773477 - Create automated tests for verification of MD5-based certificates

Status: RESOLVED WORKSFORME

(Core :: Security: PSM, defect)

Description

[Brian Smith (:briansmith, :bsmith, use NEEDINFO?)]

In bug 650355, we soft-block MD5-based certificates because MD5 is not considered a secure hash algorithm anymore. We need to have automated tests for this bug we don't have the infrastructure for it yet. We need to build that infrastructure and then build tests on it.

Comment 1

[Henrik Skupin [:whimboo][⌚️UTC+1]]

Brian, how long will it take for you to setup the infrastructure? Is it a time frame of a couple of days or weeks only? I wonder if it is worth working on a Mozmill test, but don't want to waste our time if those tests in the tree could be implemented sooner than later.

Comment 2

[Brian Smith (:briansmith, :bsmith, use NEEDINFO?)]

Is this not already being tested somewhere? Can you dupe this to the bug that added the test for this?

Comment 3

[Camilo Viecco (:cviecco)]

We dont check for md5 signaures. We do test for correctness of different signatures using sha256.  signatures.

Comment 4

[Dana Keeler (she/her) (use needinfo) [:keeler] (on leave)]

Well, we do have this: http://hg.mozilla.org/mozilla-central/diff/b6aa1e70e482/security/manager/ssl/tests/unit/test_cert_overrides.js#l1.73 added in bug 967975.

Comment 5

[Camilo Viecco (:cviecco)]

Why not enhance security/manager/ssl/tests/unit/test_cert_signatures.js ?

Comment 6

[Dana Keeler (she/her) (use needinfo) [:keeler] (on leave)]

I think we have sufficient coverage for this.