On 09/25/2009 06:55 PM, Nelson Bolyard wrote:
> On 2009-09-25 18:17 , Robert Relyea wrote:
>
>> On 09/25/2009 04:39 PM, Kathleen Wilson wrote:
>>
>>> Note that I am operating under the assumption that there is currently
>>> no way in NSS to mark a root certificate as “untrusted”. Please let me
>>> know if this assumption is incorrect.
>>>
>>>
>> There are 3 states we can report about a certificate: trusted, unknown,
>> and untrusted.
>>
> Bob, I suggest you look at this bug.
> https://bugzilla.mozilla.org/show_bug.cgi?id=distrust
>
> In short, it says that, while we have code in softoken that knows how
> to record (in legacy DBs) that a cert is actively distrusted, we don't
> know how to represent that or handle it outside of softoken.
>
Your last statement is only partially true. It is true that the cert
processing code only looks at is the cert trusted or not. I said as much
in my original post:
These are colapsed from all our potential sources of trust into: the
trust bit is own, or the trust bit is off. Certs in which the trust
bit is off can still be trusted if the cert itself is signed by
another cert which chains to a trusted root. For Root certs, trust
bit off means the root cert is not trusted.
That does not mean that a token saying a cert is actively distrusted
doesn't mean anything or isn't parsed. Currently CKT_NSS_UNTRUSTED get
effectively mapped to CKT_NSS_MUST_VERIFY. My discussion was reflecting
this fact. Even if we implemented code in the cert processing to handle
the untrusted case, there is, in fact, no semantic difference between
marking a self-signed root CKT_NSS_UNTRUSTED and marking it
CKT_NSS_MUST_VERIFY since there isn't anything for a root to chain too.
The bug you pointed out is still important because it allows us to turn
off rogue intermediates or single certificates, but it's not important
in the case of root certs.
( historical note: The legacy DB's have the ability to mark a cert as
distrusted in order to implement the CKT_NSS_UNTRUSTED value of a PKCS
#11 trust record. The stan pki code retains this value in the stan trust
record, but no one uses the stan trust record directly, only the old
nss3 trust bits. )
bob
--
dev-tech-crypto mailing list
dev-tech-crypto@lists.mozilla.org
https://lists.mozilla.org/listinfo/dev-tech-crypto
