Closed Bug 1760708 Opened 3 years ago Closed 3 years ago

OneCRL Status gets set to Not Applicable because Derived Trust Bits gets emptied when cert is Revoked

Categories

(CA Program :: Common CA Database, task, P1)

Product:
CA Program
Component:
Common CA Database
Type:
task

Tracking

(Not tracked)

Status:
RESOLVED FIXED

People

(Reporter: kathleen.a.wilson, Assigned: poonam)

Details

(Whiteboard: [ccadb-bug])

When a Mozilla Root Store manager runs "Verify Revocation", there is a check to see if "Derived Trust Bits" contains "Server Authentication". If it does not, then "OneCRL Status" gets set to "Not Applicable".

The problem is that now when a certificate's "Revocation Status" gets set to "Revoked", the contents of the "Derived Trust Bits" field get moved to "Pre-Revocation Derived Trust Bits", and then the "Derived Trust Bits" field gets set to empty.

I think the fix is just to change the logic in "Verify Revocation" to use the contents of "Pre-Revocation Derived Trust Bits"

Modified the logic for "Verify Revocation" process to use "Pre-Revocation Derived Trust Bits" in place of "Derived Trust Bits". Also, moved the changes to production.

Thanks!

Status: ASSIGNED → RESOLVED
Closed: 3 years ago
Resolution: --- → FIXED
Product: NSS → CA Program
You need to log in before you can comment on or make changes to this bug.