1931437 - provide a mechanism for enterprises to skip certificate transparency enforcement for specified hosts/certificates

Status: RESOLVED FIXED

(Core :: Security: PSM, enhancement, P1)

Description

[Dana Keeler (she/her) (use needinfo) [:keeler]]

Evidently some organizations make use of certificates issued by CAs in the web PKI that aren't publicly disclosed in certificate transparency. To enable these certificates to continue working without disabling certificate transparency entirely, we should implement a mechanism to skip enforcing CT for certain hosts and certificates.

(cf. https://chromeenterprise.google/policies/#CertificateTransparencyEnforcementDisabledForCas and https://chromeenterprise.google/policies/#CertificateTransparencyEnforcementDisabledForUrls)

Comment 1

[Dana Keeler (she/her) (use needinfo) [:keeler]]

Attachment: Bug 1931437 - a mechanism to selectively skip certificate transparency enforcement r?jschanck!,mkaply!

Comment 2

[Dana Keeler (she/her) (use needinfo) [:keeler]]

Attachment: Bug 1931437 - reorganize CertVerifier::VerifyCertificateTransparencyPolicy for clarity and future changes r?jschanck

Comment 3

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/c2c1f5446544
reorganize CertVerifier::VerifyCertificateTransparencyPolicy for clarity and future changes r=jschanck
https://hg.mozilla.org/integration/autoland/rev/330315d68b20
a mechanism to selectively skip certificate transparency enforcement r=jschanck,mkaply

Comment 4

[Sandor Molnar[:smolnar]]

https://hg.mozilla.org/mozilla-central/rev/c2c1f5446544
https://hg.mozilla.org/mozilla-central/rev/330315d68b20