1615438 - Certificate validation should respect CKA_NSS_SERVER_DISTRUST_AFTER

Status: RESOLVED FIXED

(Core :: Security: PSM, enhancement, P1)

Description

[J.C. Jones [:jcj] (he/they)]

Since Bug 1465613, NSS provides CKA_NSS_SERVER_DISTRUST_AFTER as a date to be compared with certificates' NotBefore dates to indicate distrust.

As just a straw-person idea, NSSCertDBTrustDomain::IsChainValid would return invalid if the root certificate was builtin, and if the end entity NotBefore date was after the root's CKA_NSS_SERVER_DISTRUST_AFTER date.

Comment 1

[Benjamin Beurdouche [:beurdouche]]

Should I create a new error value for this or do we think reusing ERROR_ADDITIONAL_POLICY_CONSTRAINT_FAILED is ok ?

Comment 2

[Dana Keeler (she/her) [:keeler]]

To me it feels more like the active distrust records from the built-in root module, so I think we should use Result::ERROR_UNTRUSTED_CERT (which would turn into Result::ERROR_UNTRUSTED_ISSUER when that result gets processed).

Comment 3

[Benjamin Beurdouche [:beurdouche]]

Attachment: Bug 1615438 - Use CKA_NSS_SERVER_DISTRUST_AFTER from NSS for certificate validation. r=keeler

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/adb3e4385840
Use CKA_NSS_SERVER_DISTRUST_AFTER from NSS for certificate validation. r=keeler

Comment 5

[Raul Gurzau (:RaulG)]

https://hg.mozilla.org/mozilla-central/rev/adb3e4385840