683455 - Dis-trust Entrust -> DigiNotar cross-certificate

Status: RESOLVED DUPLICATE of bug 682927

(NSS :: CA Certificates Code, task)

Description

[Gervase Markham [:gerv]]

Entrust wish us to dis-trust their cross-certificate of the DigiNotar CA. They have revoked it.

This may well not be strictly necessary due to the way we wrote the original patch, but Entrust have requested that we do it.

I will update this bug with more details of the cert in question when I have them.

Gerv

Comment 1

[Gervase Markham [:gerv]]

Please find attached the certificates that were issued and distributed to DigiNotar.

The issuer was Entrust.net Secure Server Certification Authority. 

The serial numbers are:

469c2cb0
469c2caf
469c3cc9

All have been revoked and the CRL can be found at http://crl.entrust.net/server1.crl.

Please let me know if you need any other information. 

Best regards,

Bruce Morton

Entrust Certificate Services
[phone]
http://ssl.entrust.net/blog/

Comment 2

[Gervase Markham [:gerv]]

Attachment: DigiNotar Root CA (1)

Comment 3

[Gervase Markham [:gerv]]

Attachment: DigiNotar Root CA (2)

Comment 4

[Gervase Markham [:gerv]]

Attachment: DigiNotar Services 1024 CA

Comment 5

[Kai Engert [:KaiE:]]

I confirm that I already know how to blocklist these certs in NSS, all 3 certs were on my list already, and I'm working on it.

We will use a carefully crafted fake-override cert for the former "DigiNotar Root CA", in a way that covers also certs with serials 469c2caf and 469c3cc9.

In addition, we must create a separate fake override cert to handle serial 469c2cb0.

I apologize that I have a steal a serial number from Entrust in order to do that.
I intend to produce a fake, explicitly untrusted cert, which uses the same issuer name as in 469c2cb0, and use serial number 0xfffffff.

I am currently working on this in bug 683261.

Comment 6

[Brian Smith (:briansmith, :bsmith, use NEEDINFO?)]

The patches from bug 682927 already blocks these certs for SSL (only) in an overridable way for PSM-based products.

Comment 7

[Gervase Markham [:gerv]]

Comment on attachment 557169 [details]
DigiNotar Root CA (1)

I don't want these certs to automatically install themselves when clicked on!

Gerv