1456112 - Add a pref value to implement the Firefox 63 Symantec distrust algorithm

Status: RESOLVED FIXED

(Core :: Security: PSM, enhancement, P1)

Description

[J.C. Jones [:jcj] (he/him)]

Per the consensus plan for the Symantec distrust [1], in Firefox 63 we will remove the logic that continues to trust certificates issued on or after 1 June 2016. This bug is to add that logic into the security.pki.distrust_ca_policy preference.


[1] https://groups.google.com/forum/#!topic/mozilla.dev.security.policy/FLHRT79e3XE/discussion

Comment 1

[Phabricator Automation]

Attachment: Bug 1456112 - Add a pref to implement the last Symantec Distrust step r?keeler

This adds another preference (DistrustSymantecRootsRegardlessOfDate == 2) that
stops permitting certificates issued after 1 June 2016, and updates the test to
check it.

Comment 2

[Phabricator Automation]

Comment on attachment 8973794 [details]
Bug 1456112 - Add a pref to implement the last Symantec Distrust step r?keeler

David Keeler [:keeler] (use needinfo) has approved the revision.

https://phabricator.services.mozilla.com/D1150

Comment 3

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/96c17e4d2d9e
Add a pref to implement the last Symantec Distrust step r=keeler

Comment 4

[Phabricator Automation]

Attachment: Bug 1441914 - Make security.pki.distrust_ca_policy a bitmask r?fkiefer

Per Bug 1437754 comment 10, the pref security.pki.distrust_ca_policy makes more
sense as a bitmask than a state. To permit future nuance, let's go ahead and do
that before people start implementing atop Bug 1456112.

This does permit both 0b10 and 0b11 to enable the functionality for Firefox 63.

Comment 5

[Arthur Iakab [arthur_iakab]]

https://hg.mozilla.org/mozilla-central/rev/96c17e4d2d9e

Comment 6

[J.C. Jones [:jcj] (he/him)]

To use the 63 Symantec distrust settings early, set the preference "security.pki.distrust_ca_policy" to 2. That will be the default in 63.

Marking for a relnote and that this is behind a pref.

Matt: we'll submit a PI request to do periodic canary runs with this preference set.

Comment 7

[Ritu Kothari (:ritu) (Inactive, please n-i to RyanVM, jcristau, or pascal)]

Added to Firefox 62 release notes.