1228451 - Set the short-lived lifetime to the max OCSP response lifetime

Status: RESOLVED FIXED

(Core :: Security: PSM, defect)

Description

[Mark Goodwin [:mgoodwin]]

The maximum OCSP response lifetime is 10 days.

Comment 1

[Mark Goodwin [:mgoodwin]]

Attachment: MozReview Request: Bug 1228451 - Set short-lived cert lifetime to the max OCSP response lifetime. r?keeler

Bug 1228451 - Set short-lived cert lifetime to the max OCSP response lifetime. r?keeler

Comment 2

[Dana Keeler (she/her) (use needinfo) [:keeler]]

Comment on attachment 8692675 [details]
MozReview Request: Bug 1228451 - Set short-lived cert lifetime to the max OCSP response lifetime. r?keeler

https://reviewboard.mozilla.org/r/26301/#review24035

::: modules/libpref/init/all.js:1999
(Diff revision 1)
> +pref("security.pki.cert_short_lifetime_in_days", 10);

Hmmm - it looks like the TLS/PKI security prefs are split between this file and netwerk/base/security-prefs.js (with most of them being in the latter). I think it would be best if they were in one place, so let's put this pref in security-prefs.js and move the rest of them in a follow-up bug.

Comment 3

[Mark Goodwin [:mgoodwin]]

https://treeherder.mozilla.org/#/jobs?repo=try&revision=3fe739c7d448

Comment 4

[Mark Goodwin [:mgoodwin]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/ed2b80d144f9eaf50d68cfeb68d613671ef5eb52
Bug 1228451 - Set short-lived cert lifetime to the max OCSP response lifetime. r=keeler

Comment 5

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/mozilla-central/rev/ed2b80d144f9