493660 - add latest group of new root CAs to NSS

Status: RESOLVED FIXED

(NSS :: CA Certificates Code, task, P2)

Description

[Nelson Bolyard (seldom reads bugmail)]

Attachment: Patch v1 for NSS Trunk

This bug will hold a single patch to address all the following bugs that 
request changes to the Mozilla root CA certs for FF 3.5:

478573 Add S-TRUST Authentication and Encryption Root CA 2005:PN root 
483852 Add Microsec e-Szigno Root CA root certificate to NSS
483889 Add Certigna root certificate to NSS
486424 Add AC Raíz Certicámara S.A. root certificate to NSS
486759 Add Three TC TrustCenter root certificates to NSS
487647 Add Deutsche Telekom Root CA 2 root certificate to NSS
490487 Add ComSign CA and the ComSign Secured CA root certificates to NSS
490487 Enable Object Signing for the StartCom Certification Authority
493258 Add Cybertrust Global Root certificate to NSS 

I will attach a test DLL for Win32 shortly.

Comment 1

[Nelson Bolyard (seldom reads bugmail)]

This patch also includes the fix for bug 490495 (I got the number wrong 
in comment 0).  

490495 Enable Object Signing for the StartCom Certification Authority

Comment 2

[Nelson Bolyard (seldom reads bugmail)]

Attachment: nssckbi.dll file for CAs to test with Firefox on Win32

The CAs whose requests are addressed in this bug should download this zip
file onto a Win32 box (e.g. WinXP, Vista, etc.), and unzip it.  It contains
one file, nssckbi.dll.  Then, find the directory where they have Firefox 3.x 
installed, (e.g. C:/Program Files/...).  It will already have an nssckbi.dll 
file in it.  

Make certain that Firefox is NOT running.  Then copy the nssckbi.dll file 
from this zip file into that Firefox directory.  Then start the browser and
test.  Look in the "Authorities" tab of the certificate Manager.  Find your
cert and ensure that the names are right and the trust bits are as indicated
in your respective NSS bugs.  

Please confirm your findings in your own individual bug (which blocks this one) not in this bug.  Thanks.

Comment 3

[Eddy Nigg (StartCom)]

Attachment: libnssckbi.so library build on StartCom Linux

Comment 4

[Nelson Bolyard (seldom reads bugmail)]

Attachment: ZIP file of added DER certs and UTF8 shell script that added them

For posterity

Comment 5

[Kai Engert (:KaiE:)]

Comment on attachment 378197 [details] [diff] [review]
Patch v1 for NSS Trunk

Bob is going to review it.

Comment 6

[Nelson Bolyard (seldom reads bugmail)]

Checking in certdata.c;   new revision: 1.54; previous revision: 1.53
Checking in certdata.txt; new revision: 1.53; previous revision: 1.52
Checking in nssckbi.h;    new revision: 1.20; previous revision: 1.19

Now to make some tags.

Comment 7

[Nelson Bolyard (seldom reads bugmail)]

I have tagged mozilla/security/nss/lib/ckfw/builtins with a new tag:
NSSCKBI_1_75_RTM 
This is the current trunk tip in that directory.  
It includes the changes committed for this bug.

I have tagged the entire NSS module with a new tag: 
NSS_3_12_3_WITH_CKBI_1_75_RTM
This was produced specifically for Firefox 3.5.0 and bug 494236.
This tag is identical to the NSS module tag NSS_3_12_3_RTM, except 
for the builtins directory, which is identical to the tag NSSCKBI_1_75_RTM.

Soon I will produce another tag for use by the Firefox trunk.

Comment 8

[Nelson Bolyard (seldom reads bugmail)]

Fixed by checkin of patch for bug 493660.  Will be in FF 3.5