1920759 - CCADB entries generated 2024-09-24T17:00:46Z

Status: RESOLVED FIXED

(Core :: Security Block-lists, Allow-lists, and other State, task)

Description

[Common CA Database to OneCRL Bot]

Adding entries to OneCRL based on revoked intermediate certificates reported in the CCADB.

Comment 1

[Common CA Database to OneCRL Bot]

Attachment: Line delimited issuer/serial pairs

Comment 2

[Common CA Database to OneCRL Bot]

Attachment: The additions to OneCRL proposed by this bug.

Comment 3

[Common CA Database to OneCRL Bot]

Attachment: Entries with their names decoded to plain text and hexadecimal serials/hashes.

Comment 4

[Ben Wilson]

I have reviewed these proposed additions to OneCRL and they appear correct.

We do not need to run TLS Canary on this batch of changes.

We should:

• proceed with reviewing and approving the changes at Kinto Staging,
• use remote-settings-devtools in a development profile to confirm the OneCRL data in Staging Nightly is as intended (it may take a while for the changes to show up), and
• run the onecrl-entry-checker tool and attach the output to this bug.

Thanks,
Ben

Comment 5

[Dana Keeler (she/her) [:keeler]]

Attachment: onecrl-entry-checker output

Comment 6

[Ben Wilson]

The onecrl-entry-checker output looks correct and matches the proposed changes. Please proceed with approving these changes in Kinto Production.

Comment 7

[Dana Keeler (she/her) [:keeler]]

Approved in prod.

Comment 8

[Common CA Database to OneCRL Bot]

Changes are still in review. The following bugs appear to require resolution.
https://bugzilla.mozilla.org/show_bug.cgi?id=1920759

Comment 9

[Ben Wilson]

These are now included in OneCRL.