31df59e394
Bug 1311996 - Fix code using pkix::Result to not conflict with the new mozilla::Result type. r=keeler
2016-10-31 10:05:13 +01:00
d9e14ecf6a
Bug 1264562 - Part 4: Instantiates an NSSCertDBTrustDomain containing the first party domain (adapted from Tor Browser patch #13670 ) r=keeler
...
--HG--
extra : rebase_source : c43aa11ae06a3281219d1c70c0ec274c258e43c8
2016-10-04 16:49:55 +08:00
275d94abd0
Bug 1296317 - Stop calling PR_SetError() in VerifyCert() and VerifySSLServerCert(). r=keeler
...
The PR_SetError() + PR_GetError() pattern currently used is error prone and
unnecessary. The functions involved can instead return mozilla::pkix::Result,
which is equally expressive and more robust.
MozReview-Commit-ID: Hkd39eqTvds
--HG--
extra : rebase_source : f09e37c6a3a930c30cce003139df86bc84d771ee
2016-10-10 15:44:41 +08:00
976d5c3f1d
Bug 1293231 - Certificate Transparency - basic telemetry reports; r=Cykesiopka,keeler
...
MozReview-Commit-ID: EGvuZADObJo
--HG--
extra : rebase_source : 9a059c9f8e2fdf9bfc693b0b5649808b1beeb67b
2016-08-11 13:41:50 +03:00
b1cb7643ef
bug 1302140 - add policy to disable SHA-1 except for certificates issued by non-built-in CAs r=jcj,rbarnes
...
MozReview-Commit-ID: 2uwHPxk0VhZ
--HG--
extra : rebase_source : 1c7b5d2559139fa8286342decf4e4f7c83317e29
2016-09-14 15:11:15 -07:00
d8888f81d1
Backed out changeset 2df66e8b7411 (bug 1302140) for Windows build bustage in CertVerifier.cpp. r=backout on a CLOSED TREE
2016-09-21 20:47:08 +02:00
d374bc442a
bug 1302140 - add policy to disable SHA-1 except for certificates issued by non-built-in CAs r=jcj,rbarnes
...
MozReview-Commit-ID: 2uwHPxk0VhZ
--HG--
extra : rebase_source : 5b1342abc2eb260ec91464b3a1d331baf8968460
2016-09-14 15:11:15 -07:00
2e47d34ebc
Bug 1256302 - Remove CertVerifier::InitCertVerifierLog(). r=jcj
2016-09-02 10:45:47 +02:00
c17f3a2733
bug 982932 - only allow Netscape-stepUp to be used for serverAuth for old CA certificates r=Cykesiopka,jcj
...
MozReview-Commit-ID: 88JhIU1pUji
--HG--
rename : security/manager/ssl/tests/unit/test_cert_eku/ee-int-nsSGC.pem.certspec => security/manager/ssl/tests/unit/test_cert_eku/ee-int-nsSGC-recent.pem.certspec
rename : security/manager/ssl/tests/unit/test_cert_eku/int-nsSGC.pem.certspec => security/manager/ssl/tests/unit/test_cert_eku/int-nsSGC-recent.pem.certspec
extra : rebase_source : 2f6251679a6f31cccb6d88bb51c567de9cc9bc76
2016-05-05 16:11:11 -07:00
128f004a1f
Bug 1267905 - Replace uses of ScopedCERTCertList with UniqueCERTCertList. r=keeler
...
ScopedCERTCertList is based on Scoped.h, which is deprecated in favour of the
standardised UniquePtr.
Also changes CERTCertList parameters of various functions to make ownership more
explicit.
MozReview-Commit-ID: EXqxTK6inqy
--HG--
extra : transplant_source : %9B%A9a%94%D1%7E%2BTa%9E%9Fu%9F%02%B3%1AT%1B%F1%F6
2016-05-05 14:56:36 -07:00
372fe1a598
Bug 1260643 - Convert most uses of ScopedCERTCertificate in PSM to UniqueCERTCertificate. r=keeler
...
MozReview-Commit-ID: JnjoUd7d2M0
--HG--
extra : transplant_source : %99x%B6%F5%09%97%E6%60%B6%3C%3C%C2%D5vt%27%0C-%96%1B
2016-04-20 01:14:22 -07:00
6e4140d766
bug 1245280 - add policy mechanism to optionally enforce BRs for falling back to subject CN r=Cykesiopka,mgoodwin
...
MozReview-Commit-ID: 7xT6JGpOH1g
--HG--
extra : rebase_source : 0def29e8be898a2d975ee4390b3bc6a193766b1b
2016-02-09 10:14:27 -08:00
2f0004e1be
bug 1228175 - fix IsCertBuiltInRoot r=Cykesiopka,mgoodwin
...
When a built-in root certificate has its trust changed from the default value,
the platform has to essentially create a copy of it in the read/write
certificate database with the new trust settings. At that point, the desired
behavior is that the platform still considers that certificate a built-in root.
Before this patch, this would indeed happen for the duration of that run of the
platform, but as soon as it restarted, the certificate in question would only
appear to be from the read/write database, and thus was not considered a
built-in root. This patch changes the test of built-in-ness to explicitly
search the built-in certificate slot for the certificate in question. If found,
it is considered a built-in root.
MozReview-Commit-ID: HCtZpPQVEGZ
--HG--
extra : rebase_source : 759e9c5a7bb14f14a77e62eae2ba40c085f04ccd
2016-03-04 17:06:33 -08:00
113252b726
bug 1239455 - rework telemetry for SHA-1 certificates to reflect possible policy states r=Cykesiopka,mgoodwin,rbarnes
...
Before this patch, we were measuring where SHA-1 was being used in TLS
certificates: nowhere, in end-entities, in intermediates, or in both. However,
the possible SHA-1 policies don't differentiate between end-entities and
intermediates and instead depended on whether or not each certificate has a
notBefore value after 2015 (i.e. >= 0:00:00 1 January 2016 UTC). We need to
gather telemetry on the possible policy configurations.
--HG--
extra : rebase_source : 301c821c8de16ffb924cd198dd0a4d3139536019
2016-01-13 12:50:42 -08:00
31adb1a5c5
Bug 901698 - Implement OCSP-must-staple; r=keeler
2015-11-13 16:49:08 +00:00
990593f9cf
Bug 942515 - Show Untrusted Connection Error for SHA-1-based SSL certificates with notBefore >= 2016-01-01 r=keeler
2015-09-11 14:52:30 -04:00
f2b116c0d6
Bug 1153444 - Fix up Key Pinning Telemetry (r=keeler)
2015-08-21 15:14:08 +01:00
91782dab68
Bug 1159155 - Add telemetry probe for SHA-1 usage (r=keeler)
2015-07-09 07:22:29 +01:00
0a9aea4ab2
Bug 1145679 - Reject EV status for end-entity EV certs with overly long validity periods. r=keeler
...
--HG--
extra : rebase_source : ec44bb566cce8ab14f740457d6ba1d863b39c256
2015-06-29 22:19:00 +02:00
8a4bc22436
Bug 1010068 - Disable OCSP for DV certificates in Firefox for Android r=keeler
2015-05-28 13:29:13 -07:00
56574135d1
Backed out changeset fda85020d842 (bug 1010068) for Android test_cert_overrides.js failures.
...
CLOSED TREE
2015-06-08 11:37:33 -04:00
3824033dee
Bug 1010068 - Disable OCSP for DV certificates in Firefox for Android r=keeler
2015-05-28 13:29:13 -07:00
4e7fc3055e
bug 1141189 - implement skipping expensive revocation checks (OCSP fetching) for short-lived certificates r=rbarnes
2015-04-06 16:10:28 -07:00
d01ea02613
bug 1049740 - implement telemetry to measure compatibility impact of 2048-bit-minimum RSA keys r=briansmith
2015-02-24 15:48:05 -08:00
3cda0706de
Bug 1092398 - "remove unused CertVerifier enums (missing_cert_download_config and crl_download_config)". r=honzab.moz
2015-01-23 06:17:00 +01:00
0cd5238974
Bug 1107666: Fix OCSP stapling telemetry (SSL_OCSP_STAPLING), r=keeler
...
--HG--
extra : rebase_source : 926f091b2a361d7dce30bee918d6659259f1b3e4
2014-12-11 23:22:35 -08:00
fd860abf57
bug 1071308 - (2/2) remove libpkix-style chain validation callback from CertVerifier r=cviecco
2014-09-25 11:18:56 -07:00
863d5f9477
bug 1071308 - (1/2) rename pinning_enforcement_level to PinningMode for brevity r=cviecco
2014-09-25 11:08:36 -07:00
c1853c5db4
bug 1050546 - telemetry for baseline requirements sections 9.2.1 and 9.2.2 (subject alt names/common name) r=rbarnes
2014-09-03 11:44:08 -07:00
c0770e9a92
Backed out 1 changesets (bug 1050546) for build bustage
...
Backed out changeset c7a9e8177202 (bug 1050546)
2014-09-02 16:49:51 -07:00
18cd42500e
bug 1050546 - telemetry for baseline requirements sections 9.2.1 and 9.2.2 (subject alt names/common name) r=rbarnes
2014-09-02 12:10:47 -07:00
1f84bc411b
bug 1049095 - re-verify joinee certificate with joining hostname when joining connections r=briansmith r=mcmanus r=cviecco r=mmc r=rbarnes
2014-08-21 10:37:23 -07:00
0ccaf0860c
Bug 1043041: Use mozilla::pkix::Time instead of PRTime, r=keeler
...
--HG--
extra : rebase_source : 2cc39d3c322c1355aad003f2497659a091febac2
2014-08-02 08:49:12 -07:00
3f110246be
Bug 1035009: Stop using CERTCertList in mozilla::pkix, r=keeler
...
--HG--
extra : rebase_source : fc2b39e5e2b44fea365914e83a7d1f2dc9b784bc
extra : histedit_source : b40e5e8cb106fe87f6f065b01ca43adb0bf3a605
2014-07-06 15:55:38 -07:00
2d9e74e8ee
Bug 975229: Remove NSS-based certificate verification, r=keeler
...
--HG--
extra : rebase_source : 49cb20f1b51e2d9993a35decd820764e20ad9be9
2014-06-16 23:13:29 -07:00
7683ced05a
Bug 1011269: Add CertVerifier::pinningEnforceTestMode (r=keeler)
2014-05-19 13:04:40 -07:00
a54a4f05cf
Bug 744204 - Allow Certificate key pinning Part 2 - Certverifier Interface. r=keeler
...
--HG--
extra : rebase_source : 2f9748ba0b241c697e22b7ff72f2f5a0fad4a2ca
2014-02-05 14:49:10 -08:00
b1405bc489
bug 985201 - rename insanity::pkix to mozilla::pkix r=cviecco r=briansmith
...
--HG--
rename : security/insanity/include/insanity/ScopedPtr.h => security/pkix/include/pkix/ScopedPtr.h
rename : security/insanity/include/insanity/bind.h => security/pkix/include/pkix/bind.h
rename : security/insanity/include/insanity/nullptr.h => security/pkix/include/pkix/nullptr.h
rename : security/insanity/include/insanity/pkix.h => security/pkix/include/pkix/pkix.h
rename : security/insanity/include/insanity/pkixtypes.h => security/pkix/include/pkix/pkixtypes.h
rename : security/insanity/lib/pkixbind.cpp => security/pkix/lib/pkixbind.cpp
rename : security/insanity/lib/pkixbuild.cpp => security/pkix/lib/pkixbuild.cpp
rename : security/insanity/lib/pkixcheck.cpp => security/pkix/lib/pkixcheck.cpp
rename : security/insanity/lib/pkixcheck.h => security/pkix/lib/pkixcheck.h
rename : security/insanity/lib/pkixder.cpp => security/pkix/lib/pkixder.cpp
rename : security/insanity/lib/pkixder.h => security/pkix/lib/pkixder.h
rename : security/insanity/lib/pkixkey.cpp => security/pkix/lib/pkixkey.cpp
rename : security/insanity/lib/pkixocsp.cpp => security/pkix/lib/pkixocsp.cpp
rename : security/insanity/lib/pkixutil.h => security/pkix/lib/pkixutil.h
rename : security/insanity/moz.build => security/pkix/moz.build
rename : security/insanity/test/lib/moz.build => security/pkix/test/lib/moz.build
rename : security/insanity/test/lib/pkixtestutil.cpp => security/pkix/test/lib/pkixtestutil.cpp
rename : security/insanity/test/lib/pkixtestutil.h => security/pkix/test/lib/pkixtestutil.h
2014-03-20 14:29:21 -07:00
5e64bb5ea4
bug 915932 - cache OCSP responses when using insanity::pkix r=cviecco r=briansmith
2014-03-12 13:08:48 -07:00
485e9d1aab
Bug 921885: Use insanity::pkix for EV cert verification when insanity::pkix is the selected implementation, r=cviecco, r=keeler
...
--HG--
extra : rebase_source : b1fd1f8eace675484b3c2d568e5e74f767f1d2ad
2014-02-23 22:15:53 -08:00
46ac0ca312
Bug 915931, Part 3: Integrate insanity::pkix OCSP support, r=keeler, r=cviecco
...
--HG--
extra : rebase_source : 4b54682ca6d97e2ec7709b9a5c93ddea71126f8b
2014-02-16 17:35:40 -08:00
6195eb652a
Bug 878932, Part 1: add insanity::pkix as an option for certificate verification, r=keeler, r=cviecco
...
--HG--
extra : rebase_source : c1f75dff6ac7f32e082517af701654abebaee250
2014-02-10 11:41:12 -08:00
7257212a64
Bug 962833: ensure-certverify-returns secfailure on MUST_BE_EV and no ev certificate. r=dkeeler
2014-01-24 13:57:35 -08:00
9d23ee7fc7
Bug 891066, Part 8: Add stapled OCSP response to CertVerifier, r=cviecco
...
--HG--
extra : rebase_source : ffe0762228d1217cb51e2f8fad2e0605d7d61344
extra : source : f721d60b6bf74467381590457ce3542f83a2f43a
2013-09-27 19:53:36 -07:00
12a2ffda37
Bug 891066, Part 7: Give CertVerifier its own NSPR logging module, r=cviecco
...
--HG--
extra : rebase_source : a6b38c4026fe70c9789cbe4830df57c943382f5b
extra : source : 591daff856840016c979ed9b4fdbed4ed68f22a6
2013-07-10 23:47:09 -07:00
213974a8d4
Bug 891066, Part 6: Move SSL server cert verification logic to security/certverifier, r=cviecco
...
--HG--
extra : rebase_source : e30b5b46e075c52651bb5320b17660f85a50abbb
extra : source : ef41444d0a7d1f6697c7a4d431fffe8db1724605
2013-07-08 16:30:59 -07:00
4488103b73
Bug 891066, Part 5: Switch to security::pkix::ScopedCERTCertList, r=cviecco
...
--HG--
extra : rebase_source : 59015f864e612f18a2f7bb62092b692ae8d47853
extra : source : 31f68b8a192b45720fe931176cdc0565e8c6fd80
2014-01-22 17:13:19 -08:00
3091f37853
Bug 891066, Part 3: Move more initialization of NSS to security/certverifier, r=keeler
...
--HG--
extra : rebase_source : 33aad105028f849d0bbe1c37b60eab50f2f22c88
2014-01-20 22:10:33 -08:00
c1583f22ce
Bug 891066, part 2: Move CertVerifier to security/certverifier, r=keeler
...
--HG--
extra : rebase_source : dd59a391825b776b075e855660c2488105e2d741
2014-01-26 19:36:28 -08:00
Jan de Mooij
Jonathan Hao
Cykesiopka
Sergei Chernov
David Keeler
Sebastian Hengst
Mark Goodwin
Richard Barnes
Ryan VanderMeulen
TheKK
Brian Smith
Wes Kocher
Monica Chew
Camilo Viecco