1524903 - Firefox ESR 60.5.0 not following certificates chain presented by server

Status: RESOLVED INVALID

(Core :: Security: PSM, defect)

Description

[ghost.orchid2001]

Attachment: cert-chain.png

User Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.81 Safari/537.36

Steps to reproduce:

Referencing https://bugzilla.mozilla.org/show_bug.cgi?id=1473573

With Firefox ESR 60.5.0 (32 bit), we are trying to implement Import Enterprise Roots for internal CA.
We have internal RootCA, which chain to Intermediate CA1, which will issue server certificates
rootca -> ca1 -> server cert

I have attached the hierarchy as picture

From the server side, we have configured an Apache server to serve server certificate and also the intermediate certificate.
We can verify that the server certificate and intermediate certificate are served correctly from the Firefox Insecure Connection Warning

From MOZ_LOG file, we can see that the Root CA certificate is imported successfully. But Firefox failed to follow the certificate chain, so the Insecure Connection Warning is displayed.
This is my debug log step
C:\Users\Hendry.Leo>set MOZ_LOG=pipnss:4,certverifier:4
C:\Users\Hendry.Leo>set MOZ_LOG_FILE=Desktop\moz.log
C:\Users\Hendry.Leo>"c:\Program Files (x86)\Mozilla Firefox\firefox.exe"

I will attach the moz.log file

Actual results:

Firefox display Insecure Connection Warning

Expected results:

Firefox allow the connection as secure without any warning

Comment 1

[ghost.orchid2001]

Attachment: cert-server.crt

the server https certificate

Comment 2

[ghost.orchid2001]

Attachment: cert-intermediate.crt

the intermediate CA certificate

Comment 3

[ghost.orchid2001]

Attachment: cert-rootca.crt

The Root CA certificate, self signed, installed to Trusted Root Certificate Store

Comment 4

[ghost.orchid2001]

Comment on attachment 9041081 [details]
cert-intermediate.crt

The Intermediate CA certificate, installed to Intermediate Certificate Authority Store

Comment 5

[ghost.orchid2001]

Attachment: cert-TrustedRootStore.png

Comment 6

[ghost.orchid2001]

Attachment: cert-IntermediateCertificateAuthorityStore.png

Comment 7

[ghost.orchid2001]

Attachment: cert-server-with-intermediate.txt

The Error Detail

Comment 8

[ghost.orchid2001]

Attachment: cert-chrome.png

The same server with Chrome works

Comment 9

[ghost.orchid2001]

Attachment: cert-ff-esr-60.5.png

The error screenshot

Comment 10

[ghost.orchid2001]

Attachment: moz.log

Comment 11

[Dana Keeler (she/her) (use needinfo) [:keeler] (on leave)]

The issuer field of your server certificate is

C = ID, ST = Sumatera Utara, O = PT. VVF INDONESIA, OU = IT Operation, CN = ca1.vvfindonesia.local, emailAddress = [e-mail]

but the subject field of your intermediate certificate is

C = ID, ST = Sumatera Utara, O = PT. VVF INDONESIA, OU = IT Operation, CN = ca1.vvfindonesia.local

which means that the intermediate is not a valid issuer for the server certificate.

Comment 12

[ghost.orchid2001]

Why would Chrome/IE/Windows allow this?
Any reference?

Comment 13

[ghost.orchid2001]

Attachment: It works after fixing the issuer