1580912 - CCADB entries generated 2019-09-12T4:14:52Z

Status: RESOLVED FIXED

(Core :: Security Block-lists, Allow-lists, and other State, task)

Description

[Wayne Thayer]

Attachment: Intermediates to be revoked

Here are some entries: Please ensure that the entries are correct.

Comment 1

[Wayne Thayer]

Attachment: existing and new revocations in the form of a revocations.txt file

Comment 2

[Wayne Thayer]

Attachment: intermediates to be revoked

Changing content type

Comment 3

[Wayne Thayer]

Comment on attachment 9092437 [details]
intermediates to be revoked

Worked, downloaded 1041 entries from the staging list.

Evaluating expected file = 'expected.txt'

Results:
Pending Kinto Dataset (Found): 1041
Added Entries (Expected): 53
[GOOD] Expected But Not Pending (Not Found): 0
Deleted: 0
[GOOD] Entries In Production But Lost Without Being Deleted (Missing): 0

[GOOD] The Expected file matches the change between the staged Kinto and production.
[GOOD] The Kinto dataset found at production equals the union of the expected file and the live list.
Nothing not found.
Nothing deleted.

Comment 4

[Kathleen Wilson]

Comment on attachment 9092437 [details]
intermediates to be revoked

This contains the correct entries to add to OneCRL.

Comment 5

[Kathleen Wilson]

Comment on attachment 9092435 [details]
existing and new revocations in the form of a revocations.txt file

This also has the correct entries to add to OneCRL.

Comment 6

[Kathleen Wilson]

CR, Would you please do a standard compat run with this set of OneCRL updates? We are adding 53 entries. This corresponds to PI-198. Thanks!

Comment 7

[Wayne Thayer]

Attachment: existing and new revocations in the form of a revocations.txt file

Fix content-type

Comment 8

[Kathleen Wilson]

Paul, per Comment #6, We will greatly appreciate it if your team will do a standard compat run with this set of OneCRL updates, just to make sure there are now surprises...

Comment 9

[Christiane Ruetten [INACTIVE]]

Sorry for the bad timing. I'm just back from PTO and Paul was OOO last week, too. I know this is awfully late, but I'll start a regression scan run today.

Comment 10

[Christiane Ruetten [INACTIVE]]

The test run just finished. It's based on Firefox Beta:

"buildid": "20190930132843"
"app_version": "70.0b11"
"nss_version": "NSS 3.46"
"NSPR_Version": "4.22"

The regression run yielded two potential regressions:

1. wellmov.com (rank 65420) issued by Let's Encrypt
2. cdn.1rtb.com (rank 745174) issued by Comodo

I suspect the first to be a false positive. The error looks like it was triggered by an expired certificate, and it seems it got renewed by the time I got to investigate it. The second result indicated as being produced by a timeout error, so might be a false positive, too.

Comment 11

[Kathleen Wilson]

(In reply to Christiane Ruetten [:cr] from comment #10)
Thanks!
This batch of changes to OneCRL is ready to go.

Comment 12

[J.C. Jones [:jcj] (he/him)]

Approved at Kinto

Comment 13

[Kathleen Wilson]

I have confirmed that these entries are in cert-storage in Nightly and revocations.txt in Beta.

Comment 14

[Kathleen Wilson]

Attachment: revocations-Oct4-2019.txt

Comment 15

[BMO Automation]

Moving bug to Core::Security Block-lists, Allow-lists, and other State.