1418135 - asynchronously determine the certificate chain to display in the details pane of the certificate viewer

Status: RESOLVED FIXED

(Core :: Security: PSM, defect, P1)

Description

[Dana Keeler (she/her) (use needinfo) [:keeler] (on leave)]

The current certificate viewer uses "getChain" to determine what chain to show in the details pane. This is problematic for a number of reasons including a) it's synchronous (and potentially slow) and b) getChain may return something almost entirely quite unlike any actual trusted path.

This won't fix the whole problem (whatever's opening the certificate viewer should really be passing in the chain itself), but that's hard, so this would at least change the determination to be asynchronous and at least won't result in something completely bogus.

Comment 1

[Dana Keeler (she/her) (use needinfo) [:keeler] (on leave)]

Oh and this may fix bug 1409910.

Comment 2

[Dana Keeler (she/her) (use needinfo) [:keeler] (on leave)]

Attachment: bug 1418135 - asynchronously determine the chain to display in the details pane of the certificate viewer

The current certificate viewer uses "getChain" to determine what chain to show
in the details pane. This is problematic for a number of reasons including a)
it's synchronous (and potentially slow) and b) getChain may return something
almost entirely quite unlike any actual trusted path (see bug 1004580 comment
0).

This won't fix the whole problem (whatever's opening the certificate viewer
should really be passing in the chain itself), but that's hard, so this would at
least change the determination to be asynchronous and at least won't result in
something completely bogus.

Review commit: https://reviewboard.mozilla.org/r/200518/diff/#index_header
See other reviews: https://reviewboard.mozilla.org/r/200518/

Comment 3

[Mark Goodwin [:mgoodwin]]

Comment on attachment 8929244 [details]
bug 1418135 - asynchronously determine the chain to display in the details pane of the certificate viewer

https://reviewboard.mozilla.org/r/200518/#review206038

Comment 4

[Dana Keeler (she/her) (use needinfo) [:keeler] (on leave)]

Comment on attachment 8929244 [details]
bug 1418135 - asynchronously determine the chain to display in the details pane of the certificate viewer

Review request updated; see interdiff: https://reviewboard.mozilla.org/r/200518/diff/1-2/

Comment 5

[Dana Keeler (she/her) (use needinfo) [:keeler] (on leave)]

Thanks!
Had to fix up some eslint issues, but otherwise looks good to go: https://treeherder.mozilla.org/#/jobs?repo=try&revision=f350539f454f

Comment 6

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/64a8c43f5b9c
asynchronously determine the chain to display in the details pane of the certificate viewer r=mgoodwin

Comment 7

[Dana Keeler (she/her) (use needinfo) [:keeler] (on leave)]

Hmmm looks like it didn't fix bug 1409910: https://public-artifacts.taskcluster.net/D8dMnVEmTNGabMfdAlz8EQ/0/public/logs/live_backing.log
It's still an improvement, anyway.

Comment 8

[Cristian Brindusan [:cbrindusan]]

https://hg.mozilla.org/mozilla-central/rev/64a8c43f5b9c