1991483 - CCADB entries generated 2025-09-29T17:00:36Z

Status: RESOLVED FIXED

(Core :: Security Block-lists, Allow-lists, and other State, enhancement)

Description

[Common CA Database to OneCRL Bot]

Adding entries to OneCRL based on revoked intermediate certificates reported in the CCADB.

Comment 1

[Common CA Database to OneCRL Bot]

Attachment: Line delimited issuer/serial pairs

Comment 2

[Common CA Database to OneCRL Bot]

Attachment: The additions to OneCRL proposed by this bug.

Comment 3

[Common CA Database to OneCRL Bot]

Attachment: Entries with their names decoded to plain text and hexadecimal serials/hashes.

Comment 4

[Ben Wilson]

I have reviewed the OneCRL Entry to be added and confirm that it is correct:
issuer: /C=US/O=IdenTrust/CN=IdenTrust Commercial Root CA 1 serial: 4001994ee6958c161aa024fbcb14bef1

Comment 5

[Common CA Database to OneCRL Bot]

Changes are still in review. The following bugs appear to require resolution.
https://bugzilla.mozilla.org/show_bug.cgi?id=1991483

Comment 6

[Common CA Database to OneCRL Bot]

Changes are still in review. The following bugs appear to require resolution.
https://bugzilla.mozilla.org/show_bug.cgi?id=1991483

Comment 7

[Common CA Database to OneCRL Bot]

Changes are still in review. The following bugs appear to require resolution.
https://bugzilla.mozilla.org/show_bug.cgi?id=1991483

Comment 8

[Dana Keeler (she/her) [:keeler]]

Approved in stage, remote-settings-devtools looks good.

% python compare.py
[12:45:31] Stage-Stage: 1733 Stage-Preview: 1733 Stage-Published: 1733                                                                                                                                                                                           compare.py:67
[12:45:32] Prod-Stage: 1733 Prod-Preview: 1733 Prod-Published: 1732                                                                                                                                                                                              compare.py:75
           Verifying stage against preview                                                                                                                                                                                                                       compare.py:82
           prod/security-state-staging (1733) and prod/security-state-preview (1733) are equivalent                                                                                                                                                              compare.py:87
           prod/security-state-staging (1733) and prod/security-state-staging (1733) are equivalent                                                                                                                                                              compare.py:87
           prod/security-state-staging (1733) and prod/security-state-preview (1733) are equivalent                                                                                                                                                              compare.py:87
           prod/security-state-preview (1733) and prod/security-state-staging (1733) are equivalent                                                                                                                                                              compare.py:87
           prod/security-state-preview (1733) and prod/security-state-preview (1733) are equivalent                                                                                                                                                              compare.py:87
           prod/security-state-staging (1733) and prod/security-state-preview (1733) are equivalent                                                                                                                                                              compare.py:87
           No changes are waiting in staging                                                                                                                                                                                                                     compare.py:90
           There are 1 changes waiting in production. Adding:                                                                                                                                                                                                    compare.py:99
{
    'details': {'bug': 'https://bugzilla.mozilla.org/show_bug.cgi?id=1991483', 'who': '', 'why': '', 'name': '', 'created': ''},
    'enabled': False,
    'issuerName': 'MEoxCzAJBgNVBAYTAlVTMRIwEAYDVQQKEwlJZGVuVHJ1c3QxJzAlBgNVBAMTHklkZW5UcnVzdCBDb21tZXJjaWFsIFJvb3QgQ0EgMQ==',
    'serialNumber': 'QAGZTuaVjBYaoCT7yxS+8Q=='
}
           Staging is updated, and production changes are waiting, so Firefox can use                                                                                                                                                                           compare.py:110
           Remote Settings DevTools (https://github.com/mozilla-extensions/remote-settings-devtools)
           and cert-storage-inspector (https://github.com/mozkeeler/cert-storage-inspector) to test
           OneCRL.

Comment 9

[incident-reporting]

I have verified that this is the record to be added to OneCRL.
This entry can be moved to production.

Comment 10

[Common CA Database to OneCRL Bot]

Changes are still in review. The following bugs appear to require resolution.
https://bugzilla.mozilla.org/show_bug.cgi?id=1991483

Comment 11

[Dana Keeler (she/her) [:keeler]]

Approved in prod.

Comment 12

[incident-reporting]

The OneCRL entry appears in my Firefox profiles. This can be closed as fixed.