1885349 - Replace addons-stage.crt with cas-cur-root-2024-03-12.crt

Status: VERIFIED FIXED

(Core :: Security: PSM, task, P1)

Description

[Rob Wu [:robwu]]

In bug 1882192, new certificates have been generated to prepare for testing on stage.

The new cas-cur-root-2024-03-12.crt certificate needs to replace the current addons-stage.crt at security/manager/ssl/addons-stage.crt.
The expiry characteristics have not changed, but this is a necessary intermediate step as explained in https://bugzilla.mozilla.org/show_bug.cgi?id=1882192#c2

Comment 1

[Rob Wu [:robwu]]

Attachment: Bug 1885349 - Replace addons-stage.crt with cas-cur

Comment 2

[Rob Wu [:robwu]]

NOTE: the crt file from bug 1882192 is in PEM format, but Firefox expects a DER-encoded certificate. There were no compile-time errors; I discovered the issue when I tried to check Firefox against actual signed artifacts. Perhaps we should add a sanity check to security/manager/ssl/gen_cert_header.py to complain loudly at build time when the input is in an unexpected format.

This is what I did to convert the crt file:

$ openssl x509 -inform PEM -in /tmp/cas-cur-root-2024-03-12.crt -outform DER -out security/manager/ssl/addons-stage.crt

Comment 3

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/98ae4cd205cf
Replace addons-stage.crt with cas-cur r=jschanck

Comment 4

[Natalia Csoregi [:nataliaCs]]

https://hg.mozilla.org/mozilla-central/rev/98ae4cd205cf

Comment 5

[Ioana Rusiczki]

This has been verified. For more details, see https://github.com/mozilla/addons-server/issues/22016

Comment 6

[Rob Wu [:robwu]]

Comment on attachment 9391358 [details]
Bug 1885349 - Replace addons-stage.crt with cas-cur

ESR Uplift Approval Request

• If this is not a sec:{high,crit} bug, please state case for ESR consideration: QA cannot install add-ons from AMO stage/dev server. This is necessary to test the root CA succession on ESR115.
• User impact if declined: QA cannot install add-ons from AMO stage/dev server.
• Fix Landed on Version: 125
• Risk to taking this patch: Low
• Why is the change risky/not risky? (and alternatives if risky): Only affects behavior behind a pref

Comment 7

[Ryan VanderMeulen [:RyanVM]]

Comment on attachment 9391358 [details]
Bug 1885349 - Replace addons-stage.crt with cas-cur

Approved for 125.10esr.

Comment 8

[Pulsebot]

https://hg.mozilla.org/releases/mozilla-esr115/rev/b4418340ea66