Brian Smith (:briansmith, :bsmith, use NEEDINFO?) Assignee
	Description • 12 years ago

The patch in bug 479393 changes the revocation checking behavior of Firefox when libpkix is enabled. In non-libpkix mode, we did not do fetching of intermediate certificates' OCSP information. In libpkix mode, we do the fetching. There is no current combination of prefs that results in Firefox's old behavior.

Before we switch to libpkix as the default, we need to restore the old revocation information fetching behavior so that we do not regress performance and so that we do not add any unnecessary chances for regressions.

We can re-enable the revocation checking of intermediate certificates by default later if/when we have agreement that Firefox should behave that way.

	Brian Smith (:briansmith, :bsmith, use NEEDINFO?) Assignee
	Comment 1 • 12 years ago

Here's the patch I wrote a while ago showing how I intend it to work. I still need to clean it up.

	Kathleen Wilson
	Comment 2 • 12 years ago

If I'm reading this correctly, then making this change will impact EV Revocation Checking. (https://wiki.mozilla.org/CA:EV_Revocation_Checking)

Currently OCSP must also work for the intermediate certificates, and a failed OCSP response will result in EV treatment not being given.

We should make sure that the patch for this bug does not remove revocation checking of intermediate certs for EV.

	Brian Smith (:briansmith, :bsmith, use NEEDINFO?) Assignee
	Comment 3 • 12 years ago

The code that validates EV certificates has its own revocation policy and it would not be affected by this change:
http://mxr.mozilla.org/mozilla-central/source/security/manager/ssl/src/nsIdentityChecking.cpp?rev=4a432c2d1b41#1186

	Brian Smith (:briansmith, :bsmith, use NEEDINFO?) Assignee
	Comment 4 • 11 years ago

We'll be removing the option to remove libpkix as part of the switch to insanity::pkix.