583297 - Using absolute Domain Names will make certificate check fail

Status: RESOLVED DUPLICATE of bug 134402

(NSS :: Libraries, defect)

Description

[riedel]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.3) Gecko/20100401 Firefox/3.6.3
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.3) Gecko/20100401 Firefox/3.6.3

If using the correct FQDN ie. absolute DNS Notation the certificate check fails.


See RFC 1034:"Since a complete domain name ends with the root label, this leads to a printed form which ends in a dot."

Reproducible: Always

Steps to Reproduce:
1. Browse to https://www.mozilla.org./
2. Browse to https://www.mozilla.org/

Actual Results:  
First alternative gives "This Connection is Untrusted"


Relates to Bug #234058, which IMHO wrongly assumes relative notations as fully qualified names. Users should use absolute notation with a trailing dot to be sure they reach the server they intent to. Firefox should rather automatically expand relative domain names if this is a security problem.

Comment 1

[Nelson Bolyard (seldom reads bugmail)]

This issue has come up before.  Please look for the duplicate bug.
It might be a PSM bug.  It's not an NSS problem.

Comment 2

[Nelson Bolyard (seldom reads bugmail)]

Found it.