1289885 - Enable VeriSign Class 3 Public PCA - G4 for EV in PSM

Status: RESOLVED FIXED

(Core :: Security: PSM, enhancement, P1)

Description

[Kathleen Wilson]

Per Bug #833974 the request from Symantec has been approved to enable the following root certificate for EV use. Please make the corresponding changes to PSM. 
	 
Friendly Name: VeriSign Class 3 Public Primary Certification Authority - G4
SHA-1 Fingerprint: 22:D5:D8:DF:8F:02:31:D1:8D:F7:9D:B7:CF:8A:2D:64:C9:3F:6C:3A
SHA-256 Fingerprint: 	69:DD:D7:EA:90:BB:57:C9:3E:13:5D:C8:5E:A6:FC:D5:48:0B:60:32:39:BD:C4:54:FC:75:8B:2A:26:CF:7F:79
EV Policy OIDs: 
2.16.840.1.113733.1.7.23.6
2.23.140.1.1
Test URL: https://ssltest35.ssl.symclab.com/

This root certificate was included in NSS 3.12.6 and Firefox 3.6.2.

Comment 1

[Kathleen Wilson]

Steve or Rick, Please confirm that the information in this bug is correct.

Comment 2

[Steven Medin]

I confirm the name, fingerprints and test URL. I confirm the Symantec EV OID from our arc. 

At this time, aligned to CABF EVG 9.3.2, we specify our own EV policy identifier and do not include the CABF EV policy identifier. We may add the CABF OID in the future and would therefore appreciate its recognition along with our own OID.

Comment 3

[Dana Keeler (she/her) (use needinfo) [:keeler]]

Attachment: bug 1289885 - Enable VeriSign Class 3 Public PCA - G4 for EV in PSM

Review commit: https://reviewboard.mozilla.org/r/67488/diff/#index_header
See other reviews: https://reviewboard.mozilla.org/r/67488/

Comment 4

[J.C. Jones [:jcj] (he/they)]

Comment on attachment 8775314 [details]
bug 1289885 - Enable VeriSign Class 3 Public PCA - G4 for EV in PSM

https://reviewboard.mozilla.org/r/67488/#review64664

R+, matches the cert in question. Note that in https://bugzilla.mozilla.org/show_bug.cgi?id=1289885#c2 they actually ask for a second OID to be registered, which this data structure doesn't support. I guess there's nothing we can do for that request at this time?

Comment 5

[Kathleen Wilson]

(In reply to Steven Medin from comment #2)
> I confirm the name, fingerprints and test URL. I confirm the Symantec EV OID
> from our arc. 
> 
> At this time, aligned to CABF EVG 9.3.2, we specify our own EV policy
> identifier and do not include the CABF EV policy identifier. We may add the
> CABF OID in the future and would therefore appreciate its recognition along
> with our own OID.


Steve, Do you ever plan to issue SSL certs in this CA hierarchy without the 2.16.840.1.113733.1.7.23.6 OID?
i.e. with *only* the CABF EV OID.

Comment 6

[Steven Medin]

Absolutely, and while the test URL provided shows a certificate that only contains our OID, we are currently issuing EV certificates with both until all browsers accept the CABF OID. We need our OID supported for legacy certs.

If only one can be recognized at this time, then we would need our OID to be that one. Once two can be supported, we would want the CABF OID recognized as well. We will stop using our OID once we can.

Comment 7

[Dana Keeler (she/her) (use needinfo) [:keeler]]

It's looking like it will be easier to enable the CABF OID for all EV roots at the same time rather than one at a time. That work will happen in bug 1243923.

Comment 8

[Steven Medin]

Makes sense, and if it doesn't require an additional request we'll wait for that bug.  For now, let's go with our own OID.

Comment 9

[Dana Keeler (she/her) (use needinfo) [:keeler]]

Ok - sounds good. My understanding is when bug 1243923 is completed, all EV roots will be enabled for the CABF OID with no extra requests necessary.

Kathleen, the build that enables the Symantec OID for this root should be available at https://archive.mozilla.org/pub/firefox/try-builds/[e-mail]-b0ff3f141e2d6f008a75f293214d46550315cf53/try-macosx64/ - can you confirm this works as expected? Thanks!

Comment 10

[Kathleen Wilson]

(In reply to David Keeler [:keeler] (use needinfo?) from comment #9)
> Kathleen, the build that enables the Symantec OID for this root should be
> available at
> https://archive.mozilla.org/pub/firefox/try-builds/[e-mail]-
> b0ff3f141e2d6f008a75f293214d46550315cf53/try-macosx64/ - can you confirm
> this works as expected? Thanks!

Tested. Works as expected -- https://ssltest35.ssl.symclab.com/ gets EV treatment.

Thanks!

Comment 11

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/84f4017ae85f
Enable VeriSign Class 3 Public PCA - G4 for EV in PSM r=jcj

Comment 12

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/84f4017ae85f