371501 - Set an upper bound on CRL lifetime

Status: RESOLVED INCOMPLETE

(Core :: Security: PSM, enhancement)

Description

[Nelson Bolyard (seldom reads bugmail)]

Gervase has recently discovered that there are some CAs in mozilla's list 
that have CRL's with nextUpdate times that are 6 or 12 months after the 
thisUpdate time!  PSM dutifully waits until the nextUpdate time before 
fetching a new copy of the URL.  

I think PSM should have its own upper bound on the amount of time that 
it will continue to trust a CRL after it has been fetched, before it 
tries to fetch a new copy.  I suggest that that limit be no more than
a few days, maybe a week tops.

Comment 1

[Kai Engert (:KaiE:)]

reassign bug owner.
mass-update-kaie-20120918

Comment 2

[Brian Smith (:briansmith, :bsmith, use NEEDINFO?)]

The CRL Manager / Revocation Lists feature was removed.