942918 - remove ev tests that use crl for revocation checks

Status: RESOLVED FIXED

(Core :: Security: PSM, defect)

Description

[Camilo Viecco (:cviecco)]

Part to the migration to EV only with OCSP checks

Comment 1

[Camilo Viecco (:cviecco)]

Attachment: remove-crl-ev-tests

Comment 2

[Camilo Viecco (:cviecco)]

Comment on attachment 8337863 [details] [diff] [review]
remove-crl-ev-tests

Review of attachment 8337863 [details] [diff] [review]:
-----------------------------------------------------------------

Not urgent as it depends on 927016

Comment 3

[Dana Keeler (she/her) (use needinfo) [:keeler] (on leave)]

Comment on attachment 8337863 [details] [diff] [review]
remove-crl-ev-tests

Review of attachment 8337863 [details] [diff] [review]:
-----------------------------------------------------------------

I don't think it's a good idea to remove these tests entirely - can we change the certificate to have an OCSP url that we respond on using functionality similar to the xpcshell tests we've been working on?

Comment 4

[Camilo Viecco (:cviecco)]

(In reply to David Keeler (:keeler) from comment #3)
> Comment on attachment 8337863 [details] [diff] [review]
> remove-crl-ev-tests
> 
> Review of attachment 8337863 [details] [diff] [review]:
> -----------------------------------------------------------------
> 
> I don't think it's a good idea to remove these tests entirely - can we
> change the certificate to have an OCSP url that we respond on using
> functionality similar to the xpcshell tests we've been working on?

With the exception of the UI part of the test, all of the tests here
are duplicated by the new xpcshell tests. Moving this to use OCSP is non
trivial and I talked to bsmith and he agrees removal is fine.

Setting up for re-review with this in mind.

Comment 5

[Dana Keeler (she/her) (use needinfo) [:keeler] (on leave)]

Comment on attachment 8337863 [details] [diff] [review]
remove-crl-ev-tests

Review of attachment 8337863 [details] [diff] [review]:
-----------------------------------------------------------------

lgtm. r=me with the comment nit.

::: security/manager/ssl/src/nsIdentityChecking.cpp
@@ +1135,5 @@
>  
>      entry.cert = CERT_FindCertByIssuerAndSN(nullptr, &ias);
>  
>  #ifdef DEBUG
> +    // The debug CA info are at position 0, and is NOT on the NSS root db

s/are/is/, s/on/in/

Comment 6

[Camilo Viecco (:cviecco)]

https://tbpl.mozilla.org/?tree=Try&rev=1057fe27d3a3

Comment 7

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/d58fa9a72f91