dotnet core 2.2 dev ssl cert no longer work with firefox error SEC_ERROR_UNKNOWN_CRITICAL_EXTENSION

[carlossanlop]

From @pdhermann-bws on Wednesday, July 31, 2019 7:01:52 AM

Issue Title

System:
Windows 10 64 Bit Version 10.0.15063
Dotnet Core SDK 2.2.108
Visual Studio 2017 Pro 15.9.14
Visual Studio Code v 1.36.1

Steps to reproduce:

i created a new dotnet core ssl dev cert with
dotnet dev-certs https --trust
A new SSL Certificate was created and trusted
After starting the dotnet core app i opened firefox dev 69.0b4 (64-Bit)
And navigate to https://localhost:5001/swagger/index.html

Actual results:

i get the error:

Fehler: Gesicherte Verbindung fehlgeschlagen

Beim Verbinden mit localhost:5001 trat ein Fehler auf. Das Zertifikat enthält eine unbekannte kritische Erweiterung. Fehlercode: SEC_ERROR_UNKNOWN_CRITICAL_EXTENSION

Die Website kann nicht angezeigt werden, da die Authentizität der erhaltenen Daten nicht verifiziert werden konnte.
Kontaktieren Sie bitte den Inhaber der Website, um ihn über dieses Problem zu informieren.

Weitere Informationen…

Expected results:

The websites opens and shows the swagger docu page.
On Firefox 60.6.3esr (32-bit) it is working.

I also created a bug by mozilla: https://bugzilla.mozilla.org/show_bug.cgi?id=1570222 because i dont know who has to fix it.

Copied from original issue: dotnet/core#3127

[carlossanlop]

From @leecow on Wednesday, July 31, 2019 5:31:33 PM

Adding a few folks who may be able to help - @livarcocc @bradygaster

[carlossanlop]

From @blowdart on Wednesday, July 31, 2019 5:48:22 PM

This falls under aspnet tooling. The source is at https://github.com/aspnet/AspNetCore/blob/master/src/Shared/CertificateGeneration/CertificateManager.cs

This error is thrown when a cert has a critical extension Firefox doesn't understand. Odd that it suddenly stopped between versions.

The only things we appear to be marking as critical is the constraint extension, which limits what the self signed certificate can be used for, both types of key usage, which restricts the purpose of the certificate and the SAN entries, which sets the host names for the certificate. None of these should be controversial.

[carlossanlop]

From @carlossanlop on Friday, September 27, 2019 6:53:02 PM

It's possible this is a Firefox issue, but I'll move the issue to the aspnet repo in case there's something we can do about this.

[blowdart]

@javiercn Any ideas here?

[pdhermann-bws]

The Value enterprise-roots.enabled is already set to true and i can´t change it. Mit freundlichen Grüßen Patrick Daniel Hermann Scrummaster / Systemanalytiker T +49-5308-7070-217 E P.Hermann@BWS-Group.de<mailto:P.Hermann@BWS-Group.de> [cid:image003.png@01D57CDA.22E9F390]<http://www.bws-group.de/> www.BWS-Group.de<http://www.BWS-Group.de> BWS Consulting Group GmbH Hohenbüchen 5 | D-38444 Wolfsburg [cid:image002.jpg@01D57CDA.22E4C370] Amtsgericht Braunschweig HRB Nr.101056 Geschäftsführer: Bernd Graichen, Ulrich Rühl Von: Jesse Nicholson <notifications@github.com> Gesendet: Dienstag, 1. Oktober 2019 19:58 An: aspnet/AspNetCore <AspNetCore@noreply.github.com> Cc: Patrick Daniel Hermann <P.Hermann@BWS-Group.de>; Mention <mention@noreply.github.com> Betreff: Re: [aspnet/AspNetCore] dotnet core 2.2 dev ssl cert no longer work with firefox error SEC_ERROR_UNKNOWN_CRITICAL_EXTENSION (#14528) Well I can tell you that the remarks you've received about trusting the certificate in the mozilla thread are wrong. You just need to enable enterprise-roots in about:config and restart firefox. That will tell firefox to trust the local machine's root stores. — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub<#14528>, or mute the thread<https://github.com/notifications/unsubscribe-auth/AKYROEQNCMA5OSWLHIJXCTDQMOFSPANCNFSM4I3JXAWQ>.

[analogrelay]

@pdhermann-bws based on your comment on the Mozilla bug, it sounds like this was a Firefox issue and is now resolved as of Firefox 71 (in beta right now). Is that correct? Do you need additional action from us?

[pdhermann-bws]

Yes your are right. It was an Firefox Issue and has been fixed with Firefox 71+. The tiket can be closed. Mit freundlichen Grüßen Patrick Daniel Hermann Scrummaster / Systemanalytiker T +49-5308-7070-217 E P.Hermann@BWS-Group.de<mailto:P.Hermann@BWS-Group.de> [cid:image003.png@01D592D6.D9238CE0]<http://www.bws-group.de/> www.BWS-Group.de<http://www.BWS-Group.de> BWS Consulting Group GmbH Hohenbüchen 5 | D-38444 Wolfsburg [cid:image002.jpg@01D592D6.D91E35B0] Amtsgericht Braunschweig HRB Nr.101056 Geschäftsführer: Bernd Graichen, Ulrich Rühl Von: Andrew Stanton-Nurse <notifications@github.com> Gesendet: Mittwoch, 30. Oktober 2019 21:35 An: aspnet/AspNetCore <AspNetCore@noreply.github.com> Cc: Patrick Daniel Hermann <P.Hermann@BWS-Group.de>; Mention <mention@noreply.github.com> Betreff: Re: [aspnet/AspNetCore] dotnet core 2.2 dev ssl cert no longer work with firefox error SEC_ERROR_UNKNOWN_CRITICAL_EXTENSION (#14528) @pdhermann-bws<https://github.com/pdhermann-bws> based on your comment on the Mozilla bug<https://bugzilla.mozilla.org/show_bug.cgi?id=1570222#c57>, it sounds like this was a Firefox issue and is now resolved as of Firefox 71 (in beta right now). Is that correct? Do you need additional action from us? — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub<#14528>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/AKYROEWXD52YN7MK4WVZCXLQRHVXHANCNFSM4I3JXAWQ>.

[analogrelay]

Closing as this was a Firefox bug: https://bugzilla.mozilla.org/show_bug.cgi?id=1570222

No action is needed on our side.