Remove search by decoded serial in nssToken_FindCertificateByIssuerAndSerialNumber
Categories
(NSS :: Libraries, enhancement, P3)
Tracking
(Not tracked)
People
(Reporter: jschanck, Assigned: jschanck)
References
Details
Attachments
(1 file)
The nssToken_FindCertificateByIssuerAndSerialNumber function tries to find a certificate object on a token matching a particular issuer and serial number. Upon failing to find matching certificate, the function will remove the DER wrapper on the serial number and repeat the search. This was a workaround for a bug in early versions of NSS. As the affected versions are now over 22 years old, we can remove the mitigation.
|
Assignee | |
Comment 1•1 year ago
|
||
|
|
Assignee | |
Comment 2•1 year ago
|
||
|
||
Comment 3•1 year ago
|
||
So I need to be careful here. The search change wasn't just because of softoken, but also because of other PKCS #11 tokens. I think we are probably OK with this one, but some of these are really PKCS #11 compatibility issue... and some tokens have some pretty lone lifetimes (though even 22 years is pushing it). Upshot: I think this one is fine (well until we find the token that changed their code to handle our unwrapped serial numbers and never changed backed).
|
||
Comment 4•5 months ago
|
||
This change causes a regression in Thunderbird with smartcard decryption, bug 1982742.
(We also have other smartcard related bug reports in TB 140, but it isn't yet clear what causes them, for example bug 1979650.)
As I understand it, the intention was a cleanup, but now we have confirmation that the removed code is still required for proper functionality.
Could this get backed out and released with a NSS 3.104.1 bugfix release and uplifted to mozilla-esr140 ?
|
|
||
Comment 5•5 months ago
|
||
(In reply to Kai Engert [:KaiE:] from comment #4)
Could this get backed out and released with a NSS 3.104.1 bugfix release and uplifted to mozilla-esr140 ?
Sorry, false version suggestion.
mozilla-esr140 uses 3.112, which means we'd need a NSS 3.112.1
|
|
||
Comment 6•5 months ago
|
||
I wonder if it might be worth using the quick decoder here rather than a hand ASN.1 decode. It's more overhead, but less code review overhead, and the failing case is likely not too common. If you are looking up a cert by issue/SN then the user has pretty high expectations that the cert he's looking for is there.
Description
•