292776 - Need Ability to Import CRLs from the web

Status: RESOLVED FIXED

(Thunderbird :: Security, defect)

Description

[Scott MacGregor]

Mozilla currently supports CRL import when the user clicks on an embedded http
link in a web page. That works great if you are a browser but not so well if you
are an e-mail client.

The CRL manager dialog needs an import button which will prompt for the location
of the CRL file to update.

Comment 1

[Scott MacGregor]

Attachment: screen shot of the new import dialog

Comment 2

[Scott MacGregor]

Attachment: the fix

Adds an Import button to the CRL dialog. Clicking it brings up a prompt for the
URL of the CRL to import. 

One caveat, currently the CRL manager dialog is not designed to refresh itself
after a CRL has been added to the list so you won't see it in the dialog until
the next time you open the dialog. I didn't see any hooks for the CRL dialog to
get notifications from PSM about new CRLs.

Comment 3

[Scott MacGregor]

Here's a URL you can use to test the feature:

https://leek.its.monash.edu.au:81/getCRL?op=importCRL&issuepoint=MasterCRL

Comment 4

[Scott MacGregor]

this patch has been checked into the aviary 1.0 branch for a customer. Next up,
the trunk. 

Comment 5

[Scott MacGregor]

Comment on attachment 182534 [details] [diff] [review]
the fix

asking Bob for a module owner review since he's been helpful on some other
related work for bsmedberg in mozilla/security.

Bob, this patch exposes an import button in the CRL dialog so non browser apps
like Thunderbird have a way to import CRLs (currently the way you do this is by
clicking on a link in a web page which doesn't work for thunderbird).

Thanks!

Comment 6

[Robert Relyea]

Comment on attachment 182534 [details] [diff] [review]
the fix

r=relyea

code looks good, idea is great.

Comment 7

[chris hofmann]

Comment on attachment 182534 [details] [diff] [review]
the fix

a=chofmann

Comment 8

[Nelson Bolyard (seldom reads bugmail)]

The URL required to download a CRL is usually found in a certificate issued
by the CA.  

Asking a user to type in a URL from which to download a CRL may require the 
user to go look inside the cert (which mozilla products don't do so well, 
bug 259031 ) to see that URL.  

How much better if the user could click a button for the cert to get his 
mozilla to download the CRL for it, without typing any URL.