1921528 - add some new error codes to mozilla::pkix so Firefox can use them

Status: RESOLVED FIXED

(NSS :: Libraries, enhancement, P1)

Description

[Dana Keeler (she/her) (use needinfo) [:keeler]]

Bug 1911007 and bug 1921525 both need new error codes in mozilla::pkix so Firefox can use them. The former needs an error for when a certificate was issued with a notBefore value after a CA's distrustAfter value (i.e. the issuer is no longer trusted to issue new certificates). The latter needs an error for when sufficient certificate transparency information is not available.

Comment 1

[Dana Keeler (she/her) (use needinfo) [:keeler]]

Attachment: Bug 1921528 - add new error codes to mozilla::pkix for Firefox to use r?jschanck

This adds MOZILLA_PKIX_ERROR_INSUFFICIENT_CERTIFICATE_TRANSPARENCY and
MOZILLA_PKIX_ERROR_ISSUER_NO_LONGER_TRUSTED for certificate transparency and
distrust after, respectively.

Comment 2

[John Schanck [:jschanck]]

https://hg.mozilla.org/projects/nss/rev/f8a6e9557d1cb8c5e2cd35acfa080b38c9f9cca7