1171557 - convert test_cert_trust.js to generate certificates at build time

Status: RESOLVED FIXED

(Core :: Security: PSM, defect)

Description

[Dana Keeler (she/her) (use needinfo) [:keeler] (on leave)]

test_cert_trust.js is one of the PSM tests we need to convert to use the new build-time certificate generation system. It should also use certificates that are more realistic with respect to the Baseline Requirements. In particular, the root certificate is not supposed to have an extended key usage extension while the end-entity certificate is. This depends on bug 969985 because otherwise there would be merge conflicts in security/manager/ssl/tests/unit/moz.build.

Comment 1

[Dana Keeler (she/her) (use needinfo) [:keeler] (on leave)]

Attachment: MozReview Request: bug 1171557 - convert test_cert_trust.js to generate certificates at build time

bug 1171557 - convert test_cert_trust.js to generate certificates at build time

Comment 2

[Dana Keeler (she/her) (use needinfo) [:keeler] (on leave)]

Attachment: MozReview Request: bug 1171557 - make test_cert_trust.js certs a bit more realistic

bug 1171557 - make test_cert_trust.js certs a bit more realistic

According to the Baseline Requirements, root certificates MUST NOT
have the extendedKeyUsage extension. The extension is optional for
intermediates and required for end-entity certificates. This change
modifies the test certificates so they're more in line with the BRs.

Comment 3

[Mark Goodwin [:mgoodwin]]

Comment on attachment 8616223 [details]
MozReview Request: bug 1171557 - convert test_cert_trust.js to generate certificates at build time

https://reviewboard.mozilla.org/r/10441/#review9221

Looks good to me!

Comment 4

[Mark Goodwin [:mgoodwin]]

Comment on attachment 8616224 [details]
MozReview Request: bug 1171557 - make test_cert_trust.js certs a bit more realistic

https://reviewboard.mozilla.org/r/10443/#review9223

I'm a little unclear as to why some of these error codes change, but since the tests still test the right things, I'm OK with this.

Comment 5

[Pulsebot]

https://hg.mozilla.org/integration/mozilla-inbound/rev/8ac66e2b39b0
https://hg.mozilla.org/integration/mozilla-inbound/rev/08fc6655e2da

Comment 6

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/8ac66e2b39b0
https://hg.mozilla.org/mozilla-central/rev/08fc6655e2da