1691122 - remove subject common name fallback support in CertVerifier

Status: RESOLVED FIXED

(Core :: Security: PSM, task, P2)

Description

[Dana Keeler (she/her) [:keeler]]

Bug 1245280 and bug 1267463 began the process of deprecating fallback to subject common name matching against hostnames in TLS server certificate validation. However, certificates from imported roots were always exempt from this policy in Firefox. In the time since then, Chrome has deprecated fallback to the subject common name [0]. Chrome did have an enterprise policy option to re-enable this fallback, but it was removed in Chrome 66 [1].

[0] https://developers.google.com/web/updates/2017/03/chrome-58-deprecations#remove_support_for_commonname_matching_in_certificates
[1] https://bugs.chromium.org/p/chromium/issues/detail?id=803791

Comment 1

[John Schanck [:jschanck] (out of office Aug 11-18)]

Attachment: Bug 1691122 - Remove subject common name fallback support in CertVerifier. r=keeler

Comment 2

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/0599b2a0913a
Remove subject common name fallback support in CertVerifier. r=keeler,necko-reviewers,kershaw

Comment 3

[Atila Butkovits]

Backed out for causing failures at test_peerConnection_basicAudioNATRelayTLS.html.

Backout link: https://hg.mozilla.org/integration/autoland/rev/e5bcee1dfc4c2c0d8ce4c88156efb859df8cd86c

Push with failures: https://treeherder.mozilla.org/jobs?repo=autoland&selectedTaskRun=aYvU4bEpQ6aHRTlV0KjEhg.0&resultStatus=testfailed%2Cbusted%2Cexception%2Cretry%2Cusercancel&revision=0599b2a0913a4f8a5be6a5cb93be71586580b073

Failure log: https://treeherder.mozilla.org/logviewer?job_id=376046193&repo=autoland&lineNumber=6999

Comment 4

[John Schanck [:jschanck] (out of office Aug 11-18)]

The failing test involves a self-signed certificate generated (at run time) by testing/tools/iceserver/iceserver.py. That script fails to set a subject alternative name, so it is expected to fail w/o subject common name fallback support. I've updated the revision with a patch for iceserver.py

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/90a96fdbd3c4
Remove subject common name fallback support in CertVerifier. r=keeler,necko-reviewers,kershaw

Comment 6

[Atila Butkovits]

https://hg.mozilla.org/mozilla-central/rev/90a96fdbd3c4

Comment 7

[John Schanck [:jschanck] (out of office Aug 11-18)]

Release Note Request (optional, but appreciated)
[Why is this notable]: Validation of any manually installed certificates that lack the subjectAltName extension will fail with error code SSL_ERROR_BAD_CERT_DOMAIN.
[Affects Firefox for Android]: yes
[Suggested wording]: Removed "subject common name" fallback support from certificate validation. This fallback mode was previously enabled only for manually installed certificates. The CA Browser Forum Baseline Requirements have required the presence of the "subjectAltName" extension since 2012, and use of the subject common name was deprecated in RFC 2818.
[Links (documentation, blog post, etc)]:

Comment 8

[Ryan VanderMeulen [:RyanVM]]

Added to the Fx101 relnotes.