921045 - Let's include the new update cert and remove the no longer used Equifax cert

Status: RESOLVED FIXED

(Firefox :: General, defect)

Description

[Alex Keybl [:akeybl]]

Let's include the new update cert and remove the Digicert cert when possible

Comment 1

[Alex Keybl [:akeybl]]

Hoping to land on mozilla-beta today, for our second to last beta

Comment 2

[Alex Keybl [:akeybl]]

This didn't get in in time, but I'd like us to keep this on the radar for resolution in 26 at least. It's just crufty to have the old cert lying around.

Comment 3

[Lukas Blakk [:lsblakk] use ?needinfo]

Rob can you get a patch up for this?

Comment 4

[Robert Strong (they/them - no direct email)]

Attachment: patch rev1

I moved the in use certificate to be the one in use and added the new certifcate.

Comment 5

[Robert Strong (they/them - no direct email)]

If this is uplifted it would be a "good thing" to also uplift bug 928489 especially since it landed over a month ago which removes this requirement for Windows while also solving bugs with some proxies and some corporate network configuration.

Comment 6

[Brian R. Bondy [:bbondy]]

Comment on attachment 8336657 [details] [diff] [review]
patch rev1

Review of attachment 8336657 [details] [diff] [review]:
-----------------------------------------------------------------

I have no way to validate the correctness of the issuers themselves, but the change itself looks logical to me.

Comment 7

[Robert Strong (they/them - no direct email)]

Pushed to fx-team
https://hg.mozilla.org/integration/fx-team/rev/5aad6e015530

Comment 8

[Robert Strong (they/them - no direct email)]

Comment on attachment 8336657 [details] [diff] [review]
patch rev1

This doesn't affect nightly or aurora since we are currently using aus4 for those channels.
[Approval Request Comment]
Bug caused by (feature/regressing bug #): the backup certificate could not be renewed (see bug 913918)
User impact if declined: No backup certificate if the current certificate is compromised. This can be mitigated with the add-on hotfix.
Testing completed (on m-c, etc.): Manually verified the digicert certificate.
Risk to taking this patch (and alternatives if risky): Small since this is for the backup certificate.
String or IDL/UUID changes made by this patch: None

Comment 9

[Lukas Blakk [:lsblakk] use ?needinfo]

(In reply to Robert Strong [:rstrong] (do not email) from comment #8)
> Comment on attachment 8336657 [details] [diff] [review]
> patch rev1
> 
> This doesn't affect nightly or aurora since we are currently using aus4 for
> those channels.
> [Approval Request Comment]
> Bug caused by (feature/regressing bug #): the backup certificate could not
> be renewed (see bug 913918)
> User impact if declined: No backup certificate if the current certificate is
> compromised. This can be mitigated with the add-on hotfix.
> Testing completed (on m-c, etc.): Manually verified the digicert certificate.
> Risk to taking this patch (and alternatives if risky): Small since this is
> for the backup certificate.
> String or IDL/UUID changes made by this patch: None

Wait, why is this nominated for aurora approval when you say it doesn't affect aurora?

Comment 10

[Robert Strong (they/them - no direct email)]

To keep the code the same across branches as well as in case releng decides to revert back to aus3.

Comment 11

[Robert Strong (they/them - no direct email)]

Attachment: patch for beta so it applies cleanly

Comment 12

[Robert Strong (they/them - no direct email)]

Attachment: patch for beta so it applies cleanly along with metro prefs

I'll land this either later tonight or tomorrow depending on when the trees reopen

Comment 13

[Robert Strong (they/them - no direct email)]

pushed to mozilla-aurora
https://hg.mozilla.org/releases/mozilla-aurora/rev/a55d3e9d16f3

pushed to mozilla-beta
https://hg.mozilla.org/releases/mozilla-beta/rev/bc209570134e

Comment 14

[Robert Strong (they/them - no direct email)]

DO you want this backported to esr?

Comment 15

[Matt Brubeck (:mbrubeck)]

https://hg.mozilla.org/mozilla-central/rev/5aad6e015530

Comment 17

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-b2g26_v1_2/rev/bc209570134e

Comment 18

[Lukas Blakk [:lsblakk] use ?needinfo]

For completeness it can't hurt to have this avenue available to us on 24esr if we should need it - please do.

Comment 19

[Lukas Blakk [:lsblakk] use ?needinfo]

Comment on attachment 8336657 [details] [diff] [review]
patch rev1

pre-approving for esr24 with the assumption that any major changes to the patch would be brought to our attention but otherwise this meets the same standards as the other channel approvals.

Comment 20

[Robert Strong (they/them - no direct email)]

Pushed to mozilla-esr24
https://hg.mozilla.org/releases/mozilla-esr24/rev/6d0561e56c03

I backed out my first push and repushed because I forgot to include the bug number... oops!
https://hg.mozilla.org/releases/mozilla-esr24/rev/13ddbd51b9b1
https://hg.mozilla.org/releases/mozilla-esr24/rev/c71b9afe744c

Comment 21

[Matt Wobensmith [:mwobensmith][:matt:]]

Confirmed new certs in about:config prefs, for debug builds only. I have only confirmed the presence of these prefs, not the functionality enabled by them.