442561 - Change PSM to enable Entrust Root Certification Authority for EV

Status: RESOLVED FIXED

(Core :: Security: PSM, enhancement)

Description

[Frank Hecker]

Per bug 416544 I've formally approved enabling the Entrust Root Certification Authority root for EV use, and am requesting that the corresponding changes be made to PSM.

Here's the relevant information:

Root name: Entrust Root Certification Authority
SHA-1 fingerprint:
  B3:1E:B1:B7:40:E3:6C:84:02:DA:DC:37:D4:4D:F5:D4:67:49:52:F9
EV policy OID:
  2.16.840.1.114028.10.1.2

Bruce, could you double-check the above information one last time?

Comment 1

[Kai Engert (:KaiE:)]

Frank, bug 416544 talks about 3 separate CA certs.

In this bug you only approve one of them.

Because of that I'll prepare a patch that enables only one root cert for EV.

Comment 2

[Kai Engert (:KaiE:)]

Attachment: Patch v1

This patch gives me EV-green on https://www.entrust.net

Comment 3

[Robert Relyea]

Comment on attachment 327428 [details] [diff] [review]
Patch v1

r+ pending Entrust's verification of Frank's data.

Comment 4

[Bruce Morton]

The following information from Comment #1 is confirmed by Entrust:

Root name: Entrust Root Certification Authority
SHA-1 fingerprint:
  B3:1E:B1:B7:40:E3:6C:84:02:DA:DC:37:D4:4D:F5:D4:67:49:52:F9
EV policy OID:
  2.16.840.1.114028.10.1.2

Comment 5

[Bruce Morton]

Is there any possibility that Entrust can test prior to release?

Comment 6

[Mike Beltzner [:beltzner, not reading bugmail]]

Hey Bruce, when we check this in (someone will comment here when that happens) you'll be able to download the next day's nightly build and it should have this change in it.

Comment 7

[Mike Beltzner [:beltzner, not reading bugmail]]

Comment on attachment 327428 [details] [diff] [review]
Patch v1

a=beltzner

QA: you'll be able to test this by going to https://managed.entrust.net/ - it should show the name of the company and SSL provider.

Comment 8

[Reed Loden [:reed]]

Checking in security/manager/ssl/src/nsIdentityChecking.cpp;
/cvsroot/mozilla/security/manager/ssl/src/nsIdentityChecking.cpp,v  <--  nsIdentityChecking.cpp
new revision: 1.21; previous revision: 1.20
done

Comment 9

[Bill Gianopoulos [:WG9s]]

(In reply to comment #7)
> (From update of attachment 327428 [details] [diff] [review])
> a=beltzner
> 
> QA: you'll be able to test this by going to https://managed.entrust.net/ - it
> should show the name of the company and SSL provider.
> 

This does NOT work for me using 20080701 trunk builds.

Comment 10

[Kai Engert (:KaiE:)]

Bill, please try a nightly build from here:
ftp://ftp.mozilla.org/pub/mozilla.org/firefox/nightly/latest-mozilla1.9.0/

Trunk did not yet receive the fix, only the 1.9.0 branch for 3.0.x has it already.

Comment 11

[Bill Gianopoulos [:WG9s]]

(In reply to comment #9)
> (In reply to comment #7)
> > (From update of attachment 327428 [details] [diff] [review] [details])
> > a=beltzner
> > 
> > QA: you'll be able to test this by going to https://managed.entrust.net/ - it
> > should show the name of the company and SSL provider.
> > 
> 
> This does NOT work for me using 20080701 trunk builds.
> 

This DOES, however, seem to work on 20080701 branch builds.

What happened to the nothing could be checked into the branch without being tested on the trunk first rule?

Comment 12

[Kai Engert (:KaiE:)]

fixed on trunk