1908112 - Ship TLS Certificate Compression in Release

Status: RESOLVED FIXED

(Core :: Security: PSM, enhancement, P2)

Description

[Anna Weine]

As we are currently supporting certificate compression in Nightly and Beta, it's time to roll it out to Release.

See also:
certificate compression meta bug: https://bugzilla.mozilla.org/show_bug.cgi?id=1548723
enable certificate compression decoders in Beta: https://bugzilla.mozilla.org/show_bug.cgi?id=1905910

Comment 1

[Tom25519]

Can we ship it now?

Comment 2

[Anna Weine]

Hi,

Currently we are checking that the implementation will benefit to our users (measuring the speed) without breaking any functionality. More specifically, as the certificate compression operates with the certificates that are verified before accessing the page, wrong implementation of the certificate compression on any step would lead to not being able to access certain sites.

In order to ensure that everything is going well, we are having a set of experiments. Until now we do not observe any breakages, so we hope to be able to enable the certificate compression in Release soon.

Comment 3

[Anna Weine]

Attachment: Bug 1908112 - Enable all the certificate compression mechanisms in Release

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/8a1926792e04
Enable all the certificate compression mechanisms in Release r=jschanck

Comment 5

[Anna Weine]

Attachment: Bug 1908112 - Enable all the certificate compression mechanisms in Release

As discussed the last week during the NSS call, we plan

• to enable all the cert compression algorithms;
• uplift it to beta;
• start (now) the roll-out to release.

Original Revision: https://phabricator.services.mozilla.com/D224936

Comment 6

[Phabricator Automation]

beta Uplift Approval Request

• User impact if declined: none
• Code covered by automated testing: yes
• Fix verified in Nightly: yes
• Needs manual QE test: no
• Steps to reproduce for manual QE testing: Not required
• Risk associated with taking this patch: low
• Explanation of risk level: the functionality is available in Nightly/Beta + we ran several experiments
• String changes made/needed: No
• Is Android affected?: yes

Comment 7

[Cristian Tuns]

https://hg.mozilla.org/mozilla-central/rev/8a1926792e04

Comment 8

[Pulsebot]

https://hg.mozilla.org/releases/mozilla-beta/rev/c6074c1ccc6e

Comment 9

[Anna Weine]

I will leave the bug opened until we successfully ship the code to Release.

Comment 10

[Anna Weine]

Release Note Request (optional, but appreciated)
[Why is this notable]:
This feature reduces the size and increasing the speed of the TLS handshake.
[Affects Firefox for Android]: yes
[Suggested wording]: Added support for Certificate Compression TLS Extension.
[Links (documentation, blog post, etc)]:
https://datatracker.ietf.org/doc/html/rfc8879

Comment 11

[Anna Weine]

Release Note Request (optional, but appreciated)
[Why is this notable]:
This feature reduces the size and increasing the speed of the TLS handshake.
[Affects Firefox for Android]: yes
[Suggested wording]: Added support for Certificate Compression TLS Extension.
[Links (documentation, blog post, etc)]:
https://datatracker.ietf.org/doc/html/rfc8879

Comment 12

[Ryan VanderMeulen [:RyanVM]]

Added to the Fx132 relnotes.

Comment 13

[Anna Weine]

Thanks!