mirror of
https://github.com/ProxymanApp/proxyman-windows-linux.git
synced 2026-04-27 08:55:50 +03:00
[GH-ISSUE #336] Windows: Firefox MOZILLA_PKIX_CA_CERT_USED_AS_END_ENTITY error when visiting a proxied page #335
Labels
No labels
Linux
bug
enhancement
enhancement
pull-request
question
✅ Done
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference
starred/proxyman-windows-linux#335
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @cwirving on GitHub (Nov 27, 2023).
Original GitHub issue: https://github.com/ProxymanApp/proxyman-windows-linux/issues/336
Originally assigned to: @NghiaTranUIT on GitHub.
Description
The TLS certificate used by Proxyman for Windows has the CA basic constraint set to true (unlike on macOS where it is false, which means that Firefox fails to validate any intercepted connections. The underlying Mozilla code clearly checks for this condition and has returned an error for many years.
See the Mozilla documentation for an explanation of the error code.
Steps to Reproduce
Current Behavior
Firefox rejects the proxied certificate because it has the Certificate Authority basic constraint set to TRUE.
Expected Behavior
The certificate is acceptable to Firefox and the page opens normally.
Environment
@NghiaTranUIT commented on GitHub (Nov 28, 2023):
@cwirving it's not a bug. You have to install & trust the Proxyman Certificate to your Firefox. Here is the docs: https://docs.proxyman.io/debug-devices/firefox
The reason is: Firefox has their own Trust Store, and it doesn't respect the Windows Certificate Manager.
@cwirving commented on GitHub (Nov 28, 2023):
@NghiaTranUIT, I’m afraid that I must not explained clearly: the root certificate is installed in the Firefox Trust Store. This is not that error. If you fail to install the root certificate, you get a different error (that, ironically, Firefox does allow you to bypass).
This error is that the certificate served up by the proxy (not the root certificate) is recognized, but rejected because it contains a CA basic authority claim set to true. What is more frustrating is that Firefox will not let you bypass this error. Period.
If you examine the connection certificate in the browser, you will see this. Importantly, the macOS version of Proxyman does not set this CA basic authority claim — Firefox works beautifully in macOS through Proxyman because the certificate does not have this CA basic authority claim. I am happy to screenshot the certificates side by side if you don’t believe me.
@NghiaTranUIT commented on GitHub (Nov 28, 2023):
@cwirving it'd be great to have a screenshot.
Here is the screenshot. Can you clarify which attributes should be changed from the Windows? We can fix it.
@cwirving commented on GitHub (Nov 28, 2023):
I connected to the proxied sites in Firefox on each plaform, exported the certificates from each as PEM files and dumped the contents using openssl. Then did a diff between them. The key difference is the fact that the connection certificate generated on Windows includes the
CA:TRUEbasic constraint while macOS hasCA:FALSE:@NghiaTranUIT commented on GitHub (Nov 28, 2023):
Thanks @cwirving. Our team will fix it asap 👍
cc @kics223w1