2012294 - Certificate error when downloading from download.microsoft.com

Status: RESOLVED FIXED

(Core :: Security: PSM, defect)

Description

[Francesco Lodolo [:flod]]

Try to download any style guide from this website
https://learn.microsoft.com/en-us/globalization/reference/microsoft-style-guides?source=recommendations

It works in Chrome, it fails in Firefox with a certificate error.

Comment 1

[Alice0775 White]

Regression window using local cache build with new profile:
https://hg-edge.mozilla.org/integration/autoland/pushloghtml?fromchange=71772426d9b100ecbcc020257a488f31902975f2&tochange=a5d60affe1089d275812db7569fea9d85ca19145

Suspect: Bug 1906193

Comment 2

[BugBot [:suhaib / :marco/ :calixte]]

Set release status flags based on info from the regressing bug 1906193

:anna.weine, since you are the author of the regressor, bug 1906193, could you take a look? Also, could you set the severity field?

For more information, please visit BugBot documentation.

Comment 3

[Anna Weine]

Same as
https://www.reddit.com/r/firefox/comments/1qhimoy/ff_not_trusting_microsoft_cert_on_windows_sdk/
https://forum.bigfix.com/t/http-error-60-for-download-microsoft-com/53621
etc. It looks like the chain is missing Microsoft TLS G2 ECC CA OCSP 02 certificate, so I believe it's the problem on MS side?

Dana, FYI

Comment 4

[Dana Keeler (she/her) [:keeler]]

Yes - the server is misconfigured. Intermediate preloading should have papered over this, but while the intermediate is known to the CCADB, it's not in the appropriate dataset to be included in preloading. We're looking into it.

Comment 5

[Ryan VanderMeulen [:RyanVM]]

Microsoft fixed this on their end.