1910223 - Firefox Rejects Certificate with Policy Mappings Extension (Error code: SEC_ERROR_UNKNOWN_CRITICAL_EXTENSION)

Status: RESOLVED WONTFIX

(NSS :: Libraries, defect)

Description

[2295456556]

Attachment: [3.0.126.52.der]1264ea691722004557.crt

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Edg/123.0.0.0

Steps to reproduce:

1.Generating a mutated digital certificate with an additional Subject Alternative Name (SAN) of "ypj.test.com", along with its corresponding root CA and private key.
2.Configuring an Nginx web server to use the mutated certificate and private key in HTTPS mode.
3.Setting up the local machine (127.0.0.1) as the server and mapping "ypj.test.com" to 127.0.0.1 in the hosts file.
4.Adding the root CA to the system's trusted root certificate store using certutil.
5.Running nginx.exe. Accessing the URL "https://ypj.test.com:443" in a web browser, where the certificate's SAN matches the URL.

Firefox-version-113.0

Actual results:

Firefox rejects a certificate containing the critical Policy Mappings extension (OID 2.5.29.33) and displays the error code: SEC_ERROR_UNKNOWN_CRITICAL_EXTENSION. Conversely, Chrome correctly accepts the certificate.

There are two issues identified:

1. Firefox fails to parse the OID 2.5.29.33 (Policy Mappings) and incorrectly treats it as an unknown extension.
2. Firefox blocks normal access due to this failure.

Expected results:

Firefox should behave consistently with Chrome by:

1. Correctly parsing the OID 2.5.29.33 as Policy Mappings.
2. If the Policy Mappings field is valid, Firefox should pass the verification and allow normal access.
   Please address this inconsistency to ensure proper handling of the Policy Mappings extension in certificates.

Comment 1

[2295456556]

Attachment: [3.0.126.52.der]1264ea691722004557.der

Comment 2

[2295456556]

Attachment: [3.0.126.52.der]1264ea691722004557CA.crt

Comment 3

[2295456556]

Attachment: [3.0.126.52.der]1264ea691722004557CA.der

Comment 4

[2295456556]

Attachment: hosts.png

Comment 5

[2295456556]

Attachment: nginx_config.png

Comment 6

[2295456556]

Attachment: chrome.png

Comment 7

[2295456556]

Attachment: rsa_pri_2048.pem

Comment 8

[Dana Keeler (she/her) [:keeler]]

At this time, mozilla::pkix does not support the policy mappings extension, and we have no plans to support it. The baseline requirements recommend that it not be used, and we see no reason to support it.