dotnet core 2.2 dev ssl cert no longer work with firefox error SEC_ERROR_UNKNOWN_CRITICAL_EXTENSION

[pdhermann-bws]

Issue Title

System:
Windows 10 64 Bit Version 10.0.15063
Dotnet Core SDK 2.2.108
Visual Studio 2017 Pro 15.9.14
Visual Studio Code v 1.36.1

Steps to reproduce:

i created a new dotnet core ssl dev cert with
dotnet dev-certs https --trust
A new SSL Certificate was created and trusted
After starting the dotnet core app i opened firefox dev 69.0b4 (64-Bit)
And navigate to https://localhost:5001/swagger/index.html

Actual results:

i get the error:

Fehler: Gesicherte Verbindung fehlgeschlagen

Beim Verbinden mit localhost:5001 trat ein Fehler auf. Das Zertifikat enthält eine unbekannte kritische Erweiterung. Fehlercode: SEC_ERROR_UNKNOWN_CRITICAL_EXTENSION

Die Website kann nicht angezeigt werden, da die Authentizität der erhaltenen Daten nicht verifiziert werden konnte.
Kontaktieren Sie bitte den Inhaber der Website, um ihn über dieses Problem zu informieren.

Weitere Informationen…

Expected results:

The websites opens and shows the swagger docu page.
On Firefox 60.6.3esr (32-bit) it is working.

I also created a bug by mozilla: https://bugzilla.mozilla.org/show_bug.cgi?id=1570222 because i dont know who has to fix it.

[leecow]

Adding a few folks who may be able to help - @livarcocc @bradygaster

[blowdart]

This falls under aspnet tooling. The source is at https://github.com/aspnet/AspNetCore/blob/master/src/Shared/CertificateGeneration/CertificateManager.cs

This error is thrown when a cert has a critical extension Firefox doesn't understand. Odd that it suddenly stopped between versions.

The only things we appear to be marking as critical is the constraint extension, which limits what the self signed certificate can be used for, both types of key usage, which restricts the purpose of the certificate and the SAN entries, which sets the host names for the certificate. None of these should be controversial.

[carlossanlop]

It's possible this is a Firefox issue, but I'll move the issue to the aspnet repo in case there's something we can do about this.

[carlossanlop]

This issue was moved to dotnet/aspnetcore#14528