SecurityEngineering/mozpkix-testing

MozPKIX

Network Security Services (NSS) is a set of libraries designed to support cross-platform development of security-enabled client and server applications. Applications built with NSS can support SSL v2 and v3, TLS, PKCS #5, PKCS #7, PKCS #11, PKCS #12, S/MIME, X.509 v3 certificates, OCSP, PKIX, and other security standards.

NSS currently has two code paths for doing certificate verification. "Classic" verification has been used for verification of non-EV certificates, and libPKIX has been used for verification of EV certificates.

As many of you are aware, the NSS team has wanted to replace the "classic" verification with libPKIX for a long time. However, the current libPKIX code was auto-translated from Java to C, and has proven to be very difficult to work with. Therefore, Mozilla has created a new certificate verification library called mozpkix.

Request for Testing

Replacing the certificate verification library can only be done after gaining sufficient confidence in the new code by having as many people test it as possible. So we ask that all of you help us test this new library as follows.

1. Download Firefox 30 or later
   • Browse to ftp://ftp.mozilla.org/pub/firefox/tinderbox-builds/
   • Scroll down to mozilla-aurora-<platform>-debug and select the folder that matches the platform you are working on.
   • Select the most recent build in the list.
   • Download by selecting the .tar.bz2 (Linux), .dmg (Mac), or .exe (Windows) file.
   • After downloading, extract and run this debug browser, which will be called FirefoxAuroraDebug.
2. Flip switch to enable mozpkix verification
   • Open about:config in Firefox, http://kb.mozillazine.org/About:config
   • Add a new Boolean Preference "security.use_insanity_verification", setting it to true.
   • Add a new Boolean Preference "security.use_libpkix_verification", setting it to true.
3. Restart FirefoxAuroraDebug
4. Browse to various websites with known valid and expired/revoked/etc SSL certificates.
5. If you don't get the expected result, then try again without using mozpkix to see if the unexpected result is actually due to mozpkix.
   • Either quit FirefoxAuroraDebug, and start Firefox 29 or earlier.
   • Or set the two preferences that you added in about:config to false and restart FirefoxAuroraDebug.
6. If you find an issue, please file a Bugzilla bug (https://bugzilla.mozilla.org/enter_bug.cgi) with Product= ? and Component= ?
7. When you are done testing, reset the two preferences that you added in about:config and restart your Firefox browser.

Check if mozpkix is being used

• With your browser correctly set to use mozpkix, browsing to this example URL will result in....
• When your browser is not set to use mozpkix, browsing to this example URL will result in...

Request for Code Review

The mozpkix code can be found ....

- High level description of the folders/files/classes - Suggestions on what to look for