397405 - Should be able to change the interval for which cert chain is present in cache

Status: NEW

(NSS :: Libraries, enhancement, P2)

Description

[Alexei Volkov]

Currently, the cert(and it's valid chain) is stored in cert chain cache if it was successfully validated. It stored for one hour interval.

The fix for this bug should change default cache time interval to be 8 hours as most short time live certs have this validity interval.

The patch should also provide a way to change cache time interval depending upon certificate valid notAfter and crl nextUpdate times.

Comment 1

[Alexei Volkov]

The patch v1 for bug 390499 address this issues, but still requires some work. Please check comment 390499#3 and comment 390499#4

Comment 2

[Alexei Volkov]

libpkix refuse to add another cert chain into the cache if it is already has an entry with such cert. It is incorrect, because the new value may provide a new validity interval and should not be rejected, but rather an old cache entry should be updated/re-evaluated with a new data.

Comment 3

[Nelson Bolyard (seldom reads bugmail)]

Unsetting target milestone in unresolved bugs whose targets have passed.

Comment 4

[BugBot [:suhaib / :marco/ :calixte]]

The bug assignee is inactive on Bugzilla, and this bug has priority 'P2'.
:beurdouche, could you have a look please?

For more information, please visit auto_nag documentation.

Comment 5

[Marco Castelluccio [:marco]]

We have modified the bot to only consider P1 as high priority, so I'm cancelling the needinfo here.