1256961 - Firefox doesn't think a cert for *.boston.com is valid for boston.com

Status: RESOLVED WONTFIX

(Core :: Security, defect)

Description

[scratch65535]

Attachment: Boston.comCert.jpg

User Agent: Mozilla/5.0 (Windows NT 5.1; rv:44.0) Gecko/20100101 Firefox/44.0
Build ID: 20160205155049

Steps to reproduce:

I was reading comments at boston.com (not www.boston.com)


Actual results:

I got an "insecure connection!"




Expected results:

It should have recognised that boston.com is the parent of *.boston.com and thus a cert valid for *.boston.com is ipso facto valid for boston.com.

Comment 1

[Dana Keeler (she/her) [:keeler]]

From my reading of RFC 6125, *.boston.com isn't valid for boston.com (see https://tools.ietf.org/html/rfc6125#section-6.4.3 ). We can definitely improve the user-experience here, though (for example, I believe Chrome would offer to redirect to www.boston.com in this case - it might even do it automatically).

Comment 2

[scratch65535]

Wow!  I think the authors of 6125 made a mistake in 6.4.2, since the idea that example.org isn't the degenerate case of *.example.org flies in the face of how we treat hierarchical scopes generally.  I can't begin to imagine how they could justify that reasoning.

Comment 3

[Sylvestre Ledru [:Sylvestre]]

Not happening anymore.