501862 - SSL Certificate Rules Too Strict: Wildcards do not apply to superdomains

Status: RESOLVED DUPLICATE of bug 159483

(Firefox :: Security, defect)

Description

[andrew.pennebaker]

User-Agent:       Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.1) Gecko/20090624 Firefox/3.5
Build Identifier: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.1) Gecko/20090624 Firefox/3.5

Normally SSL certificates apply only to a single domain such as www.paypal.com or www.amazon.com. Certificates with wildcards can be used on several domains, e.g. yellosoft.us, slug.yellosoft.us, time.yellosoft.us, etc.

FF v3.5 (as opposed to v3.0) does not let wildcard certificates for subdomains apply to superdomains. For example, the certificate for *.yellosoft.us is not accepted for yellosoft.us, but is accepted for time.yellosoft.us and so on.

Google Chrome and Safari 4 also have this problem.

Reproducible: Always

Steps to Reproduce:
1. Visit https://slug.yellosoft.us and https://time.yellosoft.us
2. The wildcard certificate is accepted.
3. Visit https://yellosoft.us.
4. The same certificate is not accepted for the superdomain.
Actual Results:  
Warning message:

This Connection is Untrusted

You have asked Firefox to connect
securely to yellosoft.us, but we can't confirm that your connection is secure.

[...]

FF refuses to encrypt communication to the website. Hey, it couldn't hurt to encrypt anything, even if the certificate is a fraud.

Expected Results:  
FF displays the "Authenicated by..." security lock icon in the status bar, highlights the favicon in the addressbar, and encrypts the communication to the web server.

Google Chrome also has this problem as of v3.0.

Safari 4 also has this problem, but its warning message isn't as obnoxious.

YelloSoft is my domain by the way. I understand that 1) This could be a problem with my server configuration, though I have used exactly the same Apache settings for the super- as my sub-domains. 2) This could be perfectly acceptable security responses. I am not an expert on certificates. Three major browsers act the same way (probably IE too); there is only a small chance that they're all wrong.

Comment 1

[Johnathan Nightingale [:johnath]]

This is actually the behaviour the spec (RFC2818) expects, and in Firefox 3.5 we tightened up our wildcard implementation to match the spec.  Your certificate authority can, however, issue you a certificate which is valid for yellosoft.us AND *.yellosoft.us to cover this situation. A certificate can provide multiple subjectAltNames, I'd suggest contacting them about your situation.

I'm going to mark this bug as a duplicate of the one that tracked the correcting of our wildcard behaviour - sorry that it bit you in this way, I hope your CA will be responsive to your request for a re-issue.