614852 - Enable multiple roots from NSS 3.12.9 for EV. (Nov/Dec 2010 batch)

Status: VERIFIED FIXED

(Core :: Security: PSM, defect)

Description

[Kai Engert (:KaiE:)]

Enable multiple roots for EV. (Nov/Dec 2010 batch, most depend on NSS 3.12.9)

Comment 1

[Kai Engert (:KaiE:)]

Attachment: Patch v1

I used this patch for initial testing.
Only 1 out of multiple test sites gives me EV.

Comment 2

[Kai Engert (:KaiE:)]

We have positive test results for TC Trustcenter, they will be included.


We were unable to confirm that Izenpe.com's OCSP infrastructure is set up correctly, I'm removing them from this batch.


Regarding Camerfirma:
Based on incomplete test server infrastructure, it has been decided, only a subset of the request will be implemented. I'm removing 2 OIDs. I'm keeping the 2 OIDs which gave positive test results.

Comment 3

[Kai Engert (:KaiE:)]

Attachment: Patch v2

Comment 4

[Honza Bambas (:mayhemer)]

Comment on attachment 494393 [details] [diff] [review]
Patch v2

r=honzab

OIDs checked via the pending certificate list page.

Only concern I have - Camerfirma seems to use different OID for EV and OV certs, shouldn't we duplicate both entries also for the secondary OIDs (1.3.6.1.4.1.17326.10.14.2.2.2 and 1.3.6.1.4.1.17326.10.8.12.2.2) ?

Comment 5

[Kai Engert (:KaiE:)]

> r=honzab

Thanks


> Only concern I have - Camerfirma seems to use different OID for EV and OV
> certs, shouldn't we duplicate both entries also for the secondary OIDs
> (1.3.6.1.4.1.17326.10.14.2.2.2 and 1.3.6.1.4.1.17326.10.8.12.2.2) ?


No. Camerfirma agreed to omit these OIDs,
because they could not provide us with test URLS for these OIDs.

See bug 562399 comment 19 and 20.

Comment 6

[Kai Engert (:KaiE:)]

Comment on attachment 494393 [details] [diff] [review]
Patch v2

Now that NSS 3.12.9 (beta) has been landed, and the new roots are available, we're ready to get these enabled for EV.

Comment 7

[Kai Engert (:KaiE:)]

http://hg.mozilla.org/mozilla-central/rev/79eacfd734ea

Comment 8

[u279076]

Is there a way I can test this to mark this bug VERIFIED?

Comment 9

[Kai Engert (:KaiE:)]

You should get green EV identity status at
https://testserver.universal-iii.trustcenter.de/
https://www.camerfirma.com/
https://server3.camerfirma.com/

Comment 10

[u279076]

(In reply to comment #9)
> You should get green EV identity status at
> https://testserver.universal-iii.trustcenter.de/
> https://www.camerfirma.com/
> https://server3.camerfirma.com/

Thanks.  Verified FIXED with Firefox 4.0b12pre 20110221.

Comment 11

[Daniel Veditz [:dveditz]]

Comment on attachment 494393 [details] [diff] [review]
Patch v2

Approved for 1.9.2.15 and 1.9.1.18, a=dveditz for release-drivers

Comment 12

[Kai Engert (:KaiE:)]

http://hg.mozilla.org/releases/mozilla-1.9.1/rev/1decbc8b26d9

Comment 13

[Kai Engert (:KaiE:)]

http://hg.mozilla.org/releases/mozilla-1.9.2/rev/9a7602e9d5d1

Comment 14

[Daniel Veditz [:dveditz]]

The "3.6.15" we're releasing today does not fix this bug, the release containing this bug fix has been renamed to "3.6.16" and the bugzilla flags will be updated to reflect that soon. Today's release is a re-release of 3.6.14 plus a fix for a bug that prevented many Java applets from starting up.