1560353 - Cert verification cache

Status: RESOLVED FIXED

(Core :: Security: PSM, enhancement, P1)

Comment 1

[Dragana Damjanovic [:dragana]]

We want to remove call to VerifySSLServerCert( in this line). For this we will need:

• use TLS session cache implemented in necko instead the one implemented in nss. Currently this cache is not used.
• we will extend that cache to add information that function RebuildVerifiedCertificateInformation gets from VerifySSLServerCert. (Background: when we have a session resumption, we do not call AuthenticationHook and all info about certs are not added to nsNSSSocketInfo, therefore we need to call VerifySSLServerCert and get these info and these info is added to nsNSSSocketInfo in RebuildVerifiedCertificateInformation).
• TLS session cache contains resumption token that can be used for the next session resumption we need to add:
  whether certificate validation was successful
  evOidPolicy != SEC_OID_UNKNOWN
  certificateTransparencyInfo
  server certificate
  certificate built chain
  What we need is to call this lines with infromation from the case instead of calling VerifySSLServerCert.
  The session that sets resumption token gets the info above stored in nNSSSocketInfo after certificate validation in lines.

Comment 2

[Kershaw Chang [:kershaw]]

Attachment: Bug 1560353 - Extend SSLTokensCache to store the result of VerifySSLServerCert

Comment 3

[Kershaw Chang [:kershaw]]

Attachment: Bug 1560353 - Add test for external session cache

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/73a76edb175f
Extend SSLTokensCache to store the result of VerifySSLServerCert r=dragana,keeler
https://hg.mozilla.org/integration/autoland/rev/f472f9a312c9
Add test for external session cache r=keeler

Comment 5

[Stefan Hindli [:stefan_hindli]]

https://hg.mozilla.org/mozilla-central/rev/73a76edb175f
https://hg.mozilla.org/mozilla-central/rev/f472f9a312c9

Comment 6

[Stefan Hindli [:stefan_hindli]]

https://hg.mozilla.org/mozilla-central/rev/73a76edb175f
https://hg.mozilla.org/mozilla-central/rev/f472f9a312c9