1252142 - Revoke exceptional SHA-1 certificates

Status: RESOLVED FIXED

(Toolkit :: Blocklist Policy Requests, defect)

Description

[Mark Goodwin [:mgoodwin]]

Please add the following 7 entries to the certificate blocklist (as per the discussion in this thread: https://groups.google.com/forum/#!topic/mozilla.dev.security.policy/RHBHXJOG8Io)


issuer is: MIG8MQswCQYDVQQGEwJVUzEXMBUGA1UEChMOVmVyaVNpZ24sIEluYy4xHzAdBgNVBAsTFlZlcmlTaWduIFRydXN0IE5ldHdvcmsxOzA5BgNVBAsTMlRlcm1zIG9mIHVzZSBhdCBodHRwczovL3d3dy52ZXJpc2lnbi5jb20vcnBhIChjKTEwMTYwNAYDVQQDEy1WZXJpU2lnbiBDbGFzcyAzIEludGVybmF0aW9uYWwgU2VydmVyIENBIC0gRzM=
serial is: By7fBTreouRwX/qrpgSUsg==

issuer is: MIG8MQswCQYDVQQGEwJVUzEXMBUGA1UEChMOVmVyaVNpZ24sIEluYy4xHzAdBgNVBAsTFlZlcmlTaWduIFRydXN0IE5ldHdvcmsxOzA5BgNVBAsTMlRlcm1zIG9mIHVzZSBhdCBodHRwczovL3d3dy52ZXJpc2lnbi5jb20vcnBhIChjKTEwMTYwNAYDVQQDEy1WZXJpU2lnbiBDbGFzcyAzIEludGVybmF0aW9uYWwgU2VydmVyIENBIC0gRzM=
serial is: Gd/pPu+qLnXUdvP9sW73CQ==

issuer is: MIG8MQswCQYDVQQGEwJVUzEXMBUGA1UEChMOVmVyaVNpZ24sIEluYy4xHzAdBgNVBAsTFlZlcmlTaWduIFRydXN0IE5ldHdvcmsxOzA5BgNVBAsTMlRlcm1zIG9mIHVzZSBhdCBodHRwczovL3d3dy52ZXJpc2lnbi5jb20vcnBhIChjKTEwMTYwNAYDVQQDEy1WZXJpU2lnbiBDbGFzcyAzIEludGVybmF0aW9uYWwgU2VydmVyIENBIC0gRzM=
serial is: LdbnCbsA9sOgI4mkUpWXPw==

issuer is: MIG8MQswCQYDVQQGEwJVUzEXMBUGA1UEChMOVmVyaVNpZ24sIEluYy4xHzAdBgNVBAsTFlZlcmlTaWduIFRydXN0IE5ldHdvcmsxOzA5BgNVBAsTMlRlcm1zIG9mIHVzZSBhdCBodHRwczovL3d3dy52ZXJpc2lnbi5jb20vcnBhIChjKTEwMTYwNAYDVQQDEy1WZXJpU2lnbiBDbGFzcyAzIEludGVybmF0aW9uYWwgU2VydmVyIENBIC0gRzM=
serial is: NMpMcEnex3eXx4ohk9glcQ==

issuer is: MIG8MQswCQYDVQQGEwJVUzEXMBUGA1UEChMOVmVyaVNpZ24sIEluYy4xHzAdBgNVBAsTFlZlcmlTaWduIFRydXN0IE5ldHdvcmsxOzA5BgNVBAsTMlRlcm1zIG9mIHVzZSBhdCBodHRwczovL3d3dy52ZXJpc2lnbi5jb20vcnBhIChjKTEwMTYwNAYDVQQDEy1WZXJpU2lnbiBDbGFzcyAzIEludGVybmF0aW9uYWwgU2VydmVyIENBIC0gRzM=
serial is: JV/LVzSKI/wsDgg3UuZHlA==

issuer is: MIG8MQswCQYDVQQGEwJVUzEXMBUGA1UEChMOVmVyaVNpZ24sIEluYy4xHzAdBgNVBAsTFlZlcmlTaWduIFRydXN0IE5ldHdvcmsxOzA5BgNVBAsTMlRlcm1zIG9mIHVzZSBhdCBodHRwczovL3d3dy52ZXJpc2lnbi5jb20vcnBhIChjKTEwMTYwNAYDVQQDEy1WZXJpU2lnbiBDbGFzcyAzIEludGVybmF0aW9uYWwgU2VydmVyIENBIC0gRzM=
serial is: COwoDFvz7GD8R2K7Lo0rYQ==

issuer is: MIG8MQswCQYDVQQGEwJVUzEXMBUGA1UEChMOVmVyaVNpZ24sIEluYy4xHzAdBgNVBAsTFlZlcmlTaWduIFRydXN0IE5ldHdvcmsxOzA5BgNVBAsTMlRlcm1zIG9mIHVzZSBhdCBodHRwczovL3d3dy52ZXJpc2lnbi5jb20vcnBhIChjKTEwMTYwNAYDVQQDEy1WZXJpU2lnbiBDbGFzcyAzIEludGVybmF0aW9uYWwgU2VydmVyIENBIC0gRzM=
serial is: VOcIuNbTqkpOMUyI108FOg==

Comment 1

[Mark Goodwin [:mgoodwin]]

Hi, Andrew, can I have an ETA on this, please?

Comment 2

[Andrew Williamson [:eviljeff]]

All blocked now.

Comment 3

[Mark Goodwin [:mgoodwin]]

Thanks.

Comment 4

[Doug Turner (:dougt)]

Andrew, can we reference the code change in this bug for reference?  Thanks.

Comment 5

[Andrew Williamson [:eviljeff]]

There wasn't a code change, and cert blocks don't have publicly accessible detail pages, but these are the urls to the admin model pages (only admins on amo will be able to access):
https://addons.mozilla.org/en-US/admin/models/blocklist/blocklistdetail/1130/
https://addons.mozilla.org/en-US/admin/models/blocklist/blocklistdetail/1131/
https://addons.mozilla.org/en-US/admin/models/blocklist/blocklistdetail/1132/
https://addons.mozilla.org/en-US/admin/models/blocklist/blocklistdetail/1133/
https://addons.mozilla.org/en-US/admin/models/blocklist/blocklistdetail/1134/
https://addons.mozilla.org/en-US/admin/models/blocklist/blocklistdetail/1135/

Comment 6

[Andrew Williamson [:eviljeff]]

forgot this one:
https://addons.mozilla.org/en-US/admin/models/blocklist/blocklistdetail/1127/

Comment 7

[Rémy Hubscher (:natim)]

Note that for https://addons.mozilla.org/en-US/admin/models/blocklist/blocklistdetail/1127/ the ``issuerName`` have got a trailing \r\n at the end that should be removed.

Comment 8

[Andrew Williamson [:eviljeff]]

(In reply to Rémy Hubscher (:natim) from comment #7)
> Note that for
> https://addons.mozilla.org/en-US/admin/models/blocklist/blocklistdetail/1127/
> the ``issuerName`` have got a trailing \r\n at the end that should be
> removed.

Done.

Comment 9

[Rémy Hubscher (:natim)]

Thanks :)