mtls not working due to crypto db error

[Henri2777]

Steps To Reproduce

When i run Bitwarden Desktop, i get the following logs:

flatpak run com.bitwarden.desktop
ERROR: ld.so: object '/app/bin/libprocess_isolation.so' from LD_PRELOAD cannot be preloaded (cannot open shared object file): ignored.
[2 preload-host-spawn-strategy] Failed to expose '/app/bin/libprocess_isolation.so' into sandbox: Datei oder Verzeichnis nicht gefunden (errno 2)
ERROR: ld.so: object '/app/bin/libprocess_isolation.so' from LD_PRELOAD cannot be preloaded (cannot open shared object file): ignored.
Checking for beta autoupdate feature for deb/rpm distributions
Found package-type: rpm
22:13:56.217 › State version: 75
22:13:56.219 › Migrator MinVersionMigrator (to version 3) should migrate: false - up
22:13:56.219 › Migrator RemoveEverBeenUnlockedMigrator (to version 4) should migrate: false - up
22:13:56.219 › Migrator AddKeyTypeToOrgKeysMigrator (to version 5) should migrate: false - up
22:13:56.220 › Migrator RemoveLegacyEtmKeyMigrator (to version 6) should migrate: false - up
22:13:56.220 › Migrator MoveBiometricAutoPromptToAccount (to version 7) should migrate: false - up
22:13:56.220 › Migrator MoveStateVersionMigrator (to version 8) should migrate: false - up
22:13:56.220 › Migrator MoveBrowserSettingsToGlobal (to version 9) should migrate: false - up
22:13:56.220 › Migrator EverHadUserKeyMigrator (to version 10) should migrate: false - up
22:13:56.220 › Migrator OrganizationKeyMigrator (to version 11) should migrate: false - up
22:13:56.221 › Migrator MoveEnvironmentStateToProviders (to version 12) should migrate: false - up
22:13:56.221 › Migrator ProviderKeyMigrator (to version 13) should migrate: false - up
22:13:56.221 › Migrator MoveBiometricClientKeyHalfToStateProviders (to version 14) should migrate: false - up
22:13:56.221 › Migrator FolderMigrator (to version 15) should migrate: false - up
22:13:56.221 › Migrator LastSyncMigrator (to version 16) should migrate: false - up
22:13:56.221 › Migrator EnablePasskeysMigrator (to version 17) should migrate: false - up
22:13:56.221 › Migrator AutofillSettingsKeyMigrator (to version 18) should migrate: false - up
22:13:56.221 › Migrator RequirePasswordOnStartMigrator (to version 19) should migrate: false - up
22:13:56.221 › Migrator PrivateKeyMigrator (to version 20) should migrate: false - up
22:13:56.221 › Migrator CollectionMigrator (to version 21) should migrate: false - up
22:13:56.222 › Migrator CollapsedGroupingsMigrator (to version 22) should migrate: false - up
22:13:56.222 › Migrator MoveBiometricPromptsToStateProviders (to version 23) should migrate: false - up
22:13:56.222 › Migrator SmOnboardingTasksMigrator (to version 24) should migrate: false - up
22:13:56.222 › Migrator ClearClipboardDelayMigrator (to version 25) should migrate: false - up
22:13:56.222 › Migrator RevertLastSyncMigrator (to version 26) should migrate: false - up
22:13:56.222 › Migrator BadgeSettingsMigrator (to version 27) should migrate: false - up
22:13:56.222 › Migrator MoveBiometricUnlockToStateProviders (to version 28) should migrate: false - up
22:13:56.222 › Migrator UserNotificationSettingsKeyMigrator (to version 29) should migrate: false - up
22:13:56.222 › Migrator PolicyMigrator (to version 30) should migrate: false - up
22:13:56.222 › Migrator EnableContextMenuMigrator (to version 31) should migrate: false - up
22:13:56.222 › Migrator PreferredLanguageMigrator (to version 32) should migrate: false - up
22:13:56.223 › Migrator AppIdMigrator (to version 33) should migrate: false - up
22:13:56.223 › Migrator DomainSettingsMigrator (to version 34) should migrate: false - up
22:13:56.223 › Migrator MoveThemeToStateProviderMigrator (to version 35) should migrate: false - up
22:13:56.223 › Migrator VaultSettingsKeyMigrator (to version 36) should migrate: false - up
22:13:56.223 › Migrator AvatarColorMigrator (to version 37) should migrate: false - up
22:13:56.223 › Migrator TokenServiceStateProviderMigrator (to version 38) should migrate: false - up
22:13:56.223 › Migrator MoveBillingAccountProfileMigrator (to version 39) should migrate: false - up
22:13:56.223 › Migrator OrganizationMigrator (to version 40) should migrate: false - up
22:13:56.223 › Migrator EventCollectionMigrator (to version 41) should migrate: false - up
22:13:56.223 › Migrator EnableFaviconMigrator (to version 42) should migrate: false - up
22:13:56.224 › Migrator AutoConfirmFingerPrintsMigrator (to version 43) should migrate: false - up
22:13:56.224 › Migrator UserDecryptionOptionsMigrator (to version 44) should migrate: false - up
22:13:56.224 › Migrator MergeEnvironmentState (to version 45) should migrate: false - up
22:13:56.224 › Migrator DeleteBiometricPromptCancelledData (to version 46) should migrate: false - up
22:13:56.224 › Migrator MoveDesktopSettingsMigrator (to version 47) should migrate: false - up
22:13:56.224 › Migrator MoveDdgToStateProviderMigrator (to version 48) should migrate: false - up
22:13:56.224 › Migrator AccountServerConfigMigrator (to version 49) should migrate: false - up
22:13:56.224 › Migrator KeyConnectorMigrator (to version 50) should migrate: false - up
22:13:56.224 › Migrator RememberedEmailMigrator (to version 51) should migrate: false - up
22:13:56.224 › Migrator DeleteInstalledVersion (to version 52) should migrate: false - up
22:13:56.224 › Migrator DeviceTrustServiceStateProviderMigrator (to version 53) should migrate: false - up
22:13:56.225 › Migrator SendMigrator (to version 54) should migrate: false - up
22:13:56.225 › Migrator MoveMasterKeyStateToProviderMigrator (to version 55) should migrate: false - up
22:13:56.225 › Migrator AuthRequestMigrator (to version 56) should migrate: false - up
22:13:56.225 › Migrator CipherServiceMigrator (to version 57) should migrate: false - up
22:13:56.225 › Migrator RemoveRefreshTokenMigratedFlagMigrator (to version 58) should migrate: false - up
22:13:56.225 › Migrator KdfConfigMigrator (to version 59) should migrate: false - up
22:13:56.225 › Migrator KnownAccountsMigrator (to version 60) should migrate: false - up
22:13:56.225 › Migrator PinStateMigrator (to version 61) should migrate: false - up
22:13:56.225 › Migrator VaultTimeoutSettingsServiceStateProviderMigrator (to version 62) should migrate: false - up
22:13:56.225 › Migrator PasswordOptionsMigrator (to version 63) should migrate: false - up
22:13:56.226 › Migrator GeneratorHistoryMigrator (to version 64) should migrate: false - up
22:13:56.226 › Migrator ForwarderOptionsMigrator (to version 65) should migrate: false - up
22:13:56.226 › Migrator MoveFinalDesktopSettingsMigrator (to version 66) should migrate: false - up
22:13:56.226 › Migrator RemoveUnassignedItemsBannerDismissed (to version 67) should migrate: false - up
22:13:56.226 › Migrator MoveLastSyncDate (to version 68) should migrate: false - up
22:13:56.226 › Migrator MigrateIncorrectFolderKey (to version 69) should migrate: false - up
22:13:56.226 › Migrator RemoveAcBannersDismissed (to version 70) should migrate: false - up
22:13:56.226 › Migrator RemoveNewCustomizationOptionsCalloutDismissed (to version 71) should migrate: false - up
22:13:56.226 › Migrator RemoveAccountDeprovisioningBannerDismissed (to version 72) should migrate: false - up
22:13:56.226 › Migrator AddMasterPasswordUnlockData (to version 73) should migrate: false - up
22:13:56.226 › Migrator RemoveLegacyPin (to version 74) should migrate: false - up
22:13:56.227 › Migrator RemoveUserEncryptedPrivateKey (to version 75) should migrate: false - up
Gtk-Message: 22:13:56.267: Failed to load module "colorreload-gtk-module"
22:13:56.299 › [Process Isolation] Isolating process from debuggers and memory dumps
WARNING: radv is not a conformant Vulkan implementation, testing use only.
22:13:56.328 › [NAPI] [INFO] desktop_core::process_isolation::process_isolation: Disabling ptrace and memory access for main via PR_SET_DUMPABLE. pid=2
22:13:56.330 › Coredumps are disabled in renderer process
LaunchProcess: failed to execvp:
xdg-settings
22:13:56.814 › [Native Messaging IPC] Clearing connected apps
22:13:56.816 › State version: 75
22:13:56.817 › Unhandled error in angular Error: Cannot read properties of null (reading 'id')
22:13:56.818 › [NAPI] [INFO] desktop_core::ssh_agent::platform_ssh_agent: BITWARDEN_SSH_AUTH_SOCK not set, using default path
22:13:56.818 › [NAPI] [INFO] desktop_core::ssh_agent::platform_ssh_agent: Starting SSH Agent server socket_path="/home/henri/.var/app/com.bitwarden.desktop/data/.bitwarden-ssh-agent.sock"
22:13:56.818 › [NAPI] [INFO] desktop_core::ssh_agent::platform_ssh_agent: SSH Agent is running. socket_path="/home/henri/.var/app/com.bitwarden.desktop/data/.bitwarden-ssh-agent.sock"
22:13:56.818 › SSH agent started
22:13:56.835 › [NAPI] [INFO] desktop_core::password::password: falling back to get legacy Bitwarden_auto fe791b83-02cd-4f1a-a156-248d516e2cc4_user_auto
22:13:56.835 › [NAPI] [INFO] desktop_core::password::password: falling back to get legacy Bitwarden_auto 374bd204-dfe1-477a-8e4a-acda00e91a35_user_auto
22:13:56.838 › [Credential Storage Listener] getPassword failed Error: service error org.freedesktop.zbus.Error: The name is not activatable
22:13:56.839 › [Credential Storage Listener] getPassword failed Error: service error org.freedesktop.zbus.Error: The name is not activatable
22:13:56.865 › Retrieving application id
[2:0503/221356.885104:ERROR:crypto/nss_util.cc:225] Error initializing NSS with a persistent database (sql:/home/henri/.pki/nssdb): NSS error code: -8126
22:13:57.201 › Unable to fetch ServerConfig from https://bitwarden.mydomain.com/api Error: Failed to fetch
22:13:57.294 › Retrieving application id
22:13:57.295 › Retrieving application id
22:13:57.665 › Environment did not respond in time, emitting previous config.
^C
[2 preload-host-spawn-strategy] Dropping 0x13c8000402c0 (3) because of connection closed
[2:0503/221529.383926:FATAL:dbus/bus.cc:1248] D-Bus connection was disconnected. Aborting.

Expected Result

Being able to login with mtls to be able to authenticate myself with my login credentials.

Actual Result

Due to the error in the nssdb i can not connect to the bitwarden selfhosted server, because the desktop flatpak does not sent the certificate to authenticate.

Screenshots or Videos

Additional Context

It worked a week ago and the only update i did, was bazzite from version 43 to 44. But i can´t connect the errors i am getting to the update

Operating System

Linux

Operating System Version

Bazzite 44

Installation method

Flatpak

Build Version

2026.3.1

Issue Tracking Info

• I understand that work is tracked outside of GitHub. A PR will be linked to this issue should one be opened to address it, but Bitwarden doesn't use fields like "assigned", "milestone", or "project" to track progress.

[bitwarden-bot]

Thank you for reporting this issue! We've added this to our internal tracking system.
ID: PM-36445
Link (for internal use): https://bitwarden.atlassian.net/browse/PM-36445

[pamperer562580892423]

Actual Result

Due to the error in the nssdb i can not connect to the bitwarden selfhosted server, because the desktop flatpak does not sent the certificate to authenticate.

What is your exact self-hosted server version?

[Henri2777]

It is vault warden:1.35.8
Bit Traefik is in front of it as a reverse proxy to manage certificates for server and client side.
And it is running in a docker swarm environment.

[rmcdowell-bitwarden]

Hi there,

It is important to note that Vaultwarden is not associated with Bitwarden. Vaultwarden is a re-writing of the Bitwarden server code in Rust, that is not contributed to nor supported by the Bitwarden team or organization. The security audits granted to Bitwarden do not apply to Vaultwarden, and the Bitwarden support team is not able to respond to questions regarding Vaultwarden. Support options for Vaultwarden are found here:

https://github.com/dani-garcia/vaultwarden?tab=readme-ov-file#get-in-touch

Please only report issues on Bitwarden's repositories when you are able to reproduce the behavior with an official Bitwarden server (cloud or self-hosted).

You can find information about using Bitwarden's self-hosted servers here: https://bitwarden.com/help/self-host-bitwarden/

This issue will now be closed.

Thanks!

[Henri2777]

Hi,
But this has nothing to do with vaultwarden.
In my issue the client never even gets to talk with the vaultwarden server and because of that it doesn't matter if it is a vaultwarden or bitwarden server. Please reopen the issue and help me fix my bitwarden desktop app.
Kind regards
Henri

[SergeantConfused]

Hello @Henri2777,

Thank you for following up on this. I understand that this is reproducible with Bitwarden Lite as well, and thus I will now re-open this GitHub report and flag it internally for review. Please feel free to post additional information, such as screenshots or a screen video recordings, if you wish.

All the best,