After mar signing is used on Linux (it already is on Mac and Windows) the cert checks can be disabled in bug 1151485. After that has baked for a short while the custom cert checking code can be removed from app update.

The Firefox preferences should also be cleaned up in this bug

Filed bug 1189843 and bug 1189845 for Thunderbird and SeaMonkey to remove the cert checks. This bug doesn't depend on those bugs being fixed since app update will still work for those apps when this code is removed though it will remove the security mitigation.

If for whatever reason mar signing is not implemented then real cert pinning should be implemented. We didn't do this for Firefox aus since it has the same problems as the custom cert check. See bug bug 1063111

Pushed to try https://treeherder.mozilla.org/#/jobs?repo=try&revision=1386b4a18f94

Comment on attachment 8780467 [details] [diff] [review] nsISecurityUITelemetry changes Hi Dan, as you might recall we no longer use the custom certificate attribute check code since it causes issues with some use cases and rely on mar signing instead. The patches in this bug remove the checks and there is one change in nsISecurityUITelemetry.idl that I am hoping you are ok with reviewing. Thanks!

Comment on attachment 8781905 [details] [diff] [review] test changes rev1 Try push https://treeherder.mozilla.org/#/jobs?repo=try&revision=1386b4a18f94&selectedJob=25870034

Comment on attachment 8781905 [details] [diff] [review] test changes rev1 Review of attachment 8781905 [details] [diff] [review]: ----------------------------------------------------------------- Everything looks good and the try push is green, so I'm happy. Thanks!

Bug 1295896 removes several tests that would also need to be modified so adding dependency.

Forgot to hg remove a couple of tests. Carrying forward r+

Matt, forgot to remove this no longer available preference from firefox.js

Comment on attachment 8782172 [details] [diff] [review] Firefox preference Review of attachment 8782172 [details] [diff] [review]: ----------------------------------------------------------------- No problem; I saw your comment saying this needed to be removed, and then I also forgot about it.

Comment on attachment 8780467 [details] [diff] [review] nsISecurityUITelemetry changes Review of attachment 8780467 [details] [diff] [review]: ----------------------------------------------------------------- r=dveditz

Pushed by rstrong@mozilla.com: https://hg.mozilla.org/integration/mozilla-inbound/rev/4bd0ad73562b nsISecurityUITelemetry.idl - Remove custom cert check code from app update. r=dveditz https://hg.mozilla.org/integration/mozilla-inbound/rev/1bf5bb2dc20d client code - Remove custom cert check code from app update. r=mhowell https://hg.mozilla.org/integration/mozilla-inbound/rev/4b648a542bfb test code - Remove custom cert check code from app update. r=mhowell https://hg.mozilla.org/integration/mozilla-inbound/rev/b717faf86fe7 Firefox preference removal - Remove custom cert check code from app update. r=mhowell

https://hg.mozilla.org/mozilla-central/rev/4bd0ad73562b https://hg.mozilla.org/mozilla-central/rev/1bf5bb2dc20d https://hg.mozilla.org/mozilla-central/rev/4b648a542bfb https://hg.mozilla.org/mozilla-central/rev/b717faf86fe7