1460062 - Enforce Symantec distrust in Firefox 63

Status: RESOLVED FIXED

(Core :: Security: PSM, defect, P1)

Description

[J.C. Jones [:jcj] (he/him)]

Similar to Bug 1442075, this bug is to change the default of the "security.pki.distrust_ca_policy" pref to the value of 2, introduced in Bug 1456112. This change should happen in the Firefox 63 branch.

Comment 1

[Julien Cristau [:jcristau] (back April 22)]

We should add this to 63 release notes.

Comment 2

[Wayne Thayer]

Canary went live with this enabled somewhere around 31-July. We should make this change in Nightly sometime around 10-13 August.

It should not ride the train to Beta initially. @pascalc suggested that we implement this as follows:

you don't need to revert it in beta, you can use an ifdef statement with the NIGHTLY_BUILD define
so as that the feature only targets nightly and does not affect beta.
Here is an example in our code:
https://searchfox.org/mozilla-central/source/browser/app/profile/firefox.js#1426-1430


Then during the 64 nightly cycle, the week of September 17, you remove
the ifdef statement and ask in bug 1460062 an uplift of this patch to 63
beta 9 which is planned for September 25.

Comment 3

[Dana Keeler (she/her) (use needinfo) [:keeler] (on leave)]

Attachment: bug 1460062 - Enforce Symantec distrust in Firefox 63 r?franziskus

This patch implements the Symantec distrust plan on Nightly only for now.

Comment 4

[Franziskus Kiefer [:franziskus]]

Comment on attachment 8998635 [details]
bug 1460062 - Enforce Symantec distrust in Firefox 63 r?franziskus

Franziskus Kiefer [:fkiefer or :franziskus] has approved the revision.

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/6ef1b4f2756a
Enforce Symantec distrust in Firefox 63 r=franziskus

Comment 6

[Daniel Varga [:dvarga]]

https://hg.mozilla.org/mozilla-central/rev/6ef1b4f2756a

Comment 7

[Kohei Yoshino [:kohei]]

Posted the site compatibility note a while ago: https://www.fxsitecompat.com/en-CA/docs/2018/symantec-geotrust-rapidssl-thawte-verisign-certificates-will-all-be-distrusted-in-october-2018/

Comment 8

[Kohei Yoshino [:kohei]]

Firefox 63 Beta 9 is shipping next Tuesday. Time to request an uplift if Comment 2 is still the plan?

Comment 9

[Wayne Thayer]

We are not yet ready to enable this change in 63 Beta. Chrome has not yet enabled the distrust in their 70 Beta and the breakage caused by this change is still significant: http://tlscanary-plot-8e95d89854d73f4d.elb.us-west-2.amazonaws.com/ We'll continue to monitor this and determine when to move forward, but for now please do not uplift.

Comment 10

[Dana Keeler (she/her) (use needinfo) [:keeler] (on leave)]

(see comment 9)