been installed from the central Mozilla Add-ons repository --and for which the signing certificate had expired.
Another possible way to resolve it, as recommended by many Firefox users, would be to turn system clocks before May 4, 12:00am UTC (the date at which the Mozilla certificate expired), but this would also break other apps running locally, and which depend on an accurate system clock.
Today's outage is happening because all Firefox add-ons are digitally signed since the release of Firefox 48, in the summer of 2016.
This mechanism was introduced to fight off malware distributors that were abusing Firefox add-ons; however, it indirectly centralized all add-ons management operations by tying all extensions to Mozilla's server infrastructure.
Updated on 9am ET: Mozilla has announced a temporary hotfix for the add-ons signing issue.
"We rolled out a hotfix that re-enables affected add-ons. The fix will be automatically applied in the background within the next few hours," the company said.
All the Chromium-based browsers
More browser coverage:
- Google Chrome 74 released with Dark Mode support for Windows users
- Chrome on Android: Phishing attackers can now trick you with fake address bar
- Ex-YouTube developer reveals how he 'conspired to kill IE6'
- Windows 10 security feature causes 'huge' Chromium performance issues: Fix coming
- Mozilla announces ban on Firefox extensions containing obfuscated code
- Google Chrome to get a Reader Mode
- What enterprises need to know about the new Chromium-based Edge TechRepublic
- Google's most secure login system now works on Firefox and Edge, too CNET