Closed Bug 1579060 Opened 1 year ago Closed 11 months ago

mozilla::pkix tag definitions for issuerUniqueID and subjectUniqueID shouldn't have the CONSTRUCTED bit set

Categories

(NSS :: Libraries, defect, P1)

defect

Tracking

(firefox-esr60 wontfix, firefox-esr68 fixed, firefox69 wontfix, firefox70 fixed)

RESOLVED FIXED
Tracking Status
firefox-esr60 --- wontfix
firefox-esr68 --- fixed
firefox69 --- wontfix
firefox70 --- fixed

People

(Reporter: stefan_matthaeus, Assigned: keeler)

References

Details

Attachments

(3 files)

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:69.0) Gecko/20100101 Firefox/69.0

Steps to reproduce:

I open management https websites from server hardware like DELL iDRAC, VMWare ESXi, Webmin, etc. which only have self signed certificate with Firefox 69. (OS = Windows 10 1903)

Actual results:

Firefox displays:

Fehler: Gesicherte Verbindung fehlgeschlagen

Beim Verbinden mit idrac.server.fqdn trat ein Fehler auf. Sicherheitsbibliothek: Fehlerhaft formatierte DER-verschlüsselte Nachricht. Fehlercode: SEC_ERROR_BAD_DER

(...bla...)
/quote

When clicking on (i) in front of the URL, it says connection is not safe (what is true due to self signed certificate on that device) , then click on ">" & more information, going to the security tab, it tells that the website has no owner and the website is not encrypted.

Expected results:

Open the website, like it still happened with Firefox 68.0.2 before.

Comment:

I can understand, that self signed websites are not the acme of security. But does it really make sense to block them totally? Then it even it is no more possible to secure them on device installation/maintenance, as you can't get into the device's management interface to assign a secure certificate. This is an egg-chicken-problem and it would be required that the user can override such blocking like it has been before. Otherwise user can not secure the device through it's web based management interface.

Or, isn't it a feature, but it is a bug?

Bugbug thinks this bug should belong to this component, but please revert this change in case of error.

Component: Untriaged → Security: PSM
Product: Firefox → Core

This wouldn't be a self-signed issue, it sounds like the cert itself has an encoding problem.

Any chance you can attach the certificate to the bug? I am not sure what ASN.1 decoding changes we may have made that might have caused this, but that's how we're going to nail it down.

Thanks!

Flags: needinfo?(stefan_matthaeus)

Hello, how to attach screenshots from firefox, chrome and edge? Chrome&Edge warns because of self signed cert but I can overide and access. The website example is a Dell iDRAC server management website.

Base 64 encoded self signed certificate of the Dell iDRAC (saved using Chrome browser, Firefox does not offer as it does not detect the cerificate at all)

-----BEGIN CERTIFICATE-----
MIIEETCCAvmgAwIBAgIJAK/M8I2XrH5vMA0GCSqGSIb3DQEBCwUAMIGdMQswCQYD
VQQGEwJVUzEOMAwGA1UECAwFVGV4YXMxEzARBgNVBAcMClJvdW5kIFJvY2sxEjAQ
BgNVBAoMCURlbGwgSW5jLjEcMBoGA1UECwwTUmVtb3RlIEFjY2VzcyBHcm91cDEW
MBQGA1UEAwwNaWRyYWMtSjM4UTNLMjEfMB0GCSqGSIb3DQEJARYQc3VwcG9ydEBk
ZWxsLmNvbTAgGA8yMDE3MDUxMDIyNTQwMFoXDTI3MDUxMTIyNTQ1MlowgZ0xCzAJ
BgNVBAYTAlVTMQ4wDAYDVQQIDAVUZXhhczETMBEGA1UEBwwKUm91bmQgUm9jazES
MBAGA1UECgwJRGVsbCBJbmMuMRwwGgYDVQQLDBNSZW1vdGUgQWNjZXNzIEdyb3Vw
MRYwFAYDVQQDDA1pZHJhYy1KMzhRM0syMR8wHQYJKoZIhvcNAQkBFhBzdXBwb3J0
QGRlbGwuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAp08QAk1T
SnHLECO0n8AxPA98OjqPZDF9Xu7qKE5ewbGLG7n1vbU/nT0qQyOmXxopj4SGfpQh
llJwGRPqlcTNHPVBwWnPWwOU5LC1up4KLF7qt6y5wnd8uJ/v/3+GkjIEz6SvbP9m
P62SpT3lmgB+yaCeWGoXrYFkqzfi+WPv6Y/DEA3sThEJokfUSgRApwMZW41autY0
fw1ZpY6XhSRd8AdpZ6eJ8BtTZpgafxEtgcvJb+Iv2XU2+55S4LHlzR7YtHl8KZoa
v3q6gelglg6JL+rKAZvboGMzqlQRgsy0mbLyaBUhbkjN9+Rpeuxg+tsSQ5RznhzN
POVvsP4qD+9t7QIDAQABo1AwTjAdBgNVHQ4EFgQUhJvVFuSlkBHQZ3FZN3txo4C6
AY0wHwYDVR0jBBgwFoAUhJvVFuSlkBHQZ3FZN3txo4C6AY0wDAYDVR0TBAUwAwEB
/zANBgkqhkiG9w0BAQsFAAOCAQEAlr929L+EHeqdZdWinjdkw3HYVso9J+D9ArNq
9RZk1+t+NVCa77RFvXPk+h1mB/sKs4REYFeNw7Udo9VIHKUz5Xt+ALI+q9r+qkeF
SR2o0168zoZHvE66XATZTUmlVL84sZ+QsUapG/PRneeGSy1XH3GB1QheimtkQdBN
sNWrxDAhSuukEuBGPNoSUzgRgihDxIMS/SMK+S264hTM18EosZD/QFmnaohsv50p
CDVTrEP75U+hJTAOvP6KjFT2we0YZCP9RgGJcLstLFYiUS1WAe5JO2DEf2fcfOnl
xEswB9XYD5eBAuMPfzRuBz1FK3XBW0yhHNBMMafcy1PnKINGkQ==
-----END CERTIFICATE-----

Flags: needinfo?(stefan_matthaeus)

Can you also attach a packet trace of the TLS handshake? Thanks!

Flags: needinfo?(stefan_matthaeus)

Hi,
There are people that confirm the problem on reddit: https://www.reddit.com/r/firefox/comments/d50gv7/firefox_ver69_blocks_usage_of_self_signed/

https://self-signed.badssl.com/ site returns a SEC_ERROR_BAD_DER.
I also have all my development virtual machines that are not accessible with Firefox 69.0 x64. I need to use Chrome instead.

Seems to be limited to Win10 Pro x64.

Can you attach a packet trace of the TLS handshake? Thanks! Also maybe try disabling antivirus "connection scanning" if you have it enabled?

Flags: needinfo?(sccedric)
Attached file badssl.pcapng

Here is a trace with self-signed.badssl.com with the new update 69.0.1

Flags: needinfo?(sccedric)

Thanks! Unfortunately there's nothing that stands out in that packet trace that would result in that error. Can you use https://mozilla.github.io/mozregression/quickstart.html to find when this stopped working?

Flags: needinfo?(sccedric)
Status: UNCONFIRMED → RESOLVED
Closed: 1 year ago
Resolution: --- → INCOMPLETE

Just tested Firefox 69.0.2 - Bug is still not fixed. Dell iDRAC web interface still not working. Still SEC_ERROR_BAD_DER error.

Get an old DELL server, try yourself.

Flags: needinfo?(stefan_matthaeus)

@Dana: It's not because someone did not have time to test your request that you can just close the ticket.
With a clean profile, I got no problem with mozregression but I still have the problem on 69.0.2.
May be I don't know how to work correctly with mozregression.
I'll retry as soon as I can with my profile as source.

@Stefan: If they did not mark it as confirm, it is because they don't reproduce it. You need not to be so condescending with a "Go buy a server!".

We are seeing a similar issue with a self-signed certificate used by our internal application on Firefox 69. (Worked with prior versions.) When Firefox 69 tries to use the certificate SEC_ERROR_BAD_DER is displayed, and no option to accept the certificate.

Let me know if another data point would be useful, and I can provide specifics.

Wayne, Cédric, and Stefan, can you try with a recent nightly? (https://www.mozilla.org/en-US/firefox/channel/desktop/) This bug may have the same cause as bug 1570222, which was recently fixed.

Flags: needinfo?(wayne.holmes)

I have checked in a virtual machine the recent nightly, it's not fixed. You can check by yourself by opening https://self-signed.badssl.com or the https idrac management interface of a Dell R610 server (this is the oldest machine I could test, I can see eBay.com US offers for working machine for just 49 bucks).

Please note, like said on above reddit posting, that in about:config the setting "security.enterprise_roots.enabled" must be set to "true" to reproduce the issue. This is default here in this company (I think, done through GPO), and the setting is greyed out in about:config, so it can't be changed by user. (I don't like to use Chrome instead of FF to go arround that issue.)

So you need to reopen that issue and investigate.

Flags: needinfo?(dkeeler)

I confirm Stefan assomption about "security.enterprise_roots.enabled" preference.
I removed it in my C:\Program Files\Mozilla Firefox\mozilla.cfg and I get now the self-signed error back.

With the enterprise roots feature enabled, can you please try:

  • enabling the browser console by setting devtools.chrome.enabled to true in about:config
  • opening the browser console (ctrl + shift + j)
  • running Cc["@mozilla.org/psm;1"].getService(Ci.nsINSSComponent).getEnterpriseRoots() and Cc["@mozilla.org/psm;1"].getService(Ci.nsINSSComponent).getEnterpriseIntermediates()
  • copying the output (best with right-click and Copy object)
  • attaching the output to this bug in a text file
    Thanks!
Status: RESOLVED → UNCONFIRMED
Flags: needinfo?(dkeeler)
Resolution: INCOMPLETE → ---
Attached file enterprise.txt

Here, the requested command results.
Good luck !

Flags: needinfo?(sccedric)

Thanks! It appears the definitions mozilla::pkix is using for the tags for issuerUniqueID and subjectUniqueID (optional certificate fields that, evidently, aren't used much) have been incorrect since we shipped it 5 years ago (since the underlying type is BIT STRING, which is a "primitive" type, it shouldn't have the CONSTRUCTED bit set).

Assignee: nobody → nobody
Status: UNCONFIRMED → NEW
Component: Security: PSM → Libraries
Ever confirmed: true
Flags: needinfo?(wayne.holmes)
Product: Core → NSS
QA Contact: jjones
Summary: SEC_ERROR_BAD_DER with Firefox 60 on websites with self signed certificate → mozilla::pkix tag definitions for issuerUniqueID and subjectUniqueID shouldn't have the CONSTRUCTED bit set
Version: 69 Branch → other

I am unable to turn off "security.enterprise_roots.enabled" as it shows as "locked" when I do an about:config using the corporate customized version of Firefox. Is there another workaround until this gets fixed and released to an ESR?

According to RFC 5280, the definitions of issuerUniqueID and subjectUniqueID in
TBSCertificate are as follows:

issuerUniqueID [1] IMPLICIT UniqueIdentifier OPTIONAL,
subjectUniqueID [2] IMPLICIT UniqueIdentifier OPTIONAL,

where UniqueIdentifier is a BIT STRING.

IMPLICIT tags replace the tag of the underlying type. For these fields, there is
no specified class (just a tag number within the class), and the underlying type
of BIT STRING is "primitive" (i.e. not constructed). Thus, the tags should be of
the form CONTEXT SPECIFIC | [number in class], which comes out to 0x81 and 0x82,
respectively.

When originally implemented, mozilla::pkix incorrectly required that the
CONSTRUCTED bit also be set for these fields. Consequently, the library would
reject any certificate that actually contained these fields. Evidently such
certificates are rare.

Assignee: nobody → dkeeler
Priority: -- → P1

checkin for NSS_3_47_BETA2

Flags: needinfo?(jjones)
Keywords: checkin-needed
Status: NEW → ASSIGNED
Flags: needinfo?(jjones)

Dealing with this in bug 1588567.

Flags: needinfo?(dkeeler)
Status: ASSIGNED → RESOLVED
Closed: 1 year ago11 months ago
Keywords: checkin-needed
Resolution: --- → FIXED
Target Milestone: --- → 3.47

Hello, I like to confirm, with Firefox 70, installed today, I am again able to open Dell iDRAC and https://self-signed.badssl.com/

Thanks for fixing!

Thanks, also fixed for me.

Confirmed our app is now working with Firefox 70.

Thanks!

Is this something likely to bite in an enterprise environment such that we should consider backporting to NSS 3.44 for ESR68 as well?

Yes - this is likely to affect enterprise users.

Flags: needinfo?(dkeeler)
You need to log in before you can comment on or make changes to this bug.