1756007 - Separate logic for Derived Trust Bits and EV SSL Capable from ALV logic

Status: RESOLVED FIXED

(CA Program :: Common CA Database, task)

Description

[Kathleen Wilson]

Move the logic for "Derived Trust Bits" and "EV SSL Capable" into separate routines that can be called by an hourly batch job. (out of the ALV logic and ALV batch job)

Update the ALV batch job to run once per day, but 15 minutes after the "Derived Trust Bits" and "EV SSL Capable" processes run.

Comment 1

[Poonam Bhargava]

The logic for Derived Trust Bits and EV SSL Capable have been separated from ALV button and batch job.

In the new logic a trigger method will launch an asynchronous process to calculate Derived Trust Bits and EV SSL Capable when following conditions are met:

1. A new intermediate cert is added OR
2. Amy of the below key fields are modified on intermediate certs or root certificate
   Derived_Trust_Bits
   EV_SSL_Capable
   Mozilla_Trust_Bit
   Microsoft_Trust_Bit
   Mozilla_Status
   Microsoft_Status
   Apple_Status
   Apple_Trust_Bits
   Extended_Key_Usage
   Revocation_Status
   Valid_To_GMT
   Subject_SPKI_SHA256
   ParentId
   Policy_Identifiers
   ExtendedValidation_cpp_OIDs
   Microsoft_EV_SSL_Enabled
   Apple_EV_Enabled

A separate batch program will check for expired intermediate cert (Valid To > Today). This needs to be scheduled shortly after midnight to makes the DTS and EV SSL Capable fields blank and sets the Pre field with the original DTS value.

Do we need to include "Apple EV TLS Enabled" & "Apple EV TLS Policy OID(s)" to calculate EV SSL Capable? If yes, what values we need to check for OIDs?

These changes are only in the sandbox.

Comment 2

[Kathleen Wilson]

Do we need to include "Apple EV TLS Enabled" & "Apple EV TLS Policy OID(s)" to calculate EV SSL Capable? If yes, what values we need to check for OIDs?

Only "Apple EV TLS Enabled" -- do not need to also check "Apple EV TLS Policy OID(s)" to calculate EV SSL Capable

Comment 3

[Kathleen Wilson]

Tested in Sandbox. Ready to move to production.

Comment 4

[Poonam Bhargava]

ALV processing and recalculation of Derived Trust Bits/EV SSL Capable fields logic has been separated and the new programs have been deployed in production. A one-time script was used to update the data in for existing intermediate cert records.

The new logic uses "Apple EV TLS Enabled" to calculate "EV SSL Capable".

Comment 5

[Kathleen Wilson]

Thanks!