997994 - mozilla::pkix: don't allow empty Extensions in OCSP responses

Status: NEW

(Core :: Security: PSM, defect, P3)

Description

[Dana Keeler (she/her) (use needinfo) [:keeler] (on leave)]

In bug 991898, it became apparent that at least two responders are generating OCSP responses with empty Extensions. For compatibility, we're temporarily allowing that. This bug is to undo this.

Comment 1

[Michael Comella (:mcomella) [NI reported issues only: ex-Mozilla]]

Attachment: Part 2: Factor out animation code that runs on all devices.

Further break out some shared animation code.

Comment 2

[Michael Comella (:mcomella) [NI reported issues only: ex-Mozilla]]

Comment on attachment 8409825 [details] [diff] [review]
Part 2: Factor out animation code that runs on all devices.

Sorry, bzexport typo.

Comment 3

[Dana Keeler (she/her) (use needinfo) [:keeler] (on leave)]

Turns out, when we switched to decoding certificates with mozilla::pkix, we re-used the code that decodes optional extensions. So, currently mozilla::pkix allows certificates to have empty Extensions as well.