1542409 - CCADB entries generated 2019-04-05T15:48:35Z

Status: RESOLVED FIXED

(Core :: Security Block-lists, Allow-lists, and other State, task)

Description

[Wayne Thayer]

Here are some entries: Please ensure that the entries are correct.

Comment 1

[Wayne Thayer]

Attachment: intermediates to be revoked

Here are some entries: Please ensure that the entries are correct.

Comment 2

[Wayne Thayer]

Mark or Kathleen: I had to manually upload the revocations.txt file because salesforce2OneCRL is currently broken. Also, I'm unable to get the kinto-blacklist-entry-checker to run, so please give this an extra careful review.

Comment 3

[Kathleen Wilson]

(In reply to Wayne Thayer [:wayne] from comment #2)

Mark or Kathleen: I had to manually upload the revocations.txt file because salesforce2OneCRL is currently broken. Also, I'm unable to get the kinto-blacklist-entry-checker to run, so please give this an extra careful review.

Please explain what we are supposed to be finding in the attached file. e.g. how many entries, and for which certs.

Note that there are no intermediate certs currently ready to add to OneCRL, so this should only be the specific cert(s) that you are trying to add manually.

https://ccadb-public.secure.force.com/mozilla/PublicInterCertsReadyToAddToOneCRL

Comment 4

[Wayne Thayer]

It should be this one entry, corresponding to bug 1539007:

['issuer: '
'MHUxCzAJBgNVBAYTAlVTMRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsTEHd3dy5kaWdpY2VydC5jb20xNDAyBgNVBAMTK0RpZ2lDZXJ0IFNIQTIgRXh0ZW5kZWQgVmFsaWRhdGlvbiBTZXJ2ZXIgQ0E= '
'serial: BFXgjf2ribj8GNKFDT/8+g==']

Comment 5

[Daniel C]

Is this the bug where the revoked intermediates from https://crt.sh/revoked-intermediates will be added to OneCRL? On that page I currently see 59 intermediates which are revoked but still valid in Firefox (see totals in the final row).

Comment 6

[Wayne Thayer]

No, this bug is a single end-entity revocation. We're experiencing some issues with the process. Once we get them resolved, another bug will be generated the revoked intermediate updates.

Comment 7

[Wayne Thayer]

Attachment: existing and new revocations in the form of a revocations.txt file

Revocations data for new and existing records

Comment 8

[Wayne Thayer]

Attachment: Intermediates to be revoked

Revocations data for new records

Comment 9

[Kathleen Wilson]

Comment on attachment 9061770 [details]
Intermediates to be revoked

I confirm that this has the one expected entry, which matches the cert to be added to OneCRL per Bug #1539007.

Comment 10

[J.C. Jones [:jcj] (he/they)]

Downloading intermediates to be revoked from bug # 1542409

Results:
Pending Kinto Dataset (Found): 872
Added Entries (Expected): 1
[GOOD] Expected But Not Pending (Not Found): 0
Deleted: 0
[GOOD] Entries In Production But Lost Without Being Deleted (Missing): 0

[GOOD] The Expected file matches the change between the staged Kinto and production.
[GOOD] The Kinto dataset found at production equals the union of the expected file and the live list.
Nothing not found.
Nothing deleted.

Comment 11

[Wayne Thayer]

Signed at Kinto and released.

Comment 12

[Kathleen Wilson]

I tried to see if this new entry has been added to OneCRL, using:
curl https://firefox.settings.services.mozilla.com/v1/buckets/blocklists/collections/certificates/records | jq '[.data[] | {enabled,issuerName,serialNumber} | select(.enabled) | del(.enabled)]' > ./revocations-May1-2019.txt

But I don't see the new entry yet.

Comment 13

[J.C. Jones [:jcj] (he/they)]

ugh, <enter> ruined the day again.

Mathieu:

curl https://firefox.settings.services.mozilla.com/v1/buckets/security-state/collections/onecrl/records | jq '[.data[] | {enabled,issuerName,serialNumber} | select(.enabled) | del(.enabled)]'  | grep MHUxCzAJBgNVBAYTAlVTMRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsTEHd3dy5kaWdpY2VydC5jb20xNDAyBgNVBAMTK0RpZ2lDZXJ0IFNIQTIgRXh0ZW5kZWQgVmFsaWRhdGlvbiBTZXJ2ZXIgQ0E

finds the new entry from attachment 9061770 [details].

Kathleen is correct that looking in the buckets/blocklists/collections/certificates does not, so the periodic trigger to clone the data looks to have stalled. Can you confirm?

Comment 14

[Mathieu Leplatre [:leplatrem]]

The lambda was not enabled in PROD :)

Adrian fixed it this morning...

Comment 15

[Kathleen Wilson]

I now see the new entry in
curl https://firefox.settings.services.mozilla.com/v1/buckets/blocklists/collections/certificates/records | jq '[.data[] | {enabled,issuerName,serialNumber} | select(.enabled) | del(.enabled)]' > ./revocations-May6-2019.txt

Not sure how to test if it actually ended up in my Firefox Nightly (i.e. end-to-end testing), but I guess that is a topic for Bug #1548159.

Comment 16

[Wayne Thayer]

I'm not seeing the updates in my local install of 66. revocations.txt was last updated Feb 7th.

Comment 17

[Kathleen Wilson]

Attachment: revocations-May7-2019.txt

Attaching a copy of my revocations.txt file -- I created a new Firefox profile for release on April 30, but revocations.txt wasn't showing up on my system. I ran release again this morning, and revocations.txt showed up at 10:20am. More good news: it has this entry in it.

Comment 18

[Kathleen Wilson]

(In reply to Wayne Thayer [:wayne] from comment #16)

I'm not seeing the updates in my local install of 66. revocations.txt was last updated Feb 7th.

Maybe whatever was stopping revocations.txt from getting updated got fixed yesterday?
So please check tomorrow, and update this bug to let us know if the update shows up.

Comment 19

[Wayne Thayer]

revocations.txt updated on my 66 Release profile at 7:30 AM this morning. It is identical in size to the file attached to this bug, confirming that the update has been successful

Comment 20

[BMO Automation]

Moving bug to Core::Security Block-lists, Allow-lists, and other State.