1530545 - Store Preloaded Intermediates in cert_storage

Status: RESOLVED FIXED

(Core :: Security: PSM, enhancement, P1)

Description

[J.C. Jones [:jcj] (he/him)]

Intermediate Preloading in Bug 657228 stores the downloaded CAs in NSS' DB, which has some performance issues. The new Rust cert_storage module is much faster, and since CA cert lookups are in a hot-path for all TLS connections, we should prefer the new module.

Comment 1

[Dana Keeler (she/her) (use needinfo) [:keeler] (on leave)]

Attachment: bug 1530545 - store preloaded intermediates in cert_storage r?mgoodwin

This updates cert_storage to be able to store certificates indexed by subject DN
for easy lookup by NSSCertDBTrustDomain during path building. This also updates
RemoteSecuritySettings to store newly-downloaded preloaded intermediates in
cert_storage.

Comment 2

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/70463f459a9c
store preloaded intermediates in cert_storage r=mgoodwin,myk

Comment 3

[Stefan Hindli [:stefan_hindli]]

https://hg.mozilla.org/mozilla-central/rev/70463f459a9c