1857568 - Chrome and Firefox parse certificate subject name information in digital certificates differently

Status: RESOLVED INVALID

(Firefox :: Security, defect)

Description

[2295456556]

Attachment: T8H0L%CQJIW4UB$)_}A%I6Y.png

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.0.0 Safari/537.36 Edg/113.0.1774.35

Steps to reproduce:

1.Use Python to create a local server (e.g. using Flask) and specify a mutated certificate and private key. Access the Flask provided url in Chrome.
2.In Firefox, visit the url about:certificate?cert=(processed pem data) containing the certificate information.
3.In your own developers'way, let the browser parse mutated certificate files, then observe the results.

Actual results:

Description: We tested with a mutated digital certificate as a test case. We have discovered differences in the parsing results of the certificate subject name for mutated digital certificates between Google Chrome and Mozilla Firefox browsers.
OS: Windows 10 22H2 19045.2604
My expectations: Confirm whether this is a security bug or a UI bug.

Expected results:

I don't know which of these two different certificate subject name is correct or displaying non-standard characters in the subject name on the certificate itself is an error. So I need you to confirm whether this difference is a bug or not.

Comment 1

[2295456556]

Attachment: 625fee75-5891-11ee-9e25-202b206f6d12www.apple.com_1.der

Comment 2

[2295456556]

Attachment: 625fee75-5891-11ee-9e25-202b206f6d12www.apple.com_1.pem

Comment 3

[2295456556]

Attachment: rsa_praviatekey_2048bit.pem

The public key of the certificate is generated by myself using my own private key and has been replaced.

Comment 4

[BugBot [:suhaib / :marco/ :calixte]]

The Bugbug bot thinks this bug should belong to the 'Core::Security: PSM' component, and is moving the bug to that component. Please correct in case you think the bot is wrong.

Comment 5

[Dana Keeler (she/her) [:keeler]]

Firefox does not make trust decisions based on how the certificate viewer displays certificates. At most, this is a display issue.

Comment 6

[2295456556]

So please ask if this is a bug

Comment 7

[BugBot [:suhaib / :marco/ :calixte]]

The severity field is not set for this bug.
:serg, could you have a look please?

For more information, please visit BugBot documentation.

Comment 8

[Sergey Galich [:serg]]

Thanks for raising this question!

Firefox displays ÷ which is encoded in the attached file.
Chrome displays a symbol used when font doesn't have a glyph for the ÷.

This is not a bug, it's just Chrome uses font that doesn't have a glyph for the ÷