5

Today I've create new certificates for my server (since the old ones were about to expire) using openssl with my own CA. I also used that as an oportunity to change the server's name because it was called "server" which I heard can cause problems (didn't have any though for about 6 years).

So in my openssl cnf file I've set following alt names:

[ alt_names ]
DNS.1 = server.nordprim.local
DNS.2 = *.server.nordprim.local
DNS.3 = server
DNS.4 = *.server
DNS.5 = nrv01.nordprim.local
DNS.6 = *.nrv01.nordprim.local
DNS.7 = nrv01
DNS.8 = *.nrv01
IP.1 = 192.168.10.254

I kept the old name for now so I can update hosts first to use the new name.

And here's my problem. Whenever I try to access nrv01 or nrv01.nordprim.local with Firefox it would throw SSL_ERROR_BAD_CERT_DOMAIN error but "server", "server.nordprim.local" and the ip address works just fine. Chromium doesn't have that problem.

Here's error description (in polish but it confirms that the new certificate is loaded):

Witryny potwierdzają swoją tożsamość poprzez certyfikaty. Firefox nie ufa certyfikatowi witryny „nrv01”, ponieważ nie jest on dla niej prawidłowy. Certyfikat został wystawiony tylko dla następujących domen: server.nordprim.local, *.server.nordprim.local, server, *.server, nrv01.nordprim.local, *.nrv01.nordprim.local, nrv01, *.nrv01, 192.168.10.254

Clearing cookies, cache and offline data did not help. Even creating new profile did not help.

Any idea what may cause the problem? Perhaps Firefox can't handle that many DNS alt names?

Also, I have set CN to nrv01.nordprim.local

EDIT: Here's the certificate that I have been asked for:

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 4105 (0x1009)
    Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = PL, ST = pomorskie, O = Nordprim Sp. z o.o., OU = Nordprim Sp. z o.o., CN = Nordprim Sp. z o.o., emailAddress = [email protected]
        Validity
            Not Before: Feb  3 07:21:33 2020 GMT
            Not After : Feb 12 07:21:33 2021 GMT
        Subject: C = PL, ST = pomorskie, L = Przyjazn, O = Nordprim Sp. z o.o., CN = nrv01.nordprim.local, emailAddress = [email protected]
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Modulus:
                    00:ce:d6:c4:f6:b6:ae:22:23:33:8f:7b:b4:58:4f:
                    0d:09:b8:8d:67:06:5d:13:b2:e4:c4:b2:30:6e:35:
                    98:f7:45:aa:c4:47:dd:5b:75:08:7c:e0:44:68:4e:
                    33:08:c9:46:35:92:40:20:ac:b6:b5:f2:f1:1f:f0:
                    ce:b0:d2:b5:2b:b3:dc:20:86:cb:57:25:1e:7e:76:
                    ba:cc:aa:d0:20:39:2e:bc:1c:c1:72:24:6b:75:2b:
                    e3:29:24:7d:9c:37:3a:2d:89:d2:56:62:c4:0a:7a:
                    b6:82:07:d4:5c:7d:62:57:9f:d4:ce:03:40:35:49:
                    4b:03:fa:1c:da:59:9c:de:7a:ab:c9:4b:d7:09:c6:
                    2c:88:5d:c1:91:a6:df:b3:66:c6:7d:1c:50:7d:59:
                    93:91:a9:47:08:8c:89:5c:13:54:1c:8c:25:1a:99:
                    d1:26:51:cf:0f:13:18:26:a8:b4:3f:f6:9d:d6:41:
                    d4:28:49:15:36:2c:06:7c:84:1e:97:98:46:d8:bc:
                    0b:eb:7c:73:6c:e7:72:f5:59:5a:a0:0d:c8:cc:47:
                    0d:74:e4:64:6f:15:96:fb:54:ae:6e:e8:9a:06:74:
                    5a:63:28:3a:d3:35:4f:8d:e7:bb:5e:bf:d5:5d:0b:
                    8e:88:16:98:ea:c7:ab:73:8c:d0:bd:ec:65:77:47:
                    95:3b
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: 
                CA:FALSE
            X509v3 Key Usage: 
                Digital Signature, Non Repudiation, Key Encipherment
            X509v3 Subject Alternative Name: 
                DNS:server.nordprim.local, DNS:*.server.nordprim.local, DNS:server, DNS:*.server, DNS:nrv01.nordprim.local, DNS:*.nrv01.nordprim.local, DNS:nrv01, DNS:*.nrv01, IP Address:192.168.10.254
    Signature Algorithm: sha256WithRSAEncryption
         55:61:19:72:8e:1b:d3:f7:aa:e5:42:cf:32:dd:e5:a6:7a:91:
         22:7c:bd:d4:b1:f4:52:64:ea:29:56:e7:48:6e:cc:f8:4d:bf:
         42:46:41:6a:9c:cc:bf:5e:ef:66:c3:bd:dd:50:13:c8:2c:5a:
         bc:a5:cd:95:57:22:c2:e1:e4:e1:35:14:9a:a6:11:b6:ea:77:
         c0:92:30:e0:d3:18:c7:14:b7:9b:ae:8f:a5:ab:f5:92:ae:82:
         4d:62:0e:7d:7d:3f:c2:3b:e1:6f:c7:27:19:43:df:eb:f1:24:
         cc:db:fe:00:72:cd:81:0e:8c:6a:db:42:29:9c:8d:c9:95:39:
         5b:52:44:41:e6:19:78:f2:b6:9d:5b:0f:7c:50:23:f9:f7:be:
         77:93:30:91:7a:e2:3f:9d:71:a1:47:58:5d:49:21:9a:4f:5a:
         96:0b:c6:14:0f:52:fb:eb:ab:bc:74:a9:d0:be:c7:fc:7f:eb:
         39:83:2c:b8:b7:ec:77:52:de:18:64:39:75:7b:71:26:d6:ec:
         3e:08:7f:fb:3e:39:f0:7a:4c:cf:de:25:ad:19:0d:fe:bb:8d:
         a5:7e:6a:e0:65:ee:e1:f9:c2:90:b3:df:43:15:58:80:6c:61:
         20:3d:56:fd:7d:aa:b6:8c:e9:29:80:61:fe:61:ab:f4:8c:d5:
         8f:b6:1f:11:db:03:24:17:6c:31:19:21:31:60:ce:82:ca:44:
         c2:61:ce:11:0d:5d:8e:7c:2d:1f:a8:51:0e:39:19:1e:09:48:
         45:03:fe:f0:38:84:dd:d7:4a:c6:71:4f:c4:99:eb:29:bb:e9:
         e9:f2:4f:17:4c:ea:6f:e6:64:04:f9:e7:7c:24:ff:cc:2b:bb:
         81:18:10:4e:eb:46:e7:7d:52:0e:64:05:74:75:3a:1b:20:7e:
         92:11:71:d0:be:45:ac:0f:e3:2a:27:e1:48:42:10:41:16:db:
         b5:a9:34:c7:c4:44:bc:0f:66:9f:ae:d2:d6:2b:e8:d1:b0:78:
         39:e9:b2:e4:2f:91:0b:2e:e9:36:bb:9a:89:a2:5f:9a:9a:8d:
         54:1f:24:b9:e6:4b:2e:8e:13:cb:ac:d3:d1:26:df:3b:95:49:
         11:fe:25:4e:17:65:dc:ff:83:38:aa:60:0f:b2:b7:67:68:c9:
         e6:89:b1:62:17:09:2b:80:81:d6:da:18:d8:d6:e0:32:cc:ab:
         47:91:97:11:2b:e2:f8:45:e2:82:03:1d:26:29:74:e2:77:d5:
         a0:94:6a:10:35:70:79:cb:a0:6c:78:02:83:5c:8f:c4:bb:5f:
         60:b3:39:35:bf:fa:58:28:95:51:21:f4:a7:47:87:ea:20:57:
         94:8e:71:4b:76:96:84:99
5
  • Chrome uses the OS trusted root CA store but Firefox has its own trusted root CA store, so you need to add a corporate CA or self signed CA to the OS for Chrome but to Firefox directly for Firefox. If that is not the problem, can you post the cert without its key here?
    – Z.T.
    Feb 3, 2020 at 9:56
  • I have added that CA to firefox already. As I mention in my post, "server" name works correctly (it's not added as exception) so I don't think there's any problem with CA. I also updated my post just now to include my certificate
    – FilipK
    Feb 3, 2020 at 10:03
  • Sorry, don't know. I'm sure it's not a problem with amount of SubjAltNames in cert, because this should work fine: 1000-sans.badssl.com
    – Z.T.
    Feb 3, 2020 at 13:24
  • 1
    I have changed the order of altNames in openssl.cnf so that nrv01 is before server and nrv01 is now a valid domain but server is not
    – FilipK
    Feb 7, 2020 at 7:25
  • 1
    That is super cool and I suspect finding out what it does will require reading the code.
    – Z.T.
    Feb 7, 2020 at 14:11

3 Answers 3

2

I think this is https://bugzilla.mozilla.org/show_bug.cgi?id=1196364 or something related to it. If Firefox considers any SAN to be too broad, e.g., *.server, it will consider the certificate to be a domain mismatch, even if the SAN it has a problem with isn't the one corresponding to how you reached the site. Making a new certificate without DNS entries 3, 4, 7, and 8 should solve the problem.

1

I can confirm this weird behavior when using SAN-Names of type DNS and IP in one TLS-Server-Certificate. Using OpenSSL to create those Certificates, alt_names pretty same as you described in your initial post. There is nothing wrong with the SAN-Names, so not one of those issues where an IP-Address is filled in as SAN of type DNS - double checked, the Certificate has no RFC-inconformity, it is pretty fine.

Some of the DNS SAN work, the IP SAN work too, but some other DNS SAN don't work - Firefox show an SSL_ERROR_BAD_CERT_DOMAIN.

Tested with Firefox 97.0.1, 91.0, 73, 68.5esr, ... behave like described, show up SSL_ERROR_BAD_CERT_DOMAIN.

Works fine without Error using all Versions of Chrome and EdgeChromium of the last two years (tested with all Versions between v78 to v98).

It still works fine without error with Firefox 52.9esr ... so the change seems to be in between Firefox v52 to v68.

1

You are right!

I did some trial and error and found out what the Problem is:

  1. This list of Subject Alternative Names leads to the problem in Firefox:
[ SAN_firefox-certproblem-server1.local ]
DNS.1 = firefox-certproblem-server1
DNS.2 = *.firefox-certproblem-server1
DNS.3 = firefox-certproblem-server1.local
DNS.4 = *.firefox-certproblem-server1.local
DNS.5 = firefox-certproblem-server1.hitco.at
DNS.6 = *.firefox-certproblem-server1.hitco.at
DNS.7 = localhost
IP.1  = 127.0.0.1
IP.2  = 5.45.107.134
IP.3  = 192.168.200.200
IP.4  = 0000:0000:0000:0000:0000:0000:0000:0001
IP.5  = 2a03:4000:0006:126c:0000:0000:0000:affe
  1. This list of Subject Alternative Names works in Firefox:
[ SAN_firefox-certproblem-server2.local ]
DNS.1 = firefox-certproblem-server2
DNS.2 = firefox-certproblem-server2.local
DNS.3 = *.firefox-certproblem-server2.local
DNS.4 = firefox-certproblem-server2.hitco.at
DNS.5 = *.firefox-certproblem-server2.hitco.at
DNS.6 = localhost
DNS.7 = *.firefox-certproblem-server2
IP.1  = 127.0.0.1
IP.2  = 5.45.107.134
IP.3  = 192.168.200.200
IP.4  = 0000:0000:0000:0000:0000:0000:0000:0001
IP.5  = 2a03:4000:0006:126c:0000:0000:0000:affe

The problem is caused by the *.firefox-certproblem-server1 entry in the first certificate above, in line DNS.2

If you move line DNS.2 to line DNS.7 as I did in the second certificate it works.

Firefox checks if the SAN matches and does it line by line. And it STOPS and doesn't check the following SAN entries if there is a to global *.tld entry for example in DNS.2 ... then DNS.3 to DNS.7 are not checked any more. Only DNS.1 entry still works. Changing the order resolves the issue.

Other Browsers like Chrome or Edge check all SAN-Entries and grant those valid which are valid. If you try to access DNS.2 in Chrome or Edge you get Error NET::ERR_CERT_COMMON_NAME_INVALID but DNS.1 and DNS.3 to DNS.7 still work. Thats the difference to Firefox, Firefox stops checking DNS.3 to DNS.7 if DNS.2 is to global and therefore not a valid SAN.

I created a Mozilla Change-Request at: https://bugzilla.mozilla.org/show_bug.cgi?id=1757758

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .