Enterprise Policy for Issuing CA Exemption for CT |
|||
Issue descriptionAs captured in the discussion and summary at https://groups.google.com/a/chromium.org/d/msg/ct-policy/_YJiQNyuNAk/X9mLva7GBQAJ , express an additional Enterprise Policy for carving out CT exemptions, based on the Issuer SPKI hash. Currently (pre-Chrome 67), the policy available is CertificateTransparencyEnforcementDisabledForUrls , which allows excluding by domain names, but has restrictions on the form of that expression (such as disallowing blanket wildcards) Based on that discussion, the proposal is to allow an exception to be expressed based on SPKI. To avoid risk from both coercion and misissuance, this policy should be such that in order for this policy to apply, an intermediate within the certificate chain MUST identify the organization (that is, an O within the Distinguished Name), validated according to the CA/Browser Forum requirements, and that the leaf certificate being verified should similarly have that. There's some complexity in just doing a byte-for-byte O identifier - a more proper expression is one that adheres to the BRs' notion of Subject Organization Identity (see BRs 7.1.4.2.1)
,
Apr 6 2018
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/c8889d0e8f2e63eff73ee6b7b10b56b45b3fe356 commit c8889d0e8f2e63eff73ee6b7b10b56b45b3fe356 Author: Ryan Sleevi <rsleevi@chromium.org> Date: Fri Apr 06 17:57:05 2018 Glue up additional Certificate Transparency Enterprise Policies https://crrev.com/548318 introduced two additional preferences for controlling Certificate Transparency disabling, and this glues up these preferences to Enterprise Policies - specifically, CertificateTransparencyEnforcementDisabledForCas and CertificateTransparencyEnforcementDisabledForLegacyCas BUG= 824184 Change-Id: I06338e82c8280db21f1b48e9455074d020f51f83 Reviewed-on: https://chromium-review.googlesource.com/998546 Commit-Queue: Ryan Sleevi <rsleevi@chromium.org> Reviewed-by: Bartosz Fabianowski <bartfab@chromium.org> Cr-Commit-Position: refs/heads/master@{#548852} [modify] https://crrev.com/c8889d0e8f2e63eff73ee6b7b10b56b45b3fe356/chrome/browser/policy/configuration_policy_handler_list_factory.cc [modify] https://crrev.com/c8889d0e8f2e63eff73ee6b7b10b56b45b3fe356/chrome/browser/policy/policy_browsertest.cc [modify] https://crrev.com/c8889d0e8f2e63eff73ee6b7b10b56b45b3fe356/chrome/test/data/policy/policy_test_cases.json [modify] https://crrev.com/c8889d0e8f2e63eff73ee6b7b10b56b45b3fe356/components/policy/resources/policy_templates.json [modify] https://crrev.com/c8889d0e8f2e63eff73ee6b7b10b56b45b3fe356/tools/metrics/histograms/enums.xml
,
Apr 6 2018
,
Apr 9 2018
|
|||
►
Sign in to add a comment |
|||
Comment 1 by bugdroid1@chromium.org
, Apr 5 2018