Reorder SAN for firefox trust

[Js-Brecht]

Getting error SSL_ERROR_BAD_CERT_DOMAIN in Firefox on Windows.

For whatever reason, if the wildcard domain is the first domain in the list, Firefox will generate the error, even though the necessary host is, in fact, in the list. Putting the domain that matches the CN first seems to work, and Firefox trusts the certificate. 🤷‍♂

[zetlen]

Oddly, it was this one I wasn't able to reproduce. Firefox seemed to trust domains the SANs in that order for me. This is on Windows 10 Home, from an image I got from here: https://developer.microsoft.com/en-us/microsoft-edge/tools/vms/

Can you give me a repro with versions?

[Js-Brecht]

Yeah, this one was pretty bizarre. I encountered it when working on getting Node to trust the CA certificate. I could get it working for everything but Firefox, and I toyed with a thousand different things. Ultimately, this was the minimal number of changes I had to make to get it to work.

I'm currently running Windows 10 Pro x64, build 18362.449.
I have Firefox version 70.0.1 x64.

This is what I get (running Firefox & Chrome side by side, Chrome is on the right)

This is using the feature update (for returning the CA Path) and the default Gatsby starter. Let me put together a minimal reproduction, though. I'll post back when it's ready.

[Js-Brecht]

Check out https://github.com/Js-Brecht/firefox-cert-trust-issue

The directory .certs is what was generated by devcert in my local app data, in case you wanted to see what was generated on my computer. I used version 1.0.2, with the same results.

[Js-Brecht]

Check out the error it gives me. It's so strange to me that it says it's a bad domain...

The certificate is only valid for the following names: *.localhost, localhost

yet you'll notice that I am at localhost 🤣

[zetlen]

It's possibly only reproducible if it's a starred cert on a top level domain, like *.localhost. I'll try that one later.

[Js-Brecht]

I didn't think to check to see if a subdomain would work with the SAN reordered (wildcard last). I'll check that out to see if it causes any problems

[Js-Brecht]

Okay, just verified that reordering the SAN doesn't cause any issues for subdomains.

[zetlen]

Still can't reproduce it, but I also can't find any regressions from this change, so I'm gonna merge it.