SecurityEngineering/Removing Compatibility Workarounds in mozilla::pkix: Difference between revisions
Jump to navigation
Jump to search
Draft
(fill out DER OPTIONAL BOOLEAN section) |
(fill out pathLenConstraint section) |
||
| Line 16: | Line 16: | ||
** Code affected: pkixcheck.cpp, pkixder.h, pkixcert.cpp, pkixocsp.cpp | ** Code affected: pkixcheck.cpp, pkixder.h, pkixcert.cpp, pkixocsp.cpp | ||
** Expected difficulty: difficult | ** Expected difficulty: difficult | ||
* pathLenConstraint when cA:False ( | * DER: pathLenConstraint included when cA:False | ||
** Workaround introduced in [https://bugzilla.mozilla.org/show_bug.cgi?id=985021 bug 985021] | |||
** Workaround to be removed in [https://bugzilla.mozilla.org/show_bug.cgi?id=985025 bug 985025] | |||
** Code affected: CheckIssuerIndependentProperties -> CheckBasicConstraints (pkixcheck.cpp) | |||
** Expected difficulty: easy | |||
* use of subject CN for naming information | * use of subject CN for naming information | ||
* Non-PrintableString/UTF8String in DNs | * Non-PrintableString/UTF8String in DNs | ||
* nameConstraints/subjectAlternativeName encoding mismatches | * nameConstraints/subjectAlternativeName encoding mismatches | ||
Revision as of 19:57, 28 October 2015
In the process of implementing mozilla::pkix, a number of compatibility issues were encountered involving certificates that did not conform to the Baseline Requirements. To maintain interoperability, some workarounds were added to allow these malformed or improper certificates to validate successfully. However, to improve the state of the web PKI, these workarounds will be removed. As of Firefox 49, if a certificate has a notBefore time after 0:00 21 August 2016 and is affected by any of these workarounds (see below), it will not validate successfully. This document will track the implementation work necessary to remove those workarounds.
- id-Netscape-stepUp in Extended Key Usage extension instead of id-kp-serverAuth
- Workaround introduced in bug 1006041
- Workaround to be removed in bug 982932
- Code affected: CheckIssuerIndependentProperties -> CheckExtendedKeyUsage -> MatchEKU (pkixcheck.cpp)
- Expected difficulty: easy
- DER: default value of OPTIONAL BOOLEAN explicitly encoded
- Workaround introduced in bug 989516 for Basic Constraints (cA field)
- Workaround introduced in bug 1060929 for Extension (critical field)
- Workaround to be removed in bug 989518
- Code affected: pkixcheck.cpp, pkixder.h, pkixcert.cpp, pkixocsp.cpp
- Expected difficulty: difficult
- DER: pathLenConstraint included when cA:False
- Workaround introduced in bug 985021
- Workaround to be removed in bug 985025
- Code affected: CheckIssuerIndependentProperties -> CheckBasicConstraints (pkixcheck.cpp)
- Expected difficulty: easy
- use of subject CN for naming information
- Non-PrintableString/UTF8String in DNs
- nameConstraints/subjectAlternativeName encoding mismatches