1909824 - mozilla::pkix: the extension "Microsoft Application Policies" should be ignored even if critical, if eku is present

Status: UNCONFIRMED

(NSS :: Libraries, defect, P5)

Description

[oron]

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:128.0) Gecko/20100101 Firefox/128.0

Steps to reproduce:

I am trying to access intranet sites using TLS with certificates generated by a Microsoft product using some kind of template.

Actual results:

Firefox fails to securely connect with SEC_ERROR_UNKNOWN_CRITICAL_EXTENSION due to the section "Microsoft Application Policies" being marked as critical. This does not occur in other browsers or any other software.

Expected results:

Firefox should ignore this critical extension if "Extended Key Usage" is also present, as per Microsoft's documentation here: https://learn.microsoft.com/en-us/windows/win32/seccertenroll/supported-extensions#msapplicationpolicies

I know this is Microsoft's fault, but Firefox is the only software that has this issue. (Also, since Firefox has very low market share in the organization, there is no incentive to fix the certificates)

Comment 1

[BugBot [:suhaib / :marco/ :calixte]]

The Bugbug bot thinks this bug should belong to the 'WebExtensions::Untriaged' component, and is moving the bug to that component. Please correct in case you think the bot is wrong.

Comment 2

[Alex Cornestean]

Hello,

Since the issue does not appear to be related to webextensions I’m going to change the product of this report to a more appropriate one (Firefox), however, in case of error, please revert the changes or move the report to the correct product/component.

Thank you !

Comment 3

[gold holk]

Finally I find the reason that firefox does not work in my company's intranet.
It would be great if this get fixed.

Comment 4

[gold holk]

I found a mitmproxy for tls can by pass this issue.
Mitmproxy does provide a portable excutable for windows:
https://mitmproxy.org/downloads/ (the zip file mitmproxy-*-windows-x86_64.zip)

Starting a proxy on 8080 port does not require special permission on windows.
One just needs to start the proxy, trust its cert, and write a proxy.pac file to config which traffics should go through the proxy.

In additional, maybe enable --ssl-insecure for mitmproxy if the cert original broken cert is a self-signed cert.

Comment 5

[Dana Keeler (she/her) [:keeler]]

Comment 4 gives instructions to allow anyone to intercept and decrypt all of your browser's traffic, so definitely don't do that.