599821 - ssl_error_bad_cert_domain when using https with url containing .com before final .com

Status: RESOLVED INVALID

(Core :: Security, defect)

Description

[Julien Bachmann]

User-Agent:       Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.6; en-US; rv:1.9.2.10) Gecko/20100914 Firefox/3.6.10
Build Identifier: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.6; en-US; rv:1.9.2.10) Gecko/20100914 Firefox/3.6.10

If you access through https a URL containing .com in the midlle, then Error code: ssl_error_bad_cert_domain is raised but it should not.
If you try following url:
https://apps.test.webdoc.com.s3.amazonaws.com/medias/widget/ffa8a20d-54fd-45a7-a350-fc5f00f02dec/0.1/icon.png

You have the following warning:
The certificate is only valid for the following names:
  *.s3.amazonaws.com , s3.amazonaws.com
But you can see that domain is *.s3.amazonaws.com. So warning should not be raised.

Reproducible: Always

Steps to Reproduce:
1.open URL https://apps.test.webdoc.com.s3.amazonaws.com/medias/widget/ffa8a20d-54fd-45a7-a350-fc5f00f02dec/0.1/icon.png

Actual Results:  
This Connection is Untrusted is raised by the browser

Expected Results:  
No warning should be raised

Comment 1

[Tuukka Tolvanen (sp3000)]

see also https://test.webdoc.blarg.s3.amazonaws.com/medias/widget/ffa8a20d-54fd-45a7-a350-fc5f00f02dec/0.1/icon.png

Comment 2

[Julien Bachmann]

Oops, you are right it does not comes from .com but from the fact that sub domain contains '.'
I'm not sure how browser should handle that but for me if the certificate is for *.s3.amazonaws.com it should match anything before .s3.amazonaws.com

I see the same problem on webkit. Perhaps it is a normal behavior.
Let me know.
Thanks.

Comment 3

[Jo Hermans]

The problem is that a wildcard is only valid for a single level, see bug 159483.

I quote RFC 2818, on page 4 :

   Matching is performed using the matching rules specified by
   [RFC2459].  If more than one identity of a given type is present in
   the certificate (e.g., more than one DNSName name, a match in any one
   of the set is considered acceptable.) Names may contain the wildcard
   character * which is considered to match any single domain name
   component or component fragment. E.g., *.a.com matches foo.a.com but
   not bar.foo.a.com. f*.com matches foo.com but not bar.com.

Comment 4

[Boris Zbarsky [:bzbarsky]]

Yep.  This is a server bug in this case.  If it wants to use deeply-nested subdomains, it needs to serve up the appropriate certificates.