1575244 - Hyphen at the beginning/end of subdomain causes SSL_ERROR_BAD_CERT_DOMAIN Warning

Status: RESOLVED DUPLICATE of bug 1184059

(NSS :: Libraries, enhancement, P3)

Description

[David Schütz]

User Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.12; rv:68.0) Gecko/20100101 Firefox/68.0

Steps to reproduce:

Open the URL: https://test-.github.io/ or the URL https://-test.github.io/

OS/Versions: MacOS Sierra 10.12.6, Firefox 68.0.2

Actual results:

SSL_ERROR_BAD_CERT_DOMAIN Warning displayed, saying "[...] certificate that is not valid for test-.github.io. The certificate is only valid for the following names: www.github.com, *.github.io, [...]"

Expected results:

The domains beginning or ending in a hyphen should be valid for the wildcard certificate.

Google Chrome loads the site (https://test-.github.io/) and says that the certificate is valid.

When the hyphen is at the beginning (https://-test.github.io/), Google Chrome says "-test.github.io’s server IP address could not be found.", but Firefox still loads the site with the SSL_ERROR_BAD_CERT_DOMAIN Warning.

Comment 1

[Gyula Palko[:gpalko]]

Hi,
I can reproduce this and I'm setting the component, in order to involve the development team.
Thanks for reporting!

Comment 2

[J.C. Jones [:jcj] (he/they)]

Per RFC 3696, any characters, or combination of bits (as octets), are permitted in DNS names. This supercedes RFC 1035's more restrictive LDH-in-middle-only approach.

IMO we shouldn't put more restrictions on DNS labels than the resolver does.

Comment 3

[J.C. Jones [:jcj] (he/they)]

This would need to be changed in Mozilla::PKIX, part of NSS.

Marking as an enhancement, as general adherence to RFC 1035 is not a defect, but it'd be nice to be lenient here a-la RFC 3696.