CCADB entries generated 2025-09-08T17:00:39Z
Categories
(Core :: Security Block-lists, Allow-lists, and other State, enhancement)
Tracking
()
People
(Reporter: ccadb2onercl, Assigned: bwilson)
Details
Attachments
(3 files)
Adding entries to OneCRL based on revoked intermediate certificates reported in the CCADB.
|
Reporter | |
Comment 1•1 year ago
|
||
|
|
Reporter | |
Comment 2•1 year ago
|
||
|
|
Reporter | |
Comment 3•1 year ago
|
||
|
Assignee | |
Updated•1 year ago
|
|
|
Assignee | |
Comment 4•1 year ago
|
||
The issuer/serial pairs attachment decodes into the following eleven (11) OneCRL entries:
issuer: /C=US/O=AffirmTrust/CN=AffirmTrust Commercial serial: 187e7f3bf66f23cd
issuer: /C=US/O=AffirmTrust/CN=AffirmTrust Commercial serial: 1729551ed68e7fb1edf57300f35d7fd5
issuer: /C=US/O=AffirmTrust/CN=AffirmTrust Premium serial: 5371c8eb0784fd5108e5d4f3e323ec46
issuer: /C=US/O=AffirmTrust/CN=AffirmTrust Networking serial: 3424a1ecf8f0a35fe746b7011c43e844
issuer: /C=US/O=Entrust, Inc./OU=See www.entrust.net/legal-terms/OU=(c) 2009 Entrust, Inc. - for authorized use only/CN=Entrust Root Certification Authority - G2 serial: 00fabb27ddff80d09a0000000051d39440
issuer: /C=US/O=Entrust, Inc./OU=See www.entrust.net/legal-terms/OU=(c) 2009 Entrust, Inc. - for authorized use only/CN=Entrust Root Certification Authority - G2 serial: 7b0350a7b1d46885af4cc8c740a568b0
issuer: /C=US/O=AffirmTrust/CN=AffirmTrust Commercial serial: 53f6a611092e528ed963f19149532204
issuer: /C=US/O=AffirmTrust/CN=AffirmTrust Commercial serial: 40f0bbaa8ae0c098
issuer: /C=US/O=AffirmTrust/CN=AffirmTrust Premium ECC serial: 0202a584c134064dc9f32d207ea37298
issuer: /C=US/O=Entrust, Inc./OU=www.entrust.net/CPS is incorporated by reference/OU=(c) 2006 Entrust, Inc./CN=Entrust Root Certification Authority serial: 008666b02ac1cb54400000000051d3589c
issuer: /C=US/O=Entrust, Inc./OU=See www.entrust.net/legal-terms/OU=(c) 2009 Entrust, Inc. - for authorized use only/CN=Entrust Root Certification Authority - G2 serial: 00ac9a58d8637568d2cdfddc1c7955cc
These are the correct entries to add to OneCRL and can be reviewed and approved in Kinto Staging.
|
|
Reporter | |
Comment 5•1 year ago
|
||
Changes are still in review. The following bugs appear to require resolution.
https://bugzilla.mozilla.org/show_bug.cgi?id=1987472
|
|
Reporter | |
Comment 6•1 year ago
|
||
Changes are still in review. The following bugs appear to require resolution.
https://bugzilla.mozilla.org/show_bug.cgi?id=1987472
|
|
Reporter | |
Comment 7•1 year ago
|
||
Changes are still in review. The following bugs appear to require resolution.
https://bugzilla.mozilla.org/show_bug.cgi?id=1987472
|
||
Comment 8•1 year ago
|
||
Approved in stage, looks good in remote-settings-devtools.
onecrl-entry-checker output:
[11:23:56] Stage-Stage: 1722 Stage-Preview: 1722 Stage-Published: 1722 compare.py:67
[11:23:57] Prod-Stage: 1722 Prod-Preview: 1722 Prod-Published: 1711 compare.py:75
Verifying stage against preview compare.py:82
prod/security-state-staging (1722) and prod/security-state-preview (1722) are equivalent compare.py:87
prod/security-state-staging (1722) and prod/security-state-staging (1722) are equivalent compare.py:87
prod/security-state-staging (1722) and prod/security-state-preview (1722) are equivalent compare.py:87
prod/security-state-preview (1722) and prod/security-state-staging (1722) are equivalent compare.py:87
[11:23:58] prod/security-state-preview (1722) and prod/security-state-preview (1722) are equivalent compare.py:87
prod/security-state-staging (1722) and prod/security-state-preview (1722) are equivalent compare.py:87
No changes are waiting in staging compare.py:90
There are 11 changes waiting in production. Adding: compare.py:99
{
'details': {'bug': 'https://bugzilla.mozilla.org/show_bug.cgi?id=1987472', 'who': '', 'why': '', 'name': '', 'created': ''},
'enabled': False,
'issuerName':
'MIG+MQswCQYDVQQGEwJVUzEWMBQGA1UEChMNRW50cnVzdCwgSW5jLjEoMCYGA1UECxMfU2VlIHd3dy5lbnRydXN0Lm5ldC9sZWdhbC10ZXJtczE5MDcGA1UECxMwKGMpIDIwMDkgRW50cnVzdCwgSW5jLiAtIGZvciBhdXRob3JpemVkIHVzZSBvbmx5MTIwMAYDVQQDEylFbnRydXN0IFJvb3QgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkgLSBHMg==',
'serialNumber': 'AKyaWNhjdWjSzf3cHHlVzA=='
}
{
'details': {'bug': 'https://bugzilla.mozilla.org/show_bug.cgi?id=1987472', 'who': '', 'why': '', 'name': '', 'created': ''},
'enabled': False,
'issuerName': 'MIGwMQswCQYDVQQGEwJVUzEWMBQGA1UEChMNRW50cnVzdCwgSW5jLjE5MDcGA1UECxMwd3d3LmVudHJ1c3QubmV0L0NQUyBpcyBpbmNvcnBvcmF0ZWQgYnkgcmVmZXJlbmNlMR8wHQYDVQQLExYoYykgMjAwNiBFbnRydXN0LCBJbmMuMS0wKwYDVQQDEyRFbnRydXN0IFJvb3QgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHk=',
'serialNumber': 'AIZmsCrBy1RAAAAAAFHTWJw='
}
{
'details': {'bug': 'https://bugzilla.mozilla.org/show_bug.cgi?id=1987472', 'who': '', 'why': '', 'name': '', 'created': ''},
'enabled': False,
'issuerName': 'MEUxCzAJBgNVBAYTAlVTMRQwEgYDVQQKDAtBZmZpcm1UcnVzdDEgMB4GA1UEAwwXQWZmaXJtVHJ1c3QgUHJlbWl1bSBFQ0M=',
'serialNumber': 'AgKlhME0Bk3J8y0gfqNymA=='
}
{
'details': {'bug': 'https://bugzilla.mozilla.org/show_bug.cgi?id=1987472', 'who': '', 'why': '', 'name': '', 'created': ''},
'enabled': False,
'issuerName': 'MEQxCzAJBgNVBAYTAlVTMRQwEgYDVQQKDAtBZmZpcm1UcnVzdDEfMB0GA1UEAwwWQWZmaXJtVHJ1c3QgQ29tbWVyY2lhbA==',
'serialNumber': 'QPC7qorgwJg='
}
{
'details': {'bug': 'https://bugzilla.mozilla.org/show_bug.cgi?id=1987472', 'who': '', 'why': '', 'name': '', 'created': ''},
'enabled': False,
'issuerName': 'MEQxCzAJBgNVBAYTAlVTMRQwEgYDVQQKDAtBZmZpcm1UcnVzdDEfMB0GA1UEAwwWQWZmaXJtVHJ1c3QgQ29tbWVyY2lhbA==',
'serialNumber': 'U/amEQkuUo7ZY/GRSVMiBA=='
}
{
'details': {'bug': 'https://bugzilla.mozilla.org/show_bug.cgi?id=1987472', 'who': '', 'why': '', 'name': '', 'created': ''},
'enabled': False,
'issuerName':
'MIG+MQswCQYDVQQGEwJVUzEWMBQGA1UEChMNRW50cnVzdCwgSW5jLjEoMCYGA1UECxMfU2VlIHd3dy5lbnRydXN0Lm5ldC9sZWdhbC10ZXJtczE5MDcGA1UECxMwKGMpIDIwMDkgRW50cnVzdCwgSW5jLiAtIGZvciBhdXRob3JpemVkIHVzZSBvbmx5MTIwMAYDVQQDEylFbnRydXN0IFJvb3QgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkgLSBHMg==',
'serialNumber': 'ewNQp7HUaIWvTMjHQKVosA=='
}
{
'details': {'bug': 'https://bugzilla.mozilla.org/show_bug.cgi?id=1987472', 'who': '', 'why': '', 'name': '', 'created': ''},
'enabled': False,
'issuerName':
'MIG+MQswCQYDVQQGEwJVUzEWMBQGA1UEChMNRW50cnVzdCwgSW5jLjEoMCYGA1UECxMfU2VlIHd3dy5lbnRydXN0Lm5ldC9sZWdhbC10ZXJtczE5MDcGA1UECxMwKGMpIDIwMDkgRW50cnVzdCwgSW5jLiAtIGZvciBhdXRob3JpemVkIHVzZSBvbmx5MTIwMAYDVQQDEylFbnRydXN0IFJvb3QgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkgLSBHMg==',
'serialNumber': 'APq7J93/gNCaAAAAAFHTlEA='
}
{
'details': {'bug': 'https://bugzilla.mozilla.org/show_bug.cgi?id=1987472', 'who': '', 'why': '', 'name': '', 'created': ''},
'enabled': False,
'issuerName': 'MEQxCzAJBgNVBAYTAlVTMRQwEgYDVQQKDAtBZmZpcm1UcnVzdDEfMB0GA1UEAwwWQWZmaXJtVHJ1c3QgTmV0d29ya2luZw==',
'serialNumber': 'NCSh7Pjwo1/nRrcBHEPoRA=='
}
{
'details': {'bug': 'https://bugzilla.mozilla.org/show_bug.cgi?id=1987472', 'who': '', 'why': '', 'name': '', 'created': ''},
'enabled': False,
'issuerName': 'MEExCzAJBgNVBAYTAlVTMRQwEgYDVQQKDAtBZmZpcm1UcnVzdDEcMBoGA1UEAwwTQWZmaXJtVHJ1c3QgUHJlbWl1bQ==',
'serialNumber': 'U3HI6weE/VEI5dTz4yPsRg=='
}
{
'details': {'bug': 'https://bugzilla.mozilla.org/show_bug.cgi?id=1987472', 'who': '', 'why': '', 'name': '', 'created': ''},
'enabled': False,
'issuerName': 'MEQxCzAJBgNVBAYTAlVTMRQwEgYDVQQKDAtBZmZpcm1UcnVzdDEfMB0GA1UEAwwWQWZmaXJtVHJ1c3QgQ29tbWVyY2lhbA==',
'serialNumber': 'FylVHtaOf7Ht9XMA811/1Q=='
}
{
'details': {'bug': 'https://bugzilla.mozilla.org/show_bug.cgi?id=1987472', 'who': '', 'why': '', 'name': '', 'created': ''},
'enabled': False,
'issuerName': 'MEQxCzAJBgNVBAYTAlVTMRQwEgYDVQQKDAtBZmZpcm1UcnVzdDEfMB0GA1UEAwwWQWZmaXJtVHJ1c3QgQ29tbWVyY2lhbA==',
'serialNumber': 'GH5/O/ZvI80='
}
Staging is updated, and production changes are waiting, so Firefox can use compare.py:110
Remote Settings DevTools (https://github.com/mozilla-extensions/remote-settings-devtools)
and cert-storage-inspector (https://github.com/mozkeeler/cert-storage-inspector) to test
OneCRL.
|
||
Comment 9•1 year ago
|
||
I have verified that these changes are correct. We can proceed with putting them into production.
|
|
Assignee | |
Comment 11•1 year ago
|
||
Verified that these entries are in local Firefox profiles and elsewhere (e.g. https://crt.sh/mozilla-onecrl)
Description
•