967175 - Remove EV entries for ValiCert roots removed in bug 936304

Status: RESOLVED FIXED

(Core :: Security: PSM, defect)

Description

[Brian Smith (:briansmith, :bsmith, use NEEDINFO?)]

Attachment: remove-valicert-ev.patch

Kathleen, besides removing these entries, we should also remove the EV entries for all/any other 1024-bit roots, since they can't meet the EV requirements (2048 keys are required), right?

Comment 1

[Kathleen Wilson]

Comment on attachment 8369619 [details] [diff] [review]
remove-valicert-ev.patch

Review of attachment 8369619 [details] [diff] [review]:
-----------------------------------------------------------------

Yes, we need to remove the EV entries for the "ValiCert Class 2 Policy Validation Authority" root, which is being removed from NSS in Bug #936304. As you noticed, it had two EV policy OIDs associated with it.

I just checked through the spreadsheet of included roots (http://www.mozilla.org/en-US/about/governance/policies/security-group/certs/included/) and found that none of the other 1024-bit root certs were enabled for EV.

Thanks!

Comment 2

[Brian Smith (:briansmith, :bsmith, use NEEDINFO?)]

https://hg.mozilla.org/integration/mozilla-inbound/rev/244ec084065b

Comment 3

[Kathleen Wilson]

Brian, thanks for catching this issue and fixing it. One question though...

This root cert is supposed to be removed in FF29. 
What will happen if the root cert is removed, but the EV entries are still there?

Comment 4

[Brian Smith (:briansmith, :bsmith, use NEEDINFO?)]

Comment on attachment 8369619 [details] [diff] [review]
remove-valicert-ev.patch

[Approval Request Comment]
Bug caused by (feature/regressing bug #): This needs to be uplifted to Firefox 29 so that we can uplift NSS 3.16 to Firefox 29. We have to uplift NSS 3.16 to Firefox 29 because we'd promised that we would remove these root certificates (and others) in Firefox 29.

User impact if declined: Cannot remove root certificates with weak keys.

Testing completed (on m-c, etc.): This problem was caught by automated tests (test_ev_certs.js, in particular). This just landed on mozilla-inbound a few minutes ago.

Risk to taking this patch (and alternatives if risky): This is a very safe change. At worst, some certificates that looked like EV certificates previously will no longer look like EV certificates. However, those certificates should never have looked like EV certificates anyway, because the root was using a weak key, which isn't allowed for EV certificates.

String or IDL/UUID changes made by this patch: None.

Comment 5

[Brian Smith (:briansmith, :bsmith, use NEEDINFO?)]

(In reply to Kathleen Wilson from comment #3)
> Brian, thanks for catching this issue and fixing it. One question though...
> 
> This root cert is supposed to be removed in FF29. 
> What will happen if the root cert is removed, but the EV entries are still
> there?

This bug has to be fixed in Firefox 29 before NSS 3.16 can be landed in Firefox 29. Otherwise, Firefox debug builds will refuse to start up. (This is how I noticed the problem in the first place.)

Comment 6

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/244ec084065b

Comment 7

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-aurora/rev/be8f5e520731