1195615 - Log a web console warning when a HPKP header is ignored due to a non-built in root cert

Status: RESOLVED FIXED

(Core :: Security: PSM, defect)

Description

[:Cykesiopka]

nsSiteSecurityService.cpp silently ignores the PKP header of a site if the cert for the site chained up to a non-built-in root. No error messages appear in either the web or browser console.

Bug 1139505 demonstrates that this is unnecessarily confusing.
A warning should be logged so that it's at least clear why Firefox is ignoring the header.

Comment 1

[:Cykesiopka]

Attachment: MozReview Request: Bug 1195615 - Log a web console warning when a HPKP header is ignored due to a non-built in root cert.

Bug 1195615 - Log a web console warning when a HPKP header is ignored due to a non-built in root cert.

Comment 2

[:Cykesiopka]

Attachment: MozReview Request: Bug 1195615 - Add web console test.

Bug 1195615 - Add web console test.

Comment 3

[Panos Astithas (he/him) [:past] (please ni?)]

Comment on attachment 8649722 [details]
MozReview Request: Bug 1195615 - Add web console test.

https://reviewboard.mozilla.org/r/16477/#review14759

Ship It!

Comment 4

[Dana Keeler (she/her) (use needinfo) [:keeler] (on leave)]

Comment on attachment 8649721 [details]
MozReview Request: Bug 1195615 - Log a web console warning when a HPKP header is ignored due to a non-built in root cert.

https://reviewboard.mozilla.org/r/16475/#review14801

This looks good. It's unfortunate that it's necessary, but I don't really see a better way. My one suggestion would be to include a bit more detail in the error message.

::: dom/locales/en-US/chrome/security/security.properties:44
(Diff revision 1)
> +PKPRootNotBuiltIn=Public-Key-Pins: The certificate used by the site chains up to a root certificate not in the root store, so the specified header was ignored.

Maybe something like "The certificate used by the site was not issued by a certificate in the default root certificate store. To prevent accidental breakage, the specified header was ignored. To disable this protection, set the preference 'security.cert_pinning.process_headers_from_non_builtin_roots' to true." (although I realize how verbose that is...)

Comment 5

[:Cykesiopka]

https://reviewboard.mozilla.org/r/16475/#review14801

> Maybe something like "The certificate used by the site was not issued by a certificate in the default root certificate store. To prevent accidental breakage, the specified header was ignored. To disable this protection, set the preference 'security.cert_pinning.process_headers_from_non_builtin_roots' to true." (although I realize how verbose that is...)

I used the first part, but left out the second part about the pref:
- To make the text shorter
- Because I would rather have people flip that pref as a last resort (but I would still be OK either way)

Comment 6

[:Cykesiopka]

Attachment: bug1195615_add-warning-hpkp-non-built-in-root_v2.patch

+ Update string

Comment 7

[:Cykesiopka]

Attachment: bug1195615_add-warning-hpkp-non-built-in-root_test_v2.patch

+ Update string

Comment 8

[:Cykesiopka]

Thanks for the reviews!

https://treeherder.mozilla.org/#/jobs?repo=try&revision=53242d46fdaf

Comment 9

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/integration/mozilla-inbound/rev/c05219c4736d
https://hg.mozilla.org/integration/mozilla-inbound/rev/0740e34249fe

Comment 10

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/c05219c4736d
https://hg.mozilla.org/mozilla-central/rev/0740e34249fe

Comment 11

[Francesco Lodolo [:flod]]

I'm really confused by "The certificate used by the site was not issued by a certificate in the default root certificate store.".

Can a certificate issue another certificate? As far as I can tell, a "certificate authority" – whose certificate is eventually in the root certificate store – can issue a certificate.

Comment 12

[Dana Keeler (she/her) (use needinfo) [:keeler] (on leave)]

A certificate authority is a certificate. Some certificates can issue other certificates while others can not. It depends on the extensions a certificate has. This might be informative: https://developer.mozilla.org/en-US/docs/Mozilla/Security/x509_Certificates

Comment 13

[Stefan Plewako [:stef]]

(In reply to David Keeler [:keeler] (use needinfo?) from comment #12)
> A certificate authority is a certificate. Some certificates can issue other
> certificates while others can not. It depends on the extensions a
> certificate has. This might be informative:
> https://developer.mozilla.org/en-US/docs/Mozilla/Security/x509_Certificates

I don't find anything indicating that certificate authority is a certificate on https://developer.mozilla.org/en-US/docs/Mozilla/Security/x509_Certificates - could you please clarify or fix PKPRootNotBuiltIn string?

Comment 14

[Stefan Plewako [:stef]]

More on PKPRootNotBuiltIn string ambiguity, is "non-built-in root" (mentioned in a bug) always equal to "default root" (form string) like when users adds cert to the store?

Comment 15

[Dana Keeler (she/her) (use needinfo) [:keeler] (on leave)]

See the basic constraints extension. The rfc may also be informative: https://tools.ietf.org/html/rfc5280#section-4.2.1.9

When a user adds a certificate authority to the certificate database, that certificate is a "non-built-in root". This is in contrast to the "default roots" or "built-in roots" that ship with the browser.