Re: OCSP Checking for certificates without AIA URLs

Yep, that sounds right.  That pref no longer appears in the codebase.

http://searchfox.org/mozilla-central/search?q=security.OCSP.URL

As far as a new module: I'm afraid that won't help either.  Firefox does
certificate validation above the NSS layer, using the mozilla::pkix library
(as of a year or two ago).

On Mon, Oct 17, 2016 at 4:26 PM, Dan Bryan <[email protected]> wrote:

> On Monday, October 17, 2016 at 2:57:18 PM UTC-4, Dan Bryan wrote:
> > On Monday, October 17, 2016 at 2:02:27 PM UTC-4, Richard Barnes wrote:
> > > Hey Dan,
> > >
> > > There is nothing in Firefox to support this use case.  The live OCSP
> > > checking code [1] (vs. stapled) pulls the OCSP responder URL from AIA
> at
> > > validation time; there is no other way to configure a responder URL.
> > >
> > > --Richard
> > >
> > > [1]
> > > http://searchfox.org/mozilla-central/source/security/certverifier/
> NSSCertDBTrustDomain.cpp#518
> > > http://searchfox.org/mozilla-central/source/security/certverifier/
> NSSCertDBTrustDomain.cpp#565
> > >
> > > On Mon, Oct 17, 2016 at 12:10 PM, Dan Bryan <[email protected]>
> wrote:
> > >
> > > > Hello,
> > > > In a PKI where there are multiple private CA's that do not publish
> > > > revocation urls into the certificates AIA field, what options does
> Firefox
> > > > provide for using a 3rd party revocation service who has been
> delegated as
> > > > an OCSP authority for these CAs.
> > > > I would like to be able to say Private CA1-3 should query responder
> > > > http://ocsp1.com and Private CA4-5 should query http://ocsp2.com.
> This
> > > > flexibility has been offered in CAPI via group policy certificate
> > > > properties since vista. But being that firefox doesn't depend on
> CAPI for
> > > > certificate validation, is there anyway to configure NSS to support
> > > > something like this?
> > > >
> > > > Thanks,
> > > >
> > > > --Dan
> > > > _______________________________________________
> > > > dev-security mailing list
> > > > [email protected]
> > > > https://lists.mozilla.org/listinfo/dev-security
> > > >
> >
> > Thanks for the detailed info. I imagine it might be possible if a 3rd
> party Firefox "Security device" were loaded and developed to handle this
> use case, right? Or maybe an extension could be developed to make firefox
> think an AIA is present in a certificate?
>
> Richard,
>
> According to: http://kb.mozillazine.org/About:config_entries
> it looks like there are/were several options:
> security. OCSP. enabled = 2
> security. OCSP. URL = http://myresponder
>
> I attempted to configure these in about:config of firefox 47.0.1 and no
> requests went to my responder. This supports what your saying. I am
> guessing this was a feature that was enabled in the past, and is no longer
> present?
> _______________________________________________
> dev-security mailing list
> [email protected]
> https://lists.mozilla.org/listinfo/dev-security
>