Firefox Browser version 43 has new plug-in signing requirements. F5 will be providing Engineering Hotfixes for BIG-IP versions 12.0.0, 11.6.0, and 11.5.3, which will include a F5 Access Policy Manager plug-in signed by Firefox for Microsoft Windows and Linux platforms. With F5 officially supporting Firefox version 34, this is a “best efforts” approach to alleviate any disruptions brought about by Firefox version 43 and the upcoming Firefox version 44, related to plug-in signing requirements (Feature Enhancement ID: 564253).
If issues are uncovered with versions of Firefox greater than version 34 after installing the appropriate Engineering Hotfix, it is recommended that users be guided to use Microsoft Internet Explorer on Windows, and Safari on Mac, as detailed in this DevCentral post. Another option is to use BIG-IP Edge Client for these two platforms. For Linux, there is a CLI client available for network access.
These Engineering Hotfix releases are short-term fixes. A more permanent solution will be available in an upcoming release of BIG-IP; specifics will also be available in the aforementioned DevCentral post.
We will make the Engineering hotfixes available for customers who create a support case with F5 Support.
This Engineering Hotfix should be good for up to Firefox 46 and F5 will need to have Mozilla sign the plug-in again for Firefox 47+. This is just how Firefox plug-in signing works currently.
January 7, 2016 Update: While we (F5) is making progress in getting the Engineering hotfixes out, we are currently working through some issues seen with the Mozzilla add-on submission tool. Once that is resolved, then we expect to be able to provide an ETA for the Engineering Hotifxes. F5 is working on this with urgency.
January 8, 2016 Update: We (F5) have the issue with the Mozilla add-on tools resolved, so we can provide a target ETA of January 15, 2016 (Friday) to provide Engineering Hotfixes for the 3 versions of BIG-IP we had mentioned on this post.
January 14, 2016 Update: We have run into a few issues that need to be addressed so we will need a few more days to have the Engineering Hotfixes available. Again, F5 is working on this with urgency.
January 21, 2016 Update: We have an Engineering Hotfix for BIG-IP 11.6.0, based on BIG-IP 11.6.0 Hotfix 6 now. Again to get it, customers should create a support case with F5 Support. We are still planning to provide an Engineering Hotfix for BIG-IP 12.0.0 and 11.5.3 soon.
January 25, 2016 Update: We have an Engineering Hotfix for BIG-IP 12.0.0 based on BIG-IP 12.0.0 Hotfix 1 now. Again to get it, customers should create a support case with F5 Support. We are still planning to provide an Engineering Hotfix for BIG-IP 11.5.3 soon.
January 26, 2016 Update: We have an Engineering Hotfix for BIG-IP 11.5.3 based on BIG-IP 11.5.3 Hotfix 2. Customers should create a support case with F5 Support.
F5 will target to release Engineering Hotfixes before Firefox 47 is available.
May 9, 2016 Update: F5 is currently working on Engineering Hotfixes for the various BIG-IP for Firefox 47+ that would work for all Firefox versions (even Firefox 46 and earlier). Mozilla is allowing for plug-in signing for all (*) versions of Firefox again. We do not have the releases ready for customers yet but expect to have it shortly. Once they are available, we will announce it here and also provide it initially to F5 Support and thus customers can get it via a Support ticket. Shortly after it is available via F5 Support, we will provide it on https://downloads.f5.com.
May 16, 2016 Update: F5 has Engineering Hotfixes for 11.5.4 HF1 and 11.6.0 HF6 available. These should work with all versions* of Firefox (including Firefox 47 Beta builds). For now, customers should create a support ticket with F5 Support to get the Engineering Hotfixes. We will provide it on https://downloads.f5.com shortly and we are also working on Engineering Hotfixes for 12.0.0 HF2 and 11.6.1.
May 21, 2016 Update: F5 has Engineering Hotfix for 12.0.0 HF2 available. These should work with all versions* of Firefox (including Firefox 47 Beta builds). For now, customers should create a support ticket with F5 Support to get the Engineering Hotfixes. We will provide it on https://downloads.f5.com shortly and we are also working on Engineering Hotfixes for 11.6.1 and 12.1.0.
May 31, 2016 Update: F5 has Engineering Hotfix for 11.6.1 available. For now, customers should create a support ticket with F5 Support to get the Engineering Hotfixes.
*These Engineering Hotfixes should work on all versions of Firefox, including 47+, until Firefox removes its NPAPI support. To address that we have another DevCentral post: here: https://devcentral.f5.com/s/articles/addressing-security-loopholes-of-third-party-browser-plug-ins
Regarding the part "it is recommended that users be guided to use Microsoft Internet Explorer on Windows, and Safari on Mac, as detailed in this DevCentral post. Another option is to use BIG-IP Edge Client for these two platforms. For Linux, there is a CLI client available for network access. " What about the AppTunnel use case? The FR about Edge support for AppTunnel (as it was with Firepass) has been opened a while ago.
I did manage to get it working on a fresh installation of Firefox but on other systems where Firefox was already installed it kept refusing to install the add-on. Even after deleting all the cache and uninstalling the previous plugin etc. it wouldn't install. How did F5 test the new F5 add-on/plugin in Firefox? Is there any documentation on that available?
Mozilla is going to release Firefox 47 in 2016-06-07.
The Engineering Hotfixe (ID564253) is available until Firefox 46.
So we are want new Engineering Hotfix for Firefox 47 and later before Mozilla release it.
Will new Engineering Hotfix be provided prior to the release date of the Firefox 47?
I have question to May 16, 2016 Update.
> These should work with all versions of Firefox (including Firefox 47 Beta builds).
Are there Hotfix support Firefox that Mozilla will be released until the end of support NPAPI ?
@yamamoto. No, you're correct that these Mozilla signed plug-ins should stop working when Firefox stops supporting NPAPI. For that, F5 is moving away from browser plug-ins as we wrote in this DevCentral post. https://devcentral.f5.com/s/articles/addressing-security-loopholes-of-third-party-browser-plug-ins
I will update his post shortly to make sure there is no confusion about that.
I don't see the ID 564253 in the 12.1 release notes. Is that intentional (wait for the newer EngHF to include 47+)?
Is it a different ID for the fix you refer in your May 9th update?
Daphne-san. Thank you! So I understand that these Engineering Hotfixes support all Firefox version, but if Mozilla will finish support NPAPI, Hotfixes will stop work on Firefox.
@amolari BIG-IP 12.1.0 doesn't have the new the Firefox plug-ins for Firefox 47+ on Windows and that's why we are working on an Engineering Hotfix for it.
@amolari BIG-IP 12.1.0 doesn't have the new the Firefox plug-ins for Firefox 47+ on Windows and that's why we are working on an Engineering Hotfix for it.
