975777 - Active distrust is considered an overridable error

Status: RESOLVED WORKSFORME

(Core :: Security: PSM, defect)

Description

[Brian Smith (:briansmith, :bsmith, use NEEDINFO?)]

From my addition to test_cert_overrides.js in bug 975122:

  // XXX(Bug XXXXX): Active distrust is an overridable error when NSS-based
  // verification is used.
  add_distrust_override_test("tlsserver/default-ee.der",
                             "untrusted.example.com",
                             getXPCOMStatusFromNSS(SEC_ERROR_UNTRUSTED_CERT),
                             useInsanity
                                ? getXPCOMStatusFromNSS(SEC_ERROR_UNTRUSTED_CERT)
                                : Cr.NS_OK);

  // XXX(Bug XXXXX): Active distrust is an overridable error when NSS-based
  // verification is used.
  add_distrust_override_test("tlsserver/other-test-ca.der",
                             "untrustedissuer.example.com",
                             getXPCOMStatusFromNSS(SEC_ERROR_UNTRUSTED_ISSUER),
                             useInsanity
                                ? getXPCOMStatusFromNSS(SEC_ERROR_UNTRUSTED_ISSUER)
                                : Cr.NS_OK);

Since this bug is fixed, let's make it depend on insanity::pkix.

Comment 1

[Brian Smith (:briansmith, :bsmith, use NEEDINFO?)]

Fixed by switching to mozilla::pkix.