1900843 - CCADB entries generated 2024-06-05T17:00:51Z

Status: RESOLVED FIXED

(Core :: Security Block-lists, Allow-lists, and other State, enhancement)

Description

[Common CA Database to OneCRL Bot]

Adding entries to OneCRL based on revoked intermediate certificates reported in the CCADB.

Comment 1

[Common CA Database to OneCRL Bot]

Attachment: Line delimited issuer/serial pairs

Comment 2

[Common CA Database to OneCRL Bot]

Attachment: The additions to OneCRL proposed by this bug.

Comment 3

[Common CA Database to OneCRL Bot]

Attachment: Entries with their names decoded to plain text and hexadecimal serials/hashes.

Comment 4

[Common CA Database to OneCRL Bot]

Changes are still in review. The following bugs appear to require resolution.
https://bugzilla.mozilla.org/show_bug.cgi?id=1900843

Comment 5

[Ben Wilson]

Hi,
I have reviewed these proposed additions to OneCRL and they appear correct.
We do not need to run TLS Canary on this batch of changes.
Can we:

• proceed with reviewing and approving the changes at Kinto Staging,
• use remote-settings-devtools in a development profile to confirm the OneCRL data in Staging Nightly is as intended (it may take a while for the changes to show up), and
• run the onecrl-entry-checker tool and attach the output to this bug.

Thanks,
Ben

Comment 6

[John Schanck [:jschanck]]

[10:41:55] Stage-Stage: 1621 Stage-Preview: 1621 Stage-Published: compare.py:67
           1621
[10:41:57] Prod-Stage: 1621 Prod-Preview: 1621 Prod-Published:    compare.py:75
           1608
           Verifying stage against preview                        compare.py:82
           prod/security-state-staging (1621) and                 compare.py:87
           prod/security-state-preview (1621) are equivalent
           prod/security-state-staging (1621) and                 compare.py:87
           prod/security-state-staging (1621) are equivalent
           prod/security-state-staging (1621) and                 compare.py:87
           prod/security-state-preview (1621) are equivalent
           prod/security-state-preview (1621) and                 compare.py:87
           prod/security-state-staging (1621) are equivalent
           prod/security-state-preview (1621) and                 compare.py:87
           prod/security-state-preview (1621) are equivalent
           prod/security-state-staging (1621) and                 compare.py:87
           prod/security-state-preview (1621) are equivalent
           No changes are waiting in staging                      compare.py:90
           There are 13 changes waiting in production. Adding:    compare.py:99
{
    'details': {
        'bug': 'https://bugzilla.mozilla.org/show_bug.cgi?id=1900843',
        'who': '',
        'why': '',
        'name': '',
        'created': ''
    },
    'enabled': False,
    'issuerName':
'MFAxJDAiBgNVBAsTG0dsb2JhbFNpZ24gRUNDIFJvb3QgQ0EgLSBSNTETMBEGA1UEChMKR2xvYmFsU2
lnbjETMBEGA1UEAxMKR2xvYmFsU2lnbg==',
    'serialNumber': 'eSmbgvwPOlXGliHHuCIbXw=='
}
{
    'details': {
        'bug': 'https://bugzilla.mozilla.org/show_bug.cgi?id=1900843',
        'who': '',
        'why': '',
        'name': '',
        'created': ''
    },
    'enabled': False,
    'issuerName':
'MFoxCzAJBgNVBAYTAkZSMRIwEAYDVQQKDAlEaGlteW90aXMxHDAaBgNVBAsMEzAwMDIgNDgxNDYzMD
gxMDAwMzYxGTAXBgNVBAMMEENlcnRpZ25hIFJvb3QgQ0E=',
    'serialNumber': 'Sv8S1Opltybu6pB7fMV4c4tDJxA='
}
{
    'details': {
        'bug': 'https://bugzilla.mozilla.org/show_bug.cgi?id=1900843',
        'who': '',
        'why': '',
        'name': '',
        'created': ''
    },
    'enabled': False,
    'issuerName':
'MHsxCzAJBgNVBAYTAkdCMRswGQYDVQQIDBJHcmVhdGVyIE1hbmNoZXN0ZXIxEDAOBgNVBAcMB1NhbG
ZvcmQxGjAYBgNVBAoMEUNvbW9kbyBDQSBMaW1pdGVkMSEwHwYDVQQDDBhBQUEgQ2VydGlmaWNhdGUgU
2VydmljZXM=',
    'serialNumber': 'fHxdvf2CERpzvs38JwG48A=='
}
{
    'details': {
        'bug': 'https://bugzilla.mozilla.org/show_bug.cgi?id=1900843',
        'who': '',
        'why': '',
        'name': '',
        'created': ''
    },
    'enabled': False,
    'issuerName':
'MFAxJDAiBgNVBAsTG0dsb2JhbFNpZ24gRUNDIFJvb3QgQ0EgLSBSNTETMBEGA1UEChMKR2xvYmFsU2
lnbjETMBEGA1UEAxMKR2xvYmFsU2lnbg==',
    'serialNumber': 'eSmbhHLMt1IRJtmqS3w+Hg=='
}
{
    'details': {
        'bug': 'https://bugzilla.mozilla.org/show_bug.cgi?id=1900843',
        'who': '',
        'why': '',
        'name': '',
        'created': ''
    },
    'enabled': False,
    'issuerName':
'MEUxCzAJBgNVBAYTAkJNMRkwFwYDVQQKExBRdW9WYWRpcyBMaW1pdGVkMRswGQYDVQQDExJRdW9WYW
RpcyBSb290IENBIDI=',
    'serialNumber': 'A1/hN80FUeTB8bAL66Wu5T+VJzQ='
}
{
    'details': {
        'bug': 'https://bugzilla.mozilla.org/show_bug.cgi?id=1900843',
        'who': '',
        'why': '',
        'name': '',
        'created': ''
    },
    'enabled': False,
    'issuerName':
'MEwxIDAeBgNVBAsTF0dsb2JhbFNpZ24gUm9vdCBDQSAtIFIzMRMwEQYDVQQKEwpHbG9iYWxTaWduMR
MwEQYDVQQDEwpHbG9iYWxTaWdu',
    'serialNumber': 'eEqpJrbnW++td7NIAblS0A=='
}
{
    'details': {
        'bug': 'https://bugzilla.mozilla.org/show_bug.cgi?id=1900843',
        'who': '',
        'why': '',
        'name': '',
        'created': ''
    },
    'enabled': False,
    'issuerName':
'MEwxIDAeBgNVBAsTF0dsb2JhbFNpZ24gUm9vdCBDQSAtIFIzMRMwEQYDVQQKEwpHbG9iYWxTaWduMR
MwEQYDVQQDEwpHbG9iYWxTaWdu',
    'serialNumber': 'fSpKUE1MI+QbVqikKzCRCw=='
}
{
    'details': {
        'bug': 'https://bugzilla.mozilla.org/show_bug.cgi?id=1900843',
        'who': '',
        'why': '',
        'name': '',
        'created': ''
    },
    'enabled': False,
    'issuerName':
'MEUxCzAJBgNVBAYTAkJNMRkwFwYDVQQKExBRdW9WYWRpcyBMaW1pdGVkMRswGQYDVQQDExJRdW9WYW
RpcyBSb290IENBIDI=',
    'serialNumber': 'dUFRzBHsibZGSbIwrYCQILseZqU='
}
{
    'details': {
        'bug': 'https://bugzilla.mozilla.org/show_bug.cgi?id=1900843',
        'who': '',
        'why': '',
        'name': '',
        'created': ''
    },
    'enabled': False,
    'issuerName':
'MEoxCzAJBgNVBAYTAlVTMRIwEAYDVQQKEwlJZGVuVHJ1c3QxJzAlBgNVBAMTHklkZW5UcnVzdCBDb2
1tZXJjaWFsIFJvb3QgQ0EgMQ==',
    'serialNumber': 'QAGPK6zlV7rhg+Zdfhm+yw=='
}
{
    'details': {
        'bug': 'https://bugzilla.mozilla.org/show_bug.cgi?id=1900843',
        'who': '',
        'why': '',
        'name': '',
        'created': ''
    },
    'enabled': False,
    'issuerName':
'MDQxCzAJBgNVBAYTAkZSMRIwEAYDVQQKDAlEaGlteW90aXMxETAPBgNVBAMMCENlcnRpZ25h',
    'serialNumber': 'Hk9yv7+W0/YZwdKqJa5SuM6j9sg='
}
{
    'details': {
        'bug': 'https://bugzilla.mozilla.org/show_bug.cgi?id=1900843',
        'who': '',
        'why': '',
        'name': '',
        'created': ''
    },
    'enabled': False,
    'issuerName':
'MFoxCzAJBgNVBAYTAkZSMRIwEAYDVQQKDAlEaGlteW90aXMxHDAaBgNVBAsMEzAwMDIgNDgxNDYzMD
gxMDAwMzYxGTAXBgNVBAMMEENlcnRpZ25hIFJvb3QgQ0E=',
    'serialNumber': 'Vpa/MHpWy1YxUNIl27d+tZ1sX5k='
}
{
    'details': {
        'bug': 'https://bugzilla.mozilla.org/show_bug.cgi?id=1900843',
        'who': '',
        'why': '',
        'name': '',
        'created': ''
    },
    'enabled': False,
    'issuerName':
'MEcxCzAJBgNVBAYTAlVTMRIwEAYDVQQKEwlJZGVuVHJ1c3QxJDAiBgNVBAMTG1RydXN0SUQgRW50ZX
JwcmlzZSBUTFMgQ0EgMw==',
    'serialNumber': 'QAGPK2OnXRav9TdQ+n+NOQ=='
}
{
    'details': {
        'bug': 'https://bugzilla.mozilla.org/show_bug.cgi?id=1900843',
        'who': '',
        'why': '',
        'name': '',
        'created': ''
    },
    'enabled': False,
    'issuerName':
'MDQxCzAJBgNVBAYTAkZSMRIwEAYDVQQKDAlEaGlteW90aXMxETAPBgNVBAMMCENlcnRpZ25h',
    'serialNumber': 'OUcWep55zFAPGqHlCF5J5BJKEic='
}
[10:41:58] Staging is updated, and production changes are        compare.py:110
           waiting, so Firefox can use
           Remote Settings DevTools
           (https://github.com/mozilla-extensions/remote-setting
           s-devtools)
           and cert-storage-inspector
           (https://github.com/mozkeeler/cert-storage-inspector)
           to test
           OneCRL.

Comment 7

[Ben Wilson]

This looks good. These changes can be moved into production.

Comment 8

[John Schanck [:jschanck]]

Approved in prod.

Comment 9

[Ben Wilson]

Confirmed