New issue
Advanced search Search tips

Issue 816543 link

Starred by 4 users

Issue metadata

Status: Verified
Owner:
Closed: Feb 2018
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: ----
Pri: 2
Type: Bug



Sign in to add a comment

Add command-line flag for testing CT Compliance

Project Member Reported by rsleevi@chromium.org, Feb 26 2018

Issue description

To assist CAs that wish to test their issuance practices and ensure the (new) certificates they are issuing are CT Compliant, provide a command-line flag to simulate CT Enforcement being required on a particular date.

This will allow CAs (and enterprises and site operators) to test their sites and certificates prior to the CT Enforcement Date.
 
Cc: asymmetric@chromium.org
Project Member

Comment 2 by bugdroid1@chromium.org, Feb 27 2018

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/ba39855616fae47148cf7da3c80d1dad6cf6e966

commit ba39855616fae47148cf7da3c80d1dad6cf6e966
Author: Ryan Sleevi <rsleevi@chromium.org>
Date: Tue Feb 27 00:16:13 2018

Add FieldTrial for CT Enforcement Testing/Configuration

This introduces a FieldTrial/Feature configuration that allows CAs
and site operators to simulate CT Enforcement on a particular date.
The use case is to allow the testing of a CA's issuance practices,
to ensure all newly-issued certificates are CT Compliant.

This can be enabled using the FieldTrial command-line flags of
chrome.exe --enable-features="EnforceCTForNewCerts<EnforceCTTrial" \
  --force-fieldtrials="EnforceCTTrial/Group1" \
  --force-fieldtrial-params="EnforceCTTrial.Group1:date/{date}"

Note that in the above syntax, "{date}" should be replaced with the
number of seconds since the Unix Epoch. For example,
"EnforceCTTrial.Group1:date/1512086400" enforces CT for all new certs
issued after 2017-12-01 00:00:00 UTC.

BUG= 816543 

Change-Id: I305ba604740d6d64738a2c4612dd40266776e3e2
Reviewed-on: https://chromium-review.googlesource.com/937689
Commit-Queue: Ryan Sleevi <rsleevi@chromium.org>
Reviewed-by: Eric Roman <eroman@chromium.org>
Cr-Commit-Position: refs/heads/master@{#539328}
[modify] https://crrev.com/ba39855616fae47148cf7da3c80d1dad6cf6e966/net/http/transport_security_state.cc
[modify] https://crrev.com/ba39855616fae47148cf7da3c80d1dad6cf6e966/net/http/transport_security_state_unittest.cc

Status: Verified (was: Started)

Sign in to add a comment