775827 - Make default behavior of libpkix-based revocation checking match the default behavior when the classic certificate validation library is used.

Status: RESOLVED INVALID

(Core :: Security: PSM, defect)

Description

[Brian Smith (:briansmith, :bsmith, use NEEDINFO?)]

The patch in bug 479393 changes the revocation checking behavior of Firefox when libpkix is enabled. In non-libpkix mode, we did not do fetching of intermediate certificates' OCSP information. In libpkix mode, we do the fetching. There is no current combination of prefs that results in Firefox's old behavior.

Before we switch to libpkix as the default, we need to restore the old revocation information fetching behavior so that we do not regress performance and so that we do not add any unnecessary chances for regressions.

We can re-enable the revocation checking of intermediate certificates by default later if/when we have agreement that Firefox should behave that way.

Comment 1

[Brian Smith (:briansmith, :bsmith, use NEEDINFO?)]

Attachment: WIP: Disable intermediate certificate revocation info fetching in libpkix mode by default

Here's the patch I wrote a while ago showing how I intend it to work. I still need to clean it up.

Comment 2

[Kathleen Wilson]

If I'm reading this correctly, then making this change will impact EV Revocation Checking. (https://wiki.mozilla.org/CA:EV_Revocation_Checking)

Currently OCSP must also work for the intermediate certificates, and a failed OCSP response will result in EV treatment not being given.

We should make sure that the patch for this bug does not remove revocation checking of intermediate certs for EV.

Comment 3

[Brian Smith (:briansmith, :bsmith, use NEEDINFO?)]

The code that validates EV certificates has its own revocation policy and it would not be affected by this change:
http://mxr.mozilla.org/mozilla-central/source/security/manager/ssl/src/nsIdentityChecking.cpp?rev=4a432c2d1b41#1186

Comment 4

[Brian Smith (:briansmith, :bsmith, use NEEDINFO?)]

We'll be removing the option to remove libpkix as part of the switch to insanity::pkix.