Enable multiple roots from NSS 3.12.9 for EV. (Nov/Dec 2010 batch)

VERIFIED FIXED

Status

()

defect
VERIFIED FIXED
9 years ago
9 years ago

People

(Reporter: kaie, Assigned: kaie)

Tracking

Trunk
Points:
---
Dependency tree / graph

Firefox Tracking Flags

(status1.9.2 .17-fixed, status1.9.1 .19-fixed)

Details

Attachments

(1 attachment, 1 obsolete attachment)

Enable multiple roots for EV. (Nov/Dec 2010 batch, most depend on NSS 3.12.9)
Depends on: 613394
Summary: Enable multiple roots for EV. (Nov/Dec 2010 batch, most depend on NSS 3.12.9) → Enable multiple roots from NSS 3.12.9 for EV. (Nov/Dec 2010 batch)
Blocks: 578499, 562399, 593067
Posted patch Patch v1 (obsolete) — Splinter Review
I used this patch for initial testing.
Only 1 out of multiple test sites gives me EV.
No longer blocks: 578499
We have positive test results for TC Trustcenter, they will be included.


We were unable to confirm that Izenpe.com's OCSP infrastructure is set up correctly, I'm removing them from this batch.


Regarding Camerfirma:
Based on incomplete test server infrastructure, it has been decided, only a subset of the request will be implemented. I'm removing 2 OIDs. I'm keeping the 2 OIDs which gave positive test results.
Posted patch Patch v2Splinter Review
Attachment #493296 - Attachment is obsolete: true
Attachment #494393 - Flags: review?(honzab.moz)
Comment on attachment 494393 [details] [diff] [review]
Patch v2

r=honzab

OIDs checked via the pending certificate list page.

Only concern I have - Camerfirma seems to use different OID for EV and OV certs, shouldn't we duplicate both entries also for the secondary OIDs (1.3.6.1.4.1.17326.10.14.2.2.2 and 1.3.6.1.4.1.17326.10.8.12.2.2) ?
Attachment #494393 - Flags: review?(honzab.moz) → review+
Whiteboard: [waiting-for-nss-3.12.9-landing]
Depends on: 599324
> r=honzab

Thanks


> Only concern I have - Camerfirma seems to use different OID for EV and OV
> certs, shouldn't we duplicate both entries also for the secondary OIDs
> (1.3.6.1.4.1.17326.10.14.2.2.2 and 1.3.6.1.4.1.17326.10.8.12.2.2) ?


No. Camerfirma agreed to omit these OIDs,
because they could not provide us with test URLS for these OIDs.

See bug 562399 comment 19 and 20.
Comment on attachment 494393 [details] [diff] [review]
Patch v2

Now that NSS 3.12.9 (beta) has been landed, and the new roots are available, we're ready to get these enabled for EV.
Attachment #494393 - Flags: approval2.0?
Whiteboard: [waiting-for-nss-3.12.9-landing]
Attachment #494393 - Flags: approval2.0? → approval2.0+
http://hg.mozilla.org/mozilla-central/rev/79eacfd734ea
Status: NEW → RESOLVED
Closed: 9 years ago
Resolution: --- → FIXED
Attachment #494393 - Flags: approval1.9.2.15?
Attachment #494393 - Flags: approval1.9.1.18?
Is there a way I can test this to mark this bug VERIFIED?
(In reply to comment #9)
> You should get green EV identity status at
> https://testserver.universal-iii.trustcenter.de/
> https://www.camerfirma.com/
> https://server3.camerfirma.com/

Thanks.  Verified FIXED with Firefox 4.0b12pre 20110221.
Status: RESOLVED → VERIFIED
Comment on attachment 494393 [details] [diff] [review]
Patch v2

Approved for 1.9.2.15 and 1.9.1.18, a=dveditz for release-drivers
Attachment #494393 - Flags: approval1.9.2.15?
Attachment #494393 - Flags: approval1.9.2.15+
Attachment #494393 - Flags: approval1.9.1.18?
Attachment #494393 - Flags: approval1.9.1.18+
The "3.6.15" we're releasing today does not fix this bug, the release containing this bug fix has been renamed to "3.6.16" and the bugzilla flags will be updated to reflect that soon. Today's release is a re-release of 3.6.14 plus a fix for a bug that prevented many Java applets from starting up.
You need to log in before you can comment on or make changes to this bug.