1110648 - improperly formatted DER-encoded message

Status: RESOLVED DUPLICATE of bug 1108408

(Core :: Security: PSM, defect)

Description

[Elmar]

User Agent: Mozilla/5.0 (X11; Linux x86_64; rv:37.0) Gecko/20100101 Firefox/37.0
Build ID: 20141211030206

Steps to reproduce:

I run the Nightly build. Earlier this week I could access all intranet sites, but after updating this morning accessing some of the HTTPS sites I get this error.

I have seen this problem before (it is reported in the 31 to 33 versions).



Actual results:

Secure Connection Failed

An error occurred during a connection to service.intranet.rijkswaterstaat.nl. security library: improperly formatted DER-encoded message. (Error code: sec_error_bad_der)
The page you are trying to view cannot be shown because the authenticity of the received data could not be verified.
Please contact the website owners to inform them of this problem.


Expected results:

Normal website, perhaps warning that the certificate is not entirely correct.

It's no use sending you the URL, as it is not accessible from the internet. And I need to use it, so for now I have to stop using firefox.

Comment 1

[Dana Keeler (she/her) (use needinfo) [:keeler] (on leave)]

Elmar, the quickest way we'll be able to help you is if you paste the output from running the command `openssl s_client -connect service.intranet.rijkswaterstaat.nl:443 -showcerts < /dev/null`. Thanks!

Comment 2

[Elmar]

The output of the openssl s_client is a bit long. I'll do it by adding an attachment.

Comment 3

[Elmar]

Attachment: s_client_output.txt

Output of openssl s_client ... command, proposed by :Keeler

Comment 4

[Kaspar]

Most likely a duplicate of bug 1108408 - the certificate for intranet.rijkswaterstaat.nl includes a subjectAltName entry of type otherName (with the Microsoft UPN value '2.16.528.1.1003.1.3.5.9.1.031ffc388bf381fc041cb2991560b413').

Can you try if a Nightly (after 2014-12-15) fixes your problem?

Comment 5

[Elmar]

I didn't have a chance to try some of the versions earlier this week, but with the current version (build date 2014-12-18) it works correctly again. Thanks.