1842872 - stop caching intermediate certificates

Status: RESOLVED FIXED

(Core :: Security: PSM, task, P1)

Description

[Dana Keeler (she/her) [:keeler]]

Firefox caches intermediate certificates from verified TLS certificate chains. This feature is an attempt to paper over misconfigured servers that don't send the appropriate intermediate certificates in the TLS handshake. However, it often leads to confusion (e.g. connections to misconfigured servers succeeding in old profiles but failing in new ones). Now that we have intermediate preloading and third party intermediate certificates, caching intermediates shouldn't be necessary. Removing this feature will also simplify the implementation and improve the performance of TLS certificate verification.

Comment 1

[Dana Keeler (she/her) [:keeler]]

<0.2% of users make use of the NSS cert DB when building certificate chains, so I think we're good to go ahead with this: https://sql.telemetry.mozilla.org/queries/101293/source#249613

Comment 2

[Dana Keeler (she/her) [:keeler]]

Attachment: Bug 1842872 - stop caching intermediate certificates from TLS connections r?djackson

Comment 3

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/6c01a963ad7b
stop caching intermediate certificates from TLS connections r=djackson

Comment 4

[Narcis Beleuzu [:NarcisB]]

https://hg.mozilla.org/mozilla-central/rev/6c01a963ad7b