1028647 - nss 3.16.1 breaks accessing https://sacoche.ac-caen.fr/

Status: RESOLVED FIXED

(NSS :: Libraries, defect, P1)

Description

[Thomas Backlund]

User Agent: Mozilla/5.0 (X11; Linux x86_64; rv:24.0) Gecko/20100101 Firefox/24.0 (Beta/Release)
Build ID: 20140622015533

Steps to reproduce:

Build firefox 24.6 esr or firefox 30 against nss-3.16.1 and try to access https://sacoche.ac-caen.fr/



Actual results:

We get the error in browser: sec_error_cert_not_in_name_space, and no way to get past that...


Expected results:

Building the same firefox aganst nss.3.16.0 shows https://sacoche.ac-caen.fr/ properly with valid ssl certificate

Comment 1

[Thomas Backlund]

and it seems to be a fallout of:
* Imposed name constraints on the French government root CA ANSSI (DCISS)
  https://bugzilla.mozilla.org/show_bug.cgi?id=952572
  https://hg.mozilla.org/projects/nss/rev/742307da0792

Comment 2

[Thomas Backlund]

And I've now confirmed that reverting:
https://hg.mozilla.org/projects/nss/rev/742307da0792

makes https://sacoche.ac-caen.fr/ accessible again

Comment 3

[Wan-Teh Chang]

Camilo: please take a look at this bug. Thanks.

Comment 4

[Kai Engert (:KaiE:)]

Bug 952572 constrained the root certificate to issueing certificates for domain names to a set of top level domains (TLDs).

The server at sacoche.ac-caen.fr returns a certificate chain, where the topmost certificate has the following properties:

  Issuer: "E=[e-mail],CN=IGC/A,OU=DCSSI,O=PM/SGDN,L=Paris,ST=France,C=FR"
  Subject: "CN=AC Education Nationale,OU=110 043 015,
            O=Ministere Education Nationale (MENESR),C=FR,E=[e-mail]"
  (no subject alt name extension)

The cert has been issued by the restricted issuer.

The subject name (CN) isn't a domain name, and therefore doesn't match the restriction.

Comment 5

[Kai Engert (:KaiE:)]

The code added in bug 952572 doesn't support the scenario where intermediate CA certificates are used, which don't use a hostname.

(If a constrained intermediate CA cert contained an allowed hostname, would the constraint be enforced to all subordinate certificates, too?)

Comment 6

[Camilo Viecco (:cviecco)]

Actually there is at least one problem comes that from the leaf cert: 
I has two dns entries:
DNS:sacoche.ac-caen.fr, DNS:sacoche
Per name constraints the second entry is not covered, the cert is invalid.

Comment 7

[Camilo Viecco (:cviecco)]

Kaie, I think your analysis is incorrect. Yes the code added in bug 952572 does not add anything about intermediates as that is covered by CERT_CompareNAmeSpace. There this revealed a bug in mozilla::pkix regarding ANSSI roots (Bug 1030204).

We do cover the case of intermediate certiticates without names.


>If a constrained intermediate CA cert contained an allowed hostname, would the constraint be enforced >to all subordinate certificates, too?)
yes. (this was being tested on psm testing code for nss until this week).


$PATH/bin/vfychain -u 1  -a /tmp/sacoche.ac-caen.fr.pem -a /tmp/AC-Infrastructures.pem -a /tmp/AC-Enseignement-Scolaire.pem  -a /tmp/AC-Education-Nationale.pem
Chain is bad!
PROBLEM WITH THE CERT CHAIN:
CERT 4. CN=sacoche.ac-caen.fr,OU=ac-caen,OU=110 043 015,O=Ministere Education Nationale (MENESR),C=FR [Certificate Authority]:
  ERROR -8080: The Certifying Authority for this certificate is not permitted to issue a certificate with this name.
$PATH/bin/vfychain -u 3  -a /tmp/AC-Infrastructures.pem -a /tmp/AC-Enseignement-Scolaire.pem  -a /tmp/AC-Education-Nationale.pem
Chain is good!

Comment 8

[Wan-Teh Chang]

Attachment: Fix comments in test scripts

Camilo:

1. I have a question about a comment in tests/chains/scenarios/nameconstraints.cfg.

I also fixed what seems like a typo in tests/libpkix/certs/make-nc.

2. The dcissblocked and dcissallowed test certs are issued directly
by the root CA. Please add test cases that have an intermediate CA.

Comment 9

[Camilo Viecco (:cviecco)]

Comment on attachment 8445985 [details] [diff] [review]
Fix comments in test scripts

Review of attachment 8445985 [details] [diff] [review]:
-----------------------------------------------------------------

::: tests/chains/scenarios/nameconstraints.cfg
@@ +7,5 @@
>  db trustanchors
>  
>  import NameConstraints.ca:x:CT,C,C
>  import NameConstraints.ncca:x:CT,C,C
> +# XXX Is this comment referring to NameConstraints.dcisscopy?

No this is to ncca.

Comment 10

[Camilo Viecco (:cviecco)]

Sure I will write the intermediate tests.

Comment 11

[Wan-Teh Chang]

Attachment: Fix comments in test scripts, v2

I moved the comment before the ncca line.

Comment 12

[Wan-Teh Chang]

Comment on attachment 8446283 [details] [diff] [review]
Fix comments in test scripts, v2

Patch checked in: https://hg.mozilla.org/projects/nss/rev/b47135fe72d4

Comment 13

[Mathew Hodson]

This looks like the same issue as bug 1048267. There was an issue with the website's certificate, and after it was updated, the site could load. So this should be resolved.

The other bug was marked INVALID, but this one did have a patch committed (comments only). I guess FIXED would work for this bug.

Comment 14

[J.C. Jones [:jcj] (he/him)]

Agreed, thanks.