1356623 - remove CNNIC whitelist

Status: RESOLVED FIXED

(Core :: Security: PSM, enhancement, P1)

Description

[Dana Keeler (she/her) (use needinfo) [:keeler]]

Now that we've disabled SHA-1, a number of CNNIC certificates can be removed from the whitelist. At the same time, we can remove some expired ones.

Comment 1

[Dana Keeler (she/her) (use needinfo) [:keeler]]

Actually, doing this results in 41 entries on the whitelist, so I'm morphing this bug to just remove the list and associated machinery once the roots have been removed from NSS.

Comment 2

[Dana Keeler (she/her) (use needinfo) [:keeler]]

Attachment: bug 1356623 - remove now-unnecessary CNNIC certificate whitelist

As a result of CNNIC issuing an unconstrained intermediate certificate that
misissued an end-entity certificate for google.com (see bug 1146026 and
bug 1177209), we implemented a system that would in theory enable Firefox to
continue to trust certificates that were valid at the time but not newly issued
certificates. This consisted of a whitelist added in bug 1151512. The CNNIC
roots have since been removed from NSS in bug 1380868. We can now remove the
whitelist in Firefox.

Review commit: https://reviewboard.mozilla.org/r/164692/diff/#index_header
See other reviews: https://reviewboard.mozilla.org/r/164692/

Comment 3

[J.C. Jones [:jcj] (he/they)]

Comment on attachment 8893606 [details]
bug 1356623 - remove now-unnecessary CNNIC certificate whitelist

https://reviewboard.mozilla.org/r/164692/#review170122

Comment 4

[Dana Keeler (she/her) (use needinfo) [:keeler]]

Thanks!

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/ec588b600d32
remove now-unnecessary CNNIC certificate whitelist r=jcj

Comment 6

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

https://hg.mozilla.org/mozilla-central/rev/ec588b600d32