430561 - Domain Name mismatch dialog for certificate that matches the domain

Status: RESOLVED WORKSFORME

(Thunderbird :: Security, defect)

Description

[Andreas Ebbert]

User-Agent:       Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.8.1.14) Gecko/20080418 Ubuntu/7.10 (gutsy) Firefox/2.0.0.14
Build Identifier: 2.0.0.12 (20080227)

I'm unsure what to make out of this. I'm maintaining my own server and as far as I can tell the certificate is ok, but still Thunderbird keeps telling me that the domain is not correct, although it exactly matches the domain in the certificate. What's going wrong? Attached are screenshots to visualize the problem

Reproducible: Always

Steps to Reproduce:
1.
2.
3.

Comment 1

[Andreas Ebbert]

Attachment: Dialog that domain names do not match

Comment 2

[Andreas Ebbert]

Attachment: certificate details

Comment 3

[Andreas Ebbert]

Attachment: smtp config

Comment 4

[Andreas Ebbert]

Can anyone confirm what's going on here? Certificate details were pasted into the support forum for the distribution I'm using: http://forum.collax.com/viewtopic.php?t=4966

According to the support the certificate looks ok.

Comment 5

[Elmar Ludwig]

The certificate has a "Subject Alternative Name" extension, so the CN attribute is effectively ignored. The error dialog is very confusing in this case.

See bug 238142 for all the details.

This is either INVALID or a duplicate of bug 238142, I'd say.

Comment 6

[Andreas Ebbert]

Ah, that might very well be the case! I didn't know that I have to repeat the original CN in the "Subject Alternative Name". I'll try that out and report back. In any case, the error dialog could be improved :)

Comment 7

[Elmar Ludwig]

It has been replaced completely for Firefox in bug 398718 and will be replaced for Thunderbird 3 as well in bug 429843.

Comment 8

[Ludovic Hirlimann [:Usul]]

Andreas do you still have the issue ?

Comment 9

[Andreas Ebbert]

Hi, I fixed my certificate as suggested in comment #5 (added the CN name to the list of alternative names). So I don't see the dialog any longer. But it would be nice, if it is redesigned, as suggested in comment #7.

Comment 10

[Elmar Ludwig]

(In reply to comment #9)
> But it would be nice, if it is redesigned, as suggested in comment #7.

It already is - for Thunderbird 3 - in bug 429843. So I think this bug can be closed now.

Comment 11

[Ludovic Hirlimann [:Usul]]

Fixing as works for me.