1925127 - align built-in certificate transparency expiration time with ecosystem

Status: RESOLVED FIXED

(Core :: Security: PSM, defect, P1)

Description

[Dana Keeler (she/her) (use needinfo) [:keeler]]

Chrome expires certificate transparency information after 70 days (10 weeks) if it doesn't get an update. This puts a bound on the time the CT ecosystem assumes clients will either be updated or will no longer enforce CT by, so it represents the speed at which changes can take place. Our implementation currently expires after 12 weeks if Firefox isn't updated, which increases the latency by 2 weeks. To avoid compatibility issues and potential errors solely in Firefox, we should expire CT information after 10 weeks with no update as well.

Comment 1

[Dana Keeler (she/her) (use needinfo) [:keeler]]

Attachment: Bug 1925127 - align built-in certificate transparency expiration time with ecosystem r?jschanck

Comment 2

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/b8a61a1c09b8
align built-in certificate transparency expiration time with ecosystem r=jschanck

Comment 3

[amarc]

https://hg.mozilla.org/mozilla-central/rev/b8a61a1c09b8