1397441 - Make sure HPKP preload expiration date is accurate for 57

Status: RESOLVED FIXED

(Core :: Security: PSM, defect, P2)

Description

[Ryan VanderMeulen [:RyanVM]]

Confirm and patch security/manager/ssl/StaticHPKPins.h and security/manager/ssl/nsSTSPreloadList.inc in 57 to have sufficient lifetime on the preloaded HPKP and STS pins.

Going off past precedents, I assume we're going to want an expiration date of around 2018-03-06 to coincide with the release of Fx59.

Comment 1

[Julien Cristau [:jcristau]]

AIUI this can only land after October 24.

Comment 2

[Julien Cristau [:jcristau]]

Attachment: hpkp-57.patch

Comment 3

[Dana Keeler (she/her) [:keeler]]

Comment on attachment 8920999 [details] [diff] [review]
hpkp-57.patch

Review of attachment 8920999 [details] [diff] [review]:
-----------------------------------------------------------------

Thanks!

Comment 4

[Julien Cristau [:jcristau]]

Comment on attachment 8920999 [details] [diff] [review]
hpkp-57.patch

Approval Request Comment
[Feature/Bug causing the regression]: n/a
[User impact if declined]: builtin key pins would expire on December 27, and hsts preload on January 24
[Is this code covered by automated tests?]: yes
[Has the fix been verified in Nightly?]: n/a, beta-only patch
[Needs manual test from QE? If yes, steps to reproduce]: no
[List of other uplifts needed for the feature/fix]: none
[Is the change risky?]: no
[Why is the change risky/not risky?]: just bumping expiration dates
[String changes made/needed]: none

Comment 5

[Ritu Kothari (:ritu) (Inactive, please n-i to RyanVM, jcristau, or pascal)]

Comment on attachment 8920999 [details] [diff] [review]
hpkp-57.patch

Must fix, Beta57+

Comment 6

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-beta/rev/9d9ed1a5d9e9