1181823 - convert test_ev_certs.js, test_keysize_ev.js, and test_validity.js to generate certificates at build time

Status: RESOLVED FIXED

(Core :: Security: PSM, defect)

Description

[Dana Keeler (she/her) (use needinfo) [:keeler]]

convert test_ev_certs.js to generate certificates at build time - see bug 1174288.
One issue is that the hash of the root test certificate is hard-coded into the browser in ExtendedValidation.cpp. My current approach is to specify a concrete validity period for the root certificate (rather than basing it on the current time), which (currently) means the same certificate should get generated every build. This may not be the best idea, and we should probably explore other options.

Comment 1

[Dana Keeler (she/her) (use needinfo) [:keeler]]

Attachment: MozReview Request: bug 1181823 - convert test_ev_certs.js, test_keysize_ev.js, and test_validity.js to generate certificates at build time r?Cykesiopka r?mgoodwin

bug 1181823 - convert test_ev_certs.js, test_keysize_ev.js, and test_validity.js to generate certificates at build time r?Cykesiopka r?mgoodwin

Comment 2

[Dana Keeler (she/her) (use needinfo) [:keeler]]

Comment on attachment 8637507 [details]
MozReview Request: bug 1181823 - convert test_ev_certs.js, test_keysize_ev.js, and test_validity.js to generate certificates at build time r?Cykesiopka r?mgoodwin

bug 1181823 - convert test_ev_certs.js, test_keysize_ev.js, and test_validity.js to generate certificates at build time r?Cykesiopka r?mgoodwin

Comment 3

[Dana Keeler (she/her) (use needinfo) [:keeler]]

This ended up being a largish patch. I'm not sure there's a good way to break it up, though, because any change to how the testing EV root certificate works affects multiple tests. Take your time reviewing this and let me know what you think.

Comment 4

[Mark Goodwin [:mgoodwin]]

Comment on attachment 8637507 [details]
MozReview Request: bug 1181823 - convert test_ev_certs.js, test_keysize_ev.js, and test_validity.js to generate certificates at build time r?Cykesiopka r?mgoodwin

https://reviewboard.mozilla.org/r/13863/#review12655

Ship It!

Comment 5

[:Cykesiopka]

Comment on attachment 8637507 [details]
MozReview Request: bug 1181823 - convert test_ev_certs.js, test_keysize_ev.js, and test_validity.js to generate certificates at build time r?Cykesiopka r?mgoodwin

https://reviewboard.mozilla.org/r/13863/#review12753

LGTM.

::: security/manager/ssl/tests/unit/pycert.py:44
(Diff revision 1)
>  generated certificate (for example, its validity period, signature

Nit: remove mention of validity period here, since this is no longer true.

::: security/manager/ssl/tests/unit/test_validity/ev_ee_40_months-ev_int_60_months-evroot.pem.certspec:3
(Diff revision 1)
> +validity:1215

Optional: same here.

::: security/manager/ssl/tests/unit/test_validity/ev_ee_39_months-ev_int_60_months-evroot.pem.certspec:3
(Diff revision 1)
> +validity:1185

Optional: not a big deal, but this doesn't match the 3 * 365 + 3 * 31 logic of the actual code.

Comment 6

[Dana Keeler (she/her) (use needinfo) [:keeler]]

https://reviewboard.mozilla.org/r/13863/#review12753

> Optional: not a big deal, but this doesn't match the 3 * 365 + 3 * 31 logic of the actual code.

I guess it's a good idea to be consistent here.

> Nit: remove mention of validity period here, since this is no longer true.

Good catch.

Comment 7

[Dana Keeler (she/her) (use needinfo) [:keeler]]

https://treeherder.mozilla.org/#/jobs?repo=try&revision=1ad6e909a5f0

Comment 8

[Pulsebot]

https://hg.mozilla.org/integration/mozilla-inbound/rev/6365880a9f9f

Comment 9

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/mozilla-central/rev/6365880a9f9f