1867580 - Firefox certificate viewer unable to parse altNames in digital certificate

Status: UNCONFIRMED

(Firefox :: Security, defect)

Description

[2295456556]

Attachment: b1d22a6b-88a6-11ee-a8b0-202b206f6d12kj.1688.com_1.pem

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Edg/119.0.0.0

Steps to reproduce:

1.Mutating a certificate.
2.Running the browser to parse the mutated certificate file.
3.Observing the results.

Actual results:

Firefox unable to parse altNames in digital certificate.
Firefox's certificate viewer does not display altNames.
However, Chrome can parse and display it, which causes a difference.

Expected results:

Firefox can parse the altNames in digital certificates correctly.

Comment 1

[2295456556]

Attachment: b1d22a6b-88a6-11ee-a8b0-202b206f6d12kj.1688.com_1.der

Comment 2

[2295456556]

Attachment: U[B4@28X4_`)8RYGB6O)793.png

Comment 3

[BugBot [:suhaib / :marco/ :calixte]]

The Bugbug bot thinks this bug should belong to the 'Core::Security: PSM' component, and is moving the bug to that component. Please correct in case you think the bot is wrong.

Comment 4

[2295456556]

Excuse me, may I ask why no one has answered this question?

Comment 5

[Negritas Sergiu, Desktop QA]

Hello! I have tried to reproduce the issue with firefox 122.0a1(2023-12-11) on Ubuntu 22.04, unfortunately I wasn't able to reproduce the issue on my end. Could you please answer the following questions in order to further investigate this isssue.

1. Does this issue happen with a new profile? Here is a link on how to create one: https://support.mozilla.org/en-US/kb/profile-manager-create-remove-switch-firefox-profiles
2. Does this issue happen in the latest nightly? Here is a link from where you can download it: https://www.mozilla.org/en-US/firefox/channel/desktop/
3. Do you have any addons installed? If yes could you please list them?

Comment 6

[2295456556]

The problem occurs in Windows 10 22H2 with Firefox version 120.0.1 (64 bits).
Chrome browser can display SAN content, but Firefox cannot parse and display SAN content.
Please refer to the latest uploaded .png image for the specifics.

Comment 7

[2295456556]

Attachment: firefox.png

Comment 8

[2295456556]

Attachment: chrome.png

Comment 9

[Dana Keeler (she/her) (use needinfo) [:keeler] (on leave)]

You're better off reporting these issues here: https://github.com/PeculiarVentures/PKI.js/issues (PKIjs is the underlying library Firefox uses to display certificates, which is where you're finding issues).