Home / server / Questions / 898793
Accepted
Michael Uray
Asked: 2018-02-26 09:37:02 +0800 CST

Why does Firefox show SSL_ERROR_BAD_CERT_DOMAIN with a self-signed wildcard certificate, but other browsers do not?

  • 772

I assigned a self signed wildcard certificate to an OpenWRT (LEDE) router LUCI (uHTTPd) system. The CA which signed this certificate got added to all browsers as trusted certificate authoritiy.

It works fine on Internet Explorer, Edge and Chrome, but not on Firefox 58.0.2, which throws the error SSL_ERROR_BAD_CERT_DOMAIN, even when it states on the same error page that the certificate is issued for this domain.

If I issue the certificate directly for the host (no wildcard) then it works fine in FF as well.

What could cause this issue?

ssl-certificate

1 Answers

  1. Best Answer

    Your certificate has the following "Subject Alternative Names" (SAN):

    1. DNS:*.mainserver.local
    2. DNS:*.mainserver
    3. DNS:*.mgmt.ctb.co.at
    4. IP:192.168.0.254
    5. IP:192.168.0.9
    6. IP:192.168.10.254
    7. IP:192.168.11.254
    8. IP:192.168.12.254
    9. DNS:mgmt.ctb.co.at
    10. DNS:mainserver.local

    Firefox does not like entry 2, as it considers mainserver a TLD and aborts there; the following entries are not checked, so your fw1.mgmt.ctb.co.at never matches entry 3.

    I solved a similar problem in our domain be re-ordering the SANs and putting all FQDNs first; you should move your entry 2 to the end.

    Firefox issues of interest

    • 3