1890618 - Expose a libssl function for getting the peer certificate chain as an array of DER certs

Status: RESOLVED FIXED

(NSS :: Libraries, enhancement, P3)

Description

[John Schanck [:jschanck]]

SSL_PeerCertificateChain returns a list of CERTCertificates. PSM calls SSL_PeerCertificateChain, copies the DER encoded certs out of the returned list, and immediately discards the CERTCertificates (here). I think neqo does something similar.

SSL_PeerCertificateChain is the only function that needs to extract a CERTCertificate from a ssl3CertNode. So let's change ssl3CertNode to store a DER cert, construct CERTCertificates in SSL_PeerCertificateChain for existing callers, and add a new function (maybe SSLExp_PeerCertificateChainDER) that gives PSM access to an array of DER certs instead.

Comment 1

[John Schanck [:jschanck]]

Attachment: Bug 1890618 - add PeerCertificateChainDER function to libssl. r=keeler

Comment 2

[John Schanck [:jschanck]]

https://hg.mozilla.org/projects/nss/rev/beafb5e8c03ab7213e9d8eec703c40b835c90100

Comment 3

[John Schanck [:jschanck]]

Backed out for causing ssl.sh failures

Backout link: https://hg.mozilla.org/projects/nss/rev/e97d97f064aeef31c6cbef894a355d0e5ba1effe
Push with failures: https://treeherder.mozilla.org/jobs?repo=nss&revision=beafb5e8c03ab7213e9d8eec703c40b835c90100

Comment 4

[John Schanck [:jschanck]]

https://hg.mozilla.org/projects/nss/rev/85b31820e432e580b7f3dfd291d444df2ee9f129