1113506 - Cannot accept connection with "sec_err_inadequate_key_usage"

Status: RESOLVED DUPLICATE of bug 1057123

(Core :: Security: PSM, defect)

Description

[Ulrich Windl]

User Agent: Mozilla/5.0 (X11; Linux i686; rv:34.0) Gecko/20100101 Firefox/34.0
Build ID: 2014112600

Steps to reproduce:

As requested in bug 982754 comment 25, I'm reporting that the sec_err_inadequate_key_usage in Firefox ESR 31.3.0 does not provide any details (e.g. view certificate) of the problem, and you cannot choose to accept the certificate.
Effectively you cannot use some web sites (that you could use with the previous major release of Firefox ESR).
Maybe the whole process of introducing "new features" that may disallow what previously was allowed should be thought about for the ESR releases at least.
Note: I couldn't find out how to present the certificate in question as requested in https://bugzilla.mozilla.org/show_bug.cgi?id=982754#c25


Actual results:

Connection not established; site cannot be used


Expected results:

A warning should have popped up, the certificate in question should have been presented to the user, and the user should have been asked whether he want's to accept a potential risk, or whether he wants to be absolutely safe and abort the connection attempt.

Comment 1

[Dana Keeler (she/her) [:keeler]]

Thanks for filing this. Do you have an example of a publicly-accessible site we can reproduce the problem on?
Also, you can use wireshark to capture the packets from a TLS handshake to see what certificates a server is sending.

Comment 2

[Ulrich Windl]

Using "openssl s_client -connect ..." I found out that the self-signed certificate presented has critical "CA:false" and critical key usage certificate sign...
Such a certificate can be found in HP's Management Information Framework (as used by HP Command View EVA, for example). What makes things complicated is that you cannot (there are no instructions, and it's not obvious how) replace the root certificate. From what I understand is that some SOAP-like web server is acting as a CA to create certificates on the fly, but that SOAP server's certificate already has issues...)
As I'm not so good in extracting certificates from wireshark, I'll attach a short tcpdump that wireshark can decode once you tell it that the transport protocol is "SSL".

Comment 3

[Ulrich Windl]

Attachment: ssl.dump.gz: gzip-compressed packet dump from tcpdump

The dump should contain the connenction SSL opening exchange (and thus the certificates) from some Linux host to the HP Command View EVA server.

Comment 4

[Dana Keeler (she/her) [:keeler]]

Thanks, Ulrich. The end-entity certificate is asserting the keyCertSign key usage, which it shouldn't, according to rfc 5280. We made some compatibility changes that should handle this case in Firefox 33 (see bug 1057123), but we haven't uplifted those changes to ESR 31.