875583 - add an API to expose a peer's certificate chain as sent on the wire

Status: RESOLVED DUPLICATE of bug 731485

(NSS :: Libraries, defect)

Description

[Dana Keeler (she/her) (use needinfo) [:keeler] (on leave)]

For the certificate error reporting feature, we need to be able to get a copy of the peer's certificate chain as it was sent to the client (this is distinct from the chain we calculate when verifying a peer's certificate). I propose a function called SSL_PeerCertChain that, given a PRFileDesc, returns a CERTCertList describing the peer's cert chain. This would be a deep copy that the caller takes ownership of.

Comment 1

[Dana Keeler (she/her) (use needinfo) [:keeler] (on leave)]

Attachment: patch

Wan-Teh, if you could review this or let me know who would be able to, that would be great. I would also appreciate guidance on what sort of locking or state checks need to be done when accessing the data this function accesses.
Thanks!

Comment 2

[Ryan Sleevi]

Marking this as a dupe of Bug #731485 (https://bugzilla.mozilla.org/show_bug.cgi?id=731485 ), which proposes a function of near identical name (SSL_PeerCertificateChain).

We've been using this in Chromium quite successfully, along with the patch from Bug #731478 ( https://bugzilla.mozilla.org/show_bug.cgi?id=731478 )