The default bug view has changed. See this FAQ.

Enable multiple roots from NSS 3.12.9 for EV. (Nov/Dec 2010 batch)

VERIFIED FIXED

Status

()

Core
Security: PSM
VERIFIED FIXED
6 years ago
6 years ago

People

(Reporter: kaie, Assigned: kaie)

Tracking

Trunk
Points:
---
Dependency tree / graph

Firefox Tracking Flags

(status1.9.2 .17-fixed, status1.9.1 .19-fixed)

Details

Attachments

(1 attachment, 1 obsolete attachment)

(Assignee)

Description

6 years ago
Enable multiple roots for EV. (Nov/Dec 2010 batch, most depend on NSS 3.12.9)
(Assignee)

Updated

6 years ago
Depends on: 613394
(Assignee)

Updated

6 years ago
Summary: Enable multiple roots for EV. (Nov/Dec 2010 batch, most depend on NSS 3.12.9) → Enable multiple roots from NSS 3.12.9 for EV. (Nov/Dec 2010 batch)
(Assignee)

Updated

6 years ago
Blocks: 578499, 562399, 593067
(Assignee)

Comment 1

6 years ago
Created attachment 493296 [details] [diff] [review]
Patch v1

I used this patch for initial testing.
Only 1 out of multiple test sites gives me EV.
(Assignee)

Updated

6 years ago
No longer blocks: 578499
(Assignee)

Comment 2

6 years ago
We have positive test results for TC Trustcenter, they will be included.


We were unable to confirm that Izenpe.com's OCSP infrastructure is set up correctly, I'm removing them from this batch.


Regarding Camerfirma:
Based on incomplete test server infrastructure, it has been decided, only a subset of the request will be implemented. I'm removing 2 OIDs. I'm keeping the 2 OIDs which gave positive test results.
(Assignee)

Comment 3

6 years ago
Created attachment 494393 [details] [diff] [review]
Patch v2
Attachment #493296 - Attachment is obsolete: true
Attachment #494393 - Flags: review?(honzab.moz)
Comment on attachment 494393 [details] [diff] [review]
Patch v2

r=honzab

OIDs checked via the pending certificate list page.

Only concern I have - Camerfirma seems to use different OID for EV and OV certs, shouldn't we duplicate both entries also for the secondary OIDs (1.3.6.1.4.1.17326.10.14.2.2.2 and 1.3.6.1.4.1.17326.10.8.12.2.2) ?
Attachment #494393 - Flags: review?(honzab.moz) → review+
(Assignee)

Updated

6 years ago
Whiteboard: [waiting-for-nss-3.12.9-landing]
(Assignee)

Updated

6 years ago
Depends on: 599324
(Assignee)

Comment 5

6 years ago
> r=honzab

Thanks


> Only concern I have - Camerfirma seems to use different OID for EV and OV
> certs, shouldn't we duplicate both entries also for the secondary OIDs
> (1.3.6.1.4.1.17326.10.14.2.2.2 and 1.3.6.1.4.1.17326.10.8.12.2.2) ?


No. Camerfirma agreed to omit these OIDs,
because they could not provide us with test URLS for these OIDs.

See bug 562399 comment 19 and 20.
(Assignee)

Comment 6

6 years ago
Comment on attachment 494393 [details] [diff] [review]
Patch v2

Now that NSS 3.12.9 (beta) has been landed, and the new roots are available, we're ready to get these enabled for EV.
Attachment #494393 - Flags: approval2.0?
(Assignee)

Updated

6 years ago
Whiteboard: [waiting-for-nss-3.12.9-landing]
Attachment #494393 - Flags: approval2.0? → approval2.0+
(Assignee)

Comment 7

6 years ago
http://hg.mozilla.org/mozilla-central/rev/79eacfd734ea
Status: NEW → RESOLVED
Last Resolved: 6 years ago
Resolution: --- → FIXED
(Assignee)

Updated

6 years ago
Attachment #494393 - Flags: approval1.9.2.15?
Attachment #494393 - Flags: approval1.9.1.18?
Is there a way I can test this to mark this bug VERIFIED?
(Assignee)

Comment 9

6 years ago
You should get green EV identity status at
https://testserver.universal-iii.trustcenter.de/
https://www.camerfirma.com/
https://server3.camerfirma.com/
(In reply to comment #9)
> You should get green EV identity status at
> https://testserver.universal-iii.trustcenter.de/
> https://www.camerfirma.com/
> https://server3.camerfirma.com/

Thanks.  Verified FIXED with Firefox 4.0b12pre 20110221.
Status: RESOLVED → VERIFIED
Comment on attachment 494393 [details] [diff] [review]
Patch v2

Approved for 1.9.2.15 and 1.9.1.18, a=dveditz for release-drivers
Attachment #494393 - Flags: approval1.9.2.15?
Attachment #494393 - Flags: approval1.9.2.15+
Attachment #494393 - Flags: approval1.9.1.18?
Attachment #494393 - Flags: approval1.9.1.18+
(Assignee)

Comment 12

6 years ago
http://hg.mozilla.org/releases/mozilla-1.9.1/rev/1decbc8b26d9
status1.9.1: --- → .18-fixed
(Assignee)

Comment 13

6 years ago
http://hg.mozilla.org/releases/mozilla-1.9.2/rev/9a7602e9d5d1
status1.9.2: --- → .15-fixed
The "3.6.15" we're releasing today does not fix this bug, the release containing this bug fix has been renamed to "3.6.16" and the bugzilla flags will be updated to reflect that soon. Today's release is a re-release of 3.6.14 plus a fix for a bug that prevented many Java applets from starting up.
You need to log in before you can comment on or make changes to this bug.