69903 - Need a way to look up certificate data

Status: VERIFIED FIXED

(Core Graveyard :: Security: UI, defect)

Description

[Mitchell Stoltz (not reading bugmail)]

To support the upcoming JS Security preferences UI, I need a way to ask PSM for
certificate data based on some unique ID for the certificate. AFAIK the only
time I can get a certificate's common name, expiration date, etc, is when I
verify that certificate against a hash of the signed document. I would like to
be able to do something like
commonName = GetCommonName(certID)
where CertID is some opaque string that uniquely identifies the cert.

Without this, I have to store all of the cert information in prefs, which is
redundant since it's already in PSM's cert database. With this feature i would
only have to store the unique ID string and get the rest of the cert data from
PSM as I need it. Is this doable?

Comment 1

[Mitchell Stoltz (not reading bugmail)]

setting milestone.

Comment 2

[John Unruh]

Reassigning.

Comment 3

[Javier Delgadillo]

mstoltz:  Perhaps you should take a look at PSM 2.0 work.  Look at
mozilla/security/manager/ssl/public/nsIX509Cert.idl to see if that's what you
need.

I doubt we'll retrofit such functionality into PSM 1.x

Comment 4

[Javier Delgadillo]

mstoltz:
can you look at the interfaces in
mozilla/security/manager/ssl/public/nsIX509Cert*.idl to see if they satisfy your
requirements?

Adding mcgreer to cc list because he has used those new interfaces to implement
the new Cert Manager and can offer advice if ned be.

Comment 5

[Mitchell Stoltz (not reading bugmail)]

Looks great, that's just what I need. How long is the dbKey good for? 'till the
program quits, or permanently?

Also, is there an interface for verifying PKCS7 signatures, and will it return
an nsIX509Cert?

Comment 6

[Javier Delgadillo]

with NSS, the dbKey will be good permanently.  If someone were to switch the
underlying implementation of nsIX509CertDB, then that's different.

ddrinan, do we have any plans on augmenting the signing interface to return
nsIX509Certificate?

Comment 7

[Javier Delgadillo]

Bumping target milesone

Comment 8

[David P. Drinan]

Mass changing of product. Browser:Security:Crypto --> PSM 2.0

Comment 9

[Mitchell Stoltz (not reading bugmail)]

PSM 2.0 is now a component of the browser like any other. Will it continue to be
a "product" in Bugzilla or will it become a component of the Browser product?

Comment 10

[Bob Lord]

Mitch, PSM is a component with several customers.  The browser is one of those
customers.  As a result, we need to track PSM progress with its own milestones.

My guess is that you'll see the other components adopts this model at some point.

Comment 11

[Javier Delgadillo]

mstoltz,

can we mark this bug "fixed?"

Comment 12

[David P. Drinan]

Fixed in 2.0

Comment 13

[John Unruh]

Verified.