384273 - Could not establish an encrypted connection because certificate is either invalid or corrupted. Error code: -8151

Status: RESOLVED WORKSFORME

(Firefox :: Security, defect)

Description

[Nicki]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.0; en-GB; rv:1.8.1.4) Gecko/20070515 Firefox/2.0.0.4
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-GB; rv:1.8.1.4) Gecko/20070515 Firefox/2.0.0.4

When accessing the url https://mobile.gijima.com I get the following error: Could not establish an encrypted connection because certificate presented by mobile.gijima.com is either invalid or corrupted. Error code: -8151

Last week the previous certificate expired, I could then access the url using FireFox, but as soon as the cert was replaced, I could no longer access the site

Reproducible: Always

Steps to Reproduce:
1.
2.
3.
Actual Results:  
Could not establish an encrypted connection because certificate presented by mobile.gijima.com is either invalid or corrupted. Error code: -8151

Expected Results:  
Established a connection

Comment 1

[Nicki]

I can access this url through IE, and I do remember using it successfully with Opera as well.

Comment 2

[Nicki]

Possibly related to 318612, but this one has a different error code.

Comment 3

[Nicki]

Attachment: Certificate with which Firefox has a problem

Comment 4

[Kaspar]

(In reply to comment #3)
> Created an attachment (id=268222) [details]
> Certificate with which Firefox has a problem

Error -8151 means SEC_ERROR_UNKNOWN_CRITICAL_EXTENSION, see http://www.mozilla.org/projects/security/pki/nss/ref/ssl/sslerr.html.

The error is not caused by the server cert itself, but by one of the intermediate CA certs, which has this extension:

>             Name: Certificate Policies
>             Critical: True
>             Data:
>                 Policy Name: OID.1.3.6.1.4.1.311.21.8.5396250.7275761.4211106.13455821.5513173.69.3931056252.2291039117
>                     Policy Qualifier Name: PKIX CPS Pointer Qualifier
>                     Policy Qualifier Data: "http://dp1.gijima.com/pki/policy-
>                         external-CA.htm"
> 

(Note that the critical flag is set to true for this extension)

NSS currently doesn't have real support for the RFC 3280 Certificate Policies extensions, and since the one in the intermediate CA cert is marked critical, it will (correctly) reject the certificate, as specified by RFC 3280:

> If this extension is
> critical, the path validation software MUST be able to interpret this
> extension (including the optional qualifier), or MUST reject the
> certificate.

This is going to change with NSS 3.12 and libpkix (see http://wiki.mozilla.org/NSS:Roadmap#libpkix:_an_RFC_3280_Compliant_Certificate_Path_Validation_Library), but until then, certs with a critical cert policy extension are not supported by Mozilla products.

Ccing Nelson Bolyard, in case he might want to comment on my explanation.