1750787 - Store CRLite issuer enrollment in cert-revocations

Status: RESOLVED FIXED

(Core :: Security: PSM, defect, P3)

Description

[John Schanck [:jschanck]]

We read the enrollment of issuers from the intermediates collection in Remote Settings and we read filters from cert-revocations. Since these are two separate operations, we can get into a state where we enroll an intermediate prior to having a filter that covers its certificates. This can lead to mislabelling, so we should defer enrolling intermediates until after we've downloaded the most recent filter.

Comment 1

[John Schanck [:jschanck]]

After reviewing the options, it believe that the space savings afforded by storing enrollment in intermediates cannot justify the risk of mislabellings. We should store the enrollment list in cert-revocations so that updates can be processed atomically. I've updated the title of this bug.

Comment 2

[John Schanck [:jschanck]]

Attachment: Bug 1750787 - get CRLite enrollment list from cert-revocations. r=keeler

Comment 3

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/4000eb2cd181
get CRLite enrollment list from cert-revocations. r=keeler

Comment 4

[Sandor Molnar[:smolnar]]

https://hg.mozilla.org/mozilla-central/rev/4000eb2cd181