1138716 - Regenerate PSM data structures affected by February 2015 batch of root changes

Status: RESOLVED FIXED

(Core :: Security: PSM, defect)

Description

[Kathleen Wilson]

Please regenerate the pinning list and notify the corresponding site operators regarding the February 2015 batch of root changes in Bug #1132496

In particular, the following root certificates will either be removed or have their websites trust bit turned off.

Bug #986019
Equifax Secure Certificate Authority
Equifax Secure Global eBusiness CA-1

Bug #1105374
TC TrustCenter Class 3 CA II

Comment 1

[Dana Keeler (she/her) (use needinfo) [:keeler] (on leave)]

AFAICT, the pinning list will automatically pick up the correct changes (no pinsets used the roots that were removed). There are other data structures that need to be updated, however (namely, the root-related telemetry).

Comment 2

[Dana Keeler (she/her) (use needinfo) [:keeler] (on leave)]

Attachment: patch

Comment 3

[Dana Keeler (she/her) (use needinfo) [:keeler] (on leave)]

Thanks!
https://hg.mozilla.org/integration/mozilla-inbound/rev/bcebc84e7238

Comment 4

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/bcebc84e7238

Comment 5

[Dana Keeler (she/her) (use needinfo) [:keeler] (on leave)]

Comment on attachment 8581772 [details] [diff] [review]
patch

Approval Request Comment
[Feature/regressing bug #]: February 2015 root changes (bug 1132496)
[User impact if declined]: root CA telemetry will be inaccurate
[Describe test coverage new/current, TreeHerder]: n/a
[Risks and why]: low
[String/UUID change made/needed]: none

Comment 6

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-aurora/rev/b1f71aee0779