760313 - Enable T-TeleSec GlobalRoot Class 3 root certificate for EV in PSM

Status: RESOLVED FIXED

(Core :: Security: PSM, enhancement)

Description

[Kathleen Wilson]

Per bug #669849 the request from T-Systems has been approved to enable the "T-TeleSec GlobalRoot Class 3" root certificate for EV use. Please make the corresponding changes to PSM.

The relevant information is as follows.

Friendly name: T-TeleSec GlobalRoot Class 3
SHA1 Fingerprint: 55:A6:72:3E:CB:F2:EC:CD:C3:23:74:70:19:9D:2A:BE:11:E3:81:D1
EV Policy OID: 1.3.6.1.4.1.7879.13.24.1
Test URL: https://root-class3.test.telesec.de

Comment 1

[Kathleen Wilson]

Carsten, Please confirm that the above information is correct.

Comment 2

[Carsten]

Happy to confirm that the presented data is correct.

Thanks,
Carsten

Comment 3

[Kathleen Wilson]

This root cert was included in FF 18. Ready for EV-enablement.

Comment 4

[Carsten]

Hi Kathleen,

I know you were busy with the latest CA communication the last weeks - anyway I would like to ask if there's any progress, as we are awaiting eagerly the EV enablement to start issuing EV certificates.

Comment 5

[Kathleen Wilson]

Honza, What information do you need about this?

The root cert was included in FF 18, so EV can be enabled for it anytime.

Comment 6

[Camilo Viecco (:cviecco)]

Attachment: add T systems, remove Wells Fargo (v1)

This patch enables EV treatment for the root cert indicated in this bug, and disables EV treatment for the root cert indicated in bug #797952. The patch was
included in a test build and tested by Kathleen

Comment 7

[Dana Keeler (she/her) [:keeler]]

Comment on attachment 744896 [details] [diff] [review]
add T systems, remove Wells Fargo (v1)

Review of attachment 744896 [details] [diff] [review]:
-----------------------------------------------------------------

The only inconsistent thing I see is the brace indentation, so as long as the data is correct, this looks good to me.

::: security/manager/ssl/src/nsIdentityChecking.cpp
@@ +644,5 @@
>      "VQQLDBBBLVRydXN0LW5RdWFsLTAzMRkwFwYDVQQDDBBBLVRydXN0LW5RdWFsLTAz",
>      "AWwe",
>      nullptr
>    },
> +{

This brace should be indented, right?

Comment 8

[Camilo Viecco (:cviecco)]

try build (all platforms all tests)
https://tbpl.mozilla.org/?tree=Try&rev=94c3c2d2f391

Comment 9

[Brian Smith (:briansmith, :bsmith, use NEEDINFO?)]

Comment on attachment 744896 [details] [diff] [review]
add T systems, remove Wells Fargo (v1)

Review of attachment 744896 [details] [diff] [review]:
-----------------------------------------------------------------

The removal of the Wells Fargo root needs to be split into a separate changeset for bug 797952. r+ for both patches.

Comment 10

[Dana Keeler (she/her) [:keeler]]

Attachment: patch

Split up patch for each change. Carrying over r+.

Comment 11

[Dana Keeler (she/her) [:keeler]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/f908d830e4c8

Comment 12

[David Baron :dbaron: (⌚️UTC-5, no longer working on Mozilla)]

https://hg.mozilla.org/mozilla-central/rev/f908d830e4c8