New issue
Advanced search Search tips

Issue 796230 link

Starred by 12 users

Issue metadata

Status: Verified
Owner:
Closed: Dec 14
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux , Android , Windows , Chrome , Mac , Fuchsia
Pri: 1
Type: Bug

Blocked on:
issue 805460



Sign in to add a comment

Deprecate trust in Symantec certificates

Project Member Reported by rsleevi@chromium.org, Dec 19 2017

Issue description

As stated in https://security.googleblog.com/2017/09/chromes-plan-to-distrust-symantec.html , a phased approach to distrusting Symantec certificates will be followed.

This can be measured in three implementation phases:
1) Certificates issued after December 1, 2017 from Symantec's legacy infrastructure will not be trusted
2) Certificates issued before June 1, 2016 from Symantec's legacy infrastructure will not be trusted
3) All certificates issued from Symantec's legacy infrastructure will not be trusted.

In addition, one other technical constraint is added:
4) All certificates issued from Symantec's/DigiCert's new managed infrastructure must be CT Compliant to be trusted.

#1 and #4 cannot be completed until after Dec 1, 2017 - thus, M65.
#2 will be landed in M66.
#3 will be landed in M70.

This bug tracks the implementation progress of the complete distrust.
 
Project Member

Comment 1 by bugdroid1@chromium.org, Dec 23 2017

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/bd9ca31194ec20fdd4faa80518aa4c01a6ca4d89

commit bd9ca31194ec20fdd4faa80518aa4c01a6ca4d89
Author: Ryan Sleevi <rsleevi@chromium.org>
Date: Sat Dec 23 07:02:16 2017

Implement the first phase of Symantec Distrust

The outline of these details is captured in the blog post at
https://security.googleblog.com/2017/09/chromes-plan-to-distrust-symantec.html

The following behaviour changes are included:
 * DigiCert Global Root G2 (https://crt.sh/?caid=5885) and
   DigiCert Global Root G3 (https://crt.sh/?caid=5699) are treated as
   indepedently operated sub-CAs, as they were CAs already trusted on Chrome
   and Android, despite having been recently cross-signed by the legacy
   Symantec infrastructure. Their audits remain unchanged, and they are
   exempt from the CT requirement specific to Symantec.
 * DigiCert Transition RSA Root (https://crt.sh/?id=250864698) and
   DigiCert Transition ECC Root (https://crt.sh/?id=250864681) are treated
   as Managed Sub-CAs, subject to the Managed Partner Infrastructure policies.
   In particular, all certificates from these CAs are required to be
   "CT Qualified" in order to be trusted
 * All new certificates issued from the legacy Symantec infrastructure -
   excluding those CAs above and the pre-existing independent sub-CAs - issued
   on or after 2017-12-01 are not trusted.
 * Control over CT requirements uses the existing TransportSecurityState
   delegate methods.
 * Control over the phased trust status is expressed as a
   CertVerifier::Verify() flag.
 * Control over the CertVerifier::Verify() flag is exposed to the SSLConfig,
   by way of the (embedder-provided) SSLConfigService.

These changes are made for Chromium and Chrome on all supported platforms.
These changes are made for Cronet, where applicable to Cronet (changing trust,
but not changing CT enforcement, as Cronet doesn't opt-in to CT).
These changes are made for all content embedders by default, and they can
provide their own SSLConfigServices to change these behaviours if desired.

Consistent with Android WebView behaving functionally identical to the Android
system, these changes are not included in Android WebView. Any changes to trust
will propogate via System Updates or through opting-in to the Google Play
Services security provider, as described at
https://developer.android.com/training/articles/security-gms-provider.html

BUG= 796230 

Change-Id: Ib9afa2cfec88dfadb7ae2300487513097f78253d
Reviewed-on: https://chromium-review.googlesource.com/830767
Commit-Queue: Ryan Sleevi <rsleevi@chromium.org>
Reviewed-by: Emily Stark <estark@chromium.org>
Reviewed-by: Eric Roman <eroman@chromium.org>
Reviewed-by: Richard Coles <torne@chromium.org>
Cr-Commit-Position: refs/heads/master@{#526143}
[modify] https://crrev.com/bd9ca31194ec20fdd4faa80518aa4c01a6ca4d89/android_webview/browser/aw_browser_context.cc
[modify] https://crrev.com/bd9ca31194ec20fdd4faa80518aa4c01a6ca4d89/android_webview/browser/net/aw_url_request_context_getter.cc
[modify] https://crrev.com/bd9ca31194ec20fdd4faa80518aa4c01a6ca4d89/android_webview/browser/net/aw_url_request_context_getter.h
[add] https://crrev.com/bd9ca31194ec20fdd4faa80518aa4c01a6ca4d89/android_webview/browser/net/aw_url_request_context_getter_unittest.cc
[modify] https://crrev.com/bd9ca31194ec20fdd4faa80518aa4c01a6ca4d89/android_webview/test/BUILD.gn
[modify] https://crrev.com/bd9ca31194ec20fdd4faa80518aa4c01a6ca4d89/chrome/browser/ssl/ssl_browsertest.cc
[modify] https://crrev.com/bd9ca31194ec20fdd4faa80518aa4c01a6ca4d89/net/BUILD.gn
[modify] https://crrev.com/bd9ca31194ec20fdd4faa80518aa4c01a6ca4d89/net/cert/cert_verifier.h
[modify] https://crrev.com/bd9ca31194ec20fdd4faa80518aa4c01a6ca4d89/net/cert/cert_verify_proc.cc
[modify] https://crrev.com/bd9ca31194ec20fdd4faa80518aa4c01a6ca4d89/net/cert/cert_verify_proc_unittest.cc
[modify] https://crrev.com/bd9ca31194ec20fdd4faa80518aa4c01a6ca4d89/net/cert/symantec_certs.cc
[modify] https://crrev.com/bd9ca31194ec20fdd4faa80518aa4c01a6ca4d89/net/cert/symantec_certs.h
[modify] https://crrev.com/bd9ca31194ec20fdd4faa80518aa4c01a6ca4d89/net/cert/symantec_certs_unittest.cc
[modify] https://crrev.com/bd9ca31194ec20fdd4faa80518aa4c01a6ca4d89/net/data/ssl/certificates/README
[add] https://crrev.com/bd9ca31194ec20fdd4faa80518aa4c01a6ca4d89/net/data/ssl/certificates/dec_2017.pem
[modify] https://crrev.com/bd9ca31194ec20fdd4faa80518aa4c01a6ca4d89/net/data/ssl/scripts/generate-test-certs.sh
[modify] https://crrev.com/bd9ca31194ec20fdd4faa80518aa4c01a6ca4d89/net/data/ssl/symantec/README.md
[add] https://crrev.com/bd9ca31194ec20fdd4faa80518aa4c01a6ca4d89/net/data/ssl/symantec/excluded/8bb593a93be1d0e8a822bb887c547890c3e706aad2dab76254f97fb36b82fc26.pem
[add] https://crrev.com/bd9ca31194ec20fdd4faa80518aa4c01a6ca4d89/net/data/ssl/symantec/excluded/b94c198300cec5c057ad0727b70bbe91816992256439a7b32f4598119dda9c97.pem
[add] https://crrev.com/bd9ca31194ec20fdd4faa80518aa4c01a6ca4d89/net/data/ssl/symantec/managed/7cac9a0ff315387750ba8bafdb1c2bc29b3f0bba16362ca93a90f84da2df5f3e.pem
[add] https://crrev.com/bd9ca31194ec20fdd4faa80518aa4c01a6ca4d89/net/data/ssl/symantec/managed/ac50b5fb738aed6cb781cc35fbfff7786f77109ada7c08867c04a573fd5cf9ee.pem
[modify] https://crrev.com/bd9ca31194ec20fdd4faa80518aa4c01a6ca4d89/net/http/transport_security_state.cc
[modify] https://crrev.com/bd9ca31194ec20fdd4faa80518aa4c01a6ca4d89/net/http/transport_security_state_ct_policies.inc
[modify] https://crrev.com/bd9ca31194ec20fdd4faa80518aa4c01a6ca4d89/net/http/transport_security_state_unittest.cc
[modify] https://crrev.com/bd9ca31194ec20fdd4faa80518aa4c01a6ca4d89/net/ssl/ssl_config.cc
[modify] https://crrev.com/bd9ca31194ec20fdd4faa80518aa4c01a6ca4d89/net/ssl/ssl_config.h
[modify] https://crrev.com/bd9ca31194ec20fdd4faa80518aa4c01a6ca4d89/net/ssl/ssl_config_unittest.cc

Blocking: 797765
Status: Verified (was: Started)
Status: Assigned (was: Verified)
Where does 1) come from in https://security.googleblog.com/2017/09/chromes-plan-to-distrust-symantec.html? That exact inverse seems to be the case? "Site Operators that obtained a certificate from Symantec’s old infrastructure after June 1, 2016 are unaffected by Chrome 66 but will need to obtain a new certificate by the Chrome 70 dates described below."


"Additionally, by December 1, 2017, Symantec will transition issuance and operation of publicly-trusted certificates to DigiCert infrastructure, and certificates issued from the old Symantec infrastructure after this date will not be trusted in Chrome."
Blockedon: 805460
Blocking: -797765
Labels: -M-65 M-70
Labels: Target-70
Project Member

Comment 8 by bugdroid1@chromium.org, Jul 11

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/c671bf913c328f7788df5046dd7b81bee3e17a04

commit c671bf913c328f7788df5046dd7b81bee3e17a04
Author: Ryan Sleevi <rsleevi@chromium.org>
Date: Wed Jul 11 22:16:22 2018

Support disabling the remainder of the Symantec Legacy PKI

Introduce a base::Feature flag that controls how the
remainder of the Symantec Legacy PKI - that is, certs
issued on/after 2016-06-01 but before 2017-12-01 - are
handled.

Bug:  796230 
Change-Id: Iebe9976ace0dfcdfd02f844fdaf497cf67dde704
Reviewed-on: https://chromium-review.googlesource.com/1134037
Reviewed-by: David Benjamin <davidben@chromium.org>
Commit-Queue: Ryan Sleevi <rsleevi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#574370}
[modify] https://crrev.com/c671bf913c328f7788df5046dd7b81bee3e17a04/net/cert/cert_verify_proc.cc
[modify] https://crrev.com/c671bf913c328f7788df5046dd7b81bee3e17a04/net/cert/cert_verify_proc.h
[modify] https://crrev.com/c671bf913c328f7788df5046dd7b81bee3e17a04/net/cert/cert_verify_proc_unittest.cc

Project Member

Comment 9 by bugdroid1@chromium.org, Jul 24

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/4ea221486494c8e4b46784b52141ba48163a49f4

commit 4ea221486494c8e4b46784b52141ba48163a49f4
Author: Nick Harper <nharper@chromium.org>
Date: Tue Jul 24 09:56:16 2018

Replace certificate for multiple OID EV test

CertVerifyProcInternalTest.EVVerificationMultipleOID uses a certificate
from trustcenter.websecurity.symantec.com, but the test fails with the
upcoming Symantec Legacy PKI distrust. This replaces the test
certificate with another that has the 2.23.140.1.1 OID before
2.16.840.1.113733.1.7.23.6 in X509v3 Certificate Policies extension.

Bug:  705285 ,  796230 
Change-Id: I0ed5d50d727a712d7c38babdb9ecfdfd30d50cc5
Reviewed-on: https://chromium-review.googlesource.com/1147665
Commit-Queue: Ryan Sleevi <rsleevi@chromium.org>
Reviewed-by: Ryan Sleevi <rsleevi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#577471}
[modify] https://crrev.com/4ea221486494c8e4b46784b52141ba48163a49f4/net/BUILD.gn
[modify] https://crrev.com/4ea221486494c8e4b46784b52141ba48163a49f4/net/cert/cert_verify_proc_unittest.cc
[modify] https://crrev.com/4ea221486494c8e4b46784b52141ba48163a49f4/net/data/ssl/certificates/README
[add] https://crrev.com/4ea221486494c8e4b46784b52141ba48163a49f4/net/data/ssl/certificates/login.trustwave.com.pem
[delete] https://crrev.com/c44f810cbe81532a80b76259d267f063a253278f/net/data/ssl/certificates/trustcenter.websecurity.symantec.com.pem

Project Member

Comment 10 by bugdroid1@chromium.org, Jul 24

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/264209c0622c077caa2378b869e3ce41a9fd3fd2

commit 264209c0622c077caa2378b869e3ce41a9fd3fd2
Author: Nick Harper <nharper@chromium.org>
Date: Tue Jul 24 23:28:15 2018

Disable CertVerifyProcMacTest.MacKeychainReordering

TBR=mattm@chromium.org

Bug:  796230 , 867174
Change-Id: I4ece7e608e597c9455bac468f828bdee91233c16
Reviewed-on: https://chromium-review.googlesource.com/1149197
Reviewed-by: Nick Harper <nharper@chromium.org>
Commit-Queue: Nick Harper <nharper@chromium.org>
Cr-Commit-Position: refs/heads/master@{#577728}
[modify] https://crrev.com/264209c0622c077caa2378b869e3ce41a9fd3fd2/net/cert/cert_verify_proc_mac_unittest.cc

Project Member

Comment 11 by bugdroid1@chromium.org, Jul 25

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/ff77dbed6aa45f0a131a8119ae7317ae19c65706

commit ff77dbed6aa45f0a131a8119ae7317ae19c65706
Author: Ryan Sleevi <rsleevi@chromium.org>
Date: Wed Jul 25 01:27:51 2018

Distrust the remainder of the Symantec Legacy PKI

As previously communicated, and as documented at at
https://g.co/chrome/symantecpkicerts, certificates issued
by the Symantec Legacy PKI Infrastructure between
2016-06-01 and 2017-12-01 will no longer be trusted. This
changes the default state to remove trust in these
certificates. Certificates issued under the DigiCert
Managed PKI, or those from previously-identified,
independent third-party CAs, are not affected.

Bug:  796230 , 805460
Change-Id: I74bdecc9dfdd66dec1a111f9eddb830babfa8222
Reviewed-on: https://chromium-review.googlesource.com/1134209
Commit-Queue: Nick Harper <nharper@chromium.org>
Reviewed-by: Nick Harper <nharper@chromium.org>
Cr-Commit-Position: refs/heads/master@{#577764}
[modify] https://crrev.com/ff77dbed6aa45f0a131a8119ae7317ae19c65706/net/cert/cert_verify_proc.cc

Status: Verified (was: Assigned)

Sign in to add a comment