Remove search by decoded serial in nssToken_FindCertificateByIssuerAndSerialNumber
Categories
(NSS :: Libraries, enhancement, P3)
Tracking
(Not tracked)
People
(Reporter: jschanck, Assigned: jschanck)
Details
Attachments
(1 file)
The nssToken_FindCertificateByIssuerAndSerialNumber function tries to find a certificate object on a token matching a particular issuer and serial number. Upon failing to find matching certificate, the function will remove the DER wrapper on the serial number and repeat the search. This was a workaround for a bug in early versions of NSS. As the affected versions are now over 22 years old, we can remove the mitigation.
|
Assignee | |
Comment 1•6 months ago
|
||
|
|
Assignee | |
Comment 2•6 months ago
|
||
|
||
Comment 3•6 months ago
|
||
So I need to be careful here. The search change wasn't just because of softoken, but also because of other PKCS #11 tokens. I think we are probably OK with this one, but some of these are really PKCS #11 compatibility issue... and some tokens have some pretty lone lifetimes (though even 22 years is pushing it). Upshot: I think this one is fine (well until we find the token that changed their code to handle our unwrapped serial numbers and never changed backed).
Description
•