Swif Browser Security, Swif's browser extension, talks to the Swif agent on the same device. In Firefox, this connection is encrypted, using two certificates the agent creates on each device. This article explains what they are, where they're stored, and how to check them. It's for IT and security teams who find them, and want to understand them.
Summary
Question | Answer |
What are they? |
|
What are they for? | An encrypted connection between Swif Browser Security in Firefox and the Swif agent, on the same device. Other browsers don't need them. |
Do they leave the device? | No. The agent creates them on each device, and the CA's private key never leaves it. No two devices share a key. |
What can the CA sign? | Only certificates for |
Key size | 4096-bit RSA, for both certificates |
Are they needed to enroll the device, or for the agent to work? | No. Only Swif Browser Security in Firefox needs them. |
How Swif Browser Security connects to the agent
Swif Browser Security uses the agent on the same device for features such as:
showing device information and compliance status in the browser
reading local accounts, to reset passwords
checking that new passwords meet your password policy
self-service app installs
Browser | Connection | Certificate needed |
Chrome, Edge, Safari |
| No |
Firefox |
| Yes |
tryswif.com stays on the device. Swif maps tryswif.com to 127.0.0.1 on each device, so the connection never leaves it. Firefox isn't contacting a website.
The two certificates
Certificate | Role |
| A certificate authority the agent creates on each device. It's used only to sign |
| The server certificate the agent presents to Firefox, at |
Why two certificates? A certificate authority can't be used as a server's certificate. And browsers require the server's certificate to match the name they connect to, tryswif.com. So the agent presents tryswif.com.crt. On Windows and Linux, Firefox trusts it because it's signed by the device's own CA. On macOS, Firefox trusts tryswif.com.crt directly, through the Swif WSS Settings profile.
Where they're stored
Platform | Folder |
macOS |
|
Windows |
|
Linux |
|
How Firefox is set to trust them
Platform | How | Operating system trust store |
macOS | The Swif WSS Settings configuration profile adds | The certificates aren't added to the System or login keychain. |
Windows | The agent adds | Changed. Only one Swif WSS Local CA is kept there. Because the CA can only sign certificates for |
Linux | The agent adds | Not changed. |
On macOS, checking the certificate against the System keychain, for example with security verify-cert, returns CSSMERR_TP_NOT_TRUSTED. This is expected, since the certificates are trusted only by Firefox.
Check the certificates
Key size. Run the command for the platform. It should show 4096 bit.
macOS:
sudo openssl x509 -in /usr/local/swifteam/wss-local-ca.crt -noout -text | grep "Public-Key"
Linux:
sudo openssl x509 -in /var/lib/swifteam/wss-local-ca.crt -noout -text | grep "Public-Key"
Windows, in an administrator Command Prompt:
certutil -dump "C:\Program Files\Swifteam\wss-local-ca.crt" | findstr /C:"Public Key Length"
In Firefox: go to Settings > Privacy & Security > Certificates > View Certificates. On macOS, look for tryswif.com on the Authorities tab. On Linux, look for Swif WSS Local CA on the Authorities tab.
Updates from 2048-bit keys
Earlier agents created 2048-bit keys. These agent versions, and later, create 4096-bit keys:
Platform | Agent version |
macOS | 1.371.0 |
Windows | 1.344.0 |
Linux | 1.433.0 |
When a device updates, the agent replaces the old certificates automatically. Users don't need to do anything. On Windows, the old CA is removed from the Trusted Root Certification Authorities store, so only the new one remains. After that, the certificates are kept, and aren't created again on restart.
What happens without them
Without the certificates | Result |
Enrollment, device management, and the agent's connection to Swif | Not affected |
Swif Browser Security in Chrome, Edge, and Safari | Not affected |
Swif Browser Security in Firefox | Features that need the agent don't work, such as device information, compliance status, password reset, and self-service app installs |
Troubleshooting
Firefox can't connect to the Swif agent
Check that Swif Browser Security is installed in Firefox, through your Firefox extension policy.
macOS: check that the Swif WSS Settings profile is installed, in System Settings > General > Device Management.
Windows: check that Swif WSS Local CA is in Trusted Root Certification Authorities. In an administrator Command Prompt, run
certutil -store Root, and look for Swif WSS Local CA.Restart Firefox.
The key size shows 2048 bit
The device has an older agent. Update it to the version in Updates from 2048-bit keys. The agent then replaces the certificates automatically.
security verify-cert says the certificate isn't trusted on a Mac
This is expected. On Macs, the certificates are trusted only by Firefox, not by the System or login keychain.
Our security tools flag "Swif WSS Local CA" in the Windows trust store
This is Swif WSS Local CA, Swif's local CA. It's created on that device, its private key never leaves it, and it can only sign certificates for tryswif.com. Firefox on Windows uses it to trust the agent's local connection.
Related resources