1911864 - Implement "less strict" OCSP revocation setting

Status: NEW

(Core :: Security: PSM, enhancement)

Description

[Daniel Veditz [:dveditz]]

Chrome does not check OCSP, and pushes only a subset of revocations to their clients based on the revocation reason. This leads to regular occurrences of sites that are are "broken" in Firefox but "work fine" in Chrome when the revocations were issued for minor technical reasons. In our plans for CRLite one approach to shrinking the data set was to include only the more serious revocation reasons. I propose

• by default our OCSP checks only result in SSL errors for that same set of reasons
• other reasons could result in degraded URL bar presentation like "Not Secure" or slashed lock (or, ignore completely like Chrome)
• there's a preference to get "full" OCSP enforcement for TLS purists. Can be hidden about:config pref, but should be settable by enterprise policy