[GH-ISSUE #1859] Windows: MOZILLA_PKIX_CA_CERT_USED_AS_END_ENTITY in Firefox #1852

New issue

Closed

opened 2026-03-03 19:54:56 +03:00 by kerem · 1 comment

kerem commented

2026-03-03 19:54:56 +03:00

Owner

Originally created by @cwirving on GitHub (Nov 27, 2023).
Original GitHub issue: https://github.com/ProxymanApp/Proxyman/issues/1859

Description

The TLS certificate used by Proxyman for Windows has the CA basic constraint set to true (unlike on macOS where it is false, which means that Firefox fails to validate any intercepted connections. The underlying Mozilla code clearly checks for this condition and has returned an error for many years.

See the Mozilla documentation for an explanation of the error code.

Steps to Reproduce

Install Proxyman for Windows, including Firefox-specific instructions
Start Proxyman
Set up SSL proxying for a domain of your choice
Visit any page in the domain using Firefox: it fails with MOZILLA_PKIX_CA_CERT_USED_AS_END_ENTITY
Visit the same page using another browser: it works and you can see the proxied requests in Proxyman

Current Behavior

Firefox rejects the proxied certificate because it has the Certificate Authority basic constraint enabled.

Expected Behavior

The certificate is acceptable to Firefox and the page opens normally.

Environment

App version: Proxyman for Windows 2.8.0
Windows version: Windows 11 22H2 (Build 22621.2715)

Originally created by @cwirving on GitHub (Nov 27, 2023). Original GitHub issue: https://github.com/ProxymanApp/Proxyman/issues/1859 ## Description The TLS certificate used by Proxyman for Windows has the CA basic constraint set to true (unlike on macOS where it is false, which means that Firefox fails to validate any intercepted connections. The [underlying Mozilla code](https://github.com/mozilla/gecko-dev/blob/acab011f9478c025c214139fcb811f2dd4f2fe86/security/nss/lib/mozpkix/lib/pkixcheck.cpp#L703) clearly checks for this condition and has returned an error for many years. See the [Mozilla documentation](https://wiki.mozilla.org/SecurityEngineering/x509Certs#Error_Codes_in_Firefox) for an explanation of the error code. ## Steps to Reproduce 1. Install Proxyman for Windows, including Firefox-specific instructions 2. Start Proxyman 3. Set up SSL proxying for a domain of your choice 4. Visit any page in the domain using Firefox: it fails with MOZILLA_PKIX_CA_CERT_USED_AS_END_ENTITY 5. Visit the same page using another browser: it works and you can see the proxied requests in Proxyman ## Current Behavior Firefox rejects the proxied certificate because it has the Certificate Authority basic constraint enabled. ## Expected Behavior The certificate is acceptable to Firefox and the page opens normally. ## Environment - App version: Proxyman for Windows 2.8.0 - Windows version: Windows 11 22H2 (Build 22621.2715)

kerem

2026-03-03 19:54:56 +03:00

closed this issue
added the
bug
label

kerem commented

2026-03-03 19:54:57 +03:00

Author

Owner

@cwirving commented on GitHub (Nov 27, 2023):

I'm sorry. I didn't realize that there was a different GitHub project for the Windows version. Will close this one and move it over there.

@cwirving commented on GitHub (Nov 27, 2023): I'm sorry. I didn't realize that there was a different GitHub project for the Windows version. Will close this one and move it over there.