:Cykesiopka Assignee
	Description • 9 years ago

Bug 1145679 disallowed any EV EE cert that had a validity period longer than 39 months from having EV status.

According to https://cabforum.org/2015/10/07/2015-10-07-face-to-face-meeting-minutes-meeting-36-istanbul/#Certificate-Validity-Periods, no change to the EV Guidelines will be made to bump max EV validity periods to 39 months:
> Certificate Validity Periods
> [...]
> •As a result, Kirk will not propose any change in cert validity periods.

I also have not seen any indications for bumping the limit in the archives of the CABF public mailing list at https://cabforum.org/pipermail/public/.

As such, it seems to be a good time to lower the limit to the 27 months allowed by the EV Guidelines.

	:Cykesiopka Assignee
	Comment 1 • 9 years ago

Bug 1222903 - Reject EV status for EV EE certs that are valid for longer than 27 months as well.

	:Cykesiopka Assignee
	Comment 2 • 9 years ago

https://reviewboard.mozilla.org/r/24645/#review22217

::: security/manager/ssl/tests/unit/test_validity/moz.build:8
(Diff revision 1)
> -    'ev_ee_39_months-ev_int_60_months-evroot.pem',
> +    'ev_ee_28_months-ev_int_60_months-evroot.pem',

Oops, these two lines should be swapped.

	:Cykesiopka Assignee
	Comment 3 • 9 years ago

https://treeherder.mozilla.org/#/jobs?repo=try&revision=d5a2311a0409

	Dana Keeler (she/her) (use needinfo) [:keeler] (on leave)
	Comment 4 • 9 years ago

Comment on attachment 8684937 [details]
MozReview Request: Bug 1222903 - Reject EV status for EV EE certs that are valid for longer than 27 months as well.

https://reviewboard.mozilla.org/r/24645/#review22277

This looks good. I had a quick look at how many EV certificates this will downgrade (according to certificate transparency), and while it's non-zero, it's not too many (I've found about 60 so far, but there was a flaw in my script, so I'll re-run it tomorrow and have a more accurate number).

	:Cykesiopka Assignee
	Comment 5 • 9 years ago

(In reply to David Keeler [:keeler] (use needinfo?) from comment #4)
> This looks good. I had a quick look at how many EV certificates this will
> downgrade (according to certificate transparency), and while it's non-zero,
> it's not too many (I've found about 60 so far, but there was a flaw in my
> script, so I'll re-run it tomorrow and have a more accurate number).

It's slightly sad that this number isn't 0 when the EV GLs have been clear on this since the beginning, but oh well, at least the number isn't that high.

	:Cykesiopka Assignee
	Comment 6 • 9 years ago

+ Correctly sort moz.build test_certificates entries

	:Cykesiopka Assignee
	Comment 7 • 9 years ago

Thanks for the review!

https://treeherder.mozilla.org/#/jobs?repo=try&revision=2dc18de3fa85

	Pulsebot
	Comment 8 • 9 years ago

https://hg.mozilla.org/integration/mozilla-inbound/rev/63873a854287

	Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)
	Comment 9 • 9 years ago
bugherder

https://hg.mozilla.org/mozilla-central/rev/63873a854287

	Kohei Yoshino [:kohei]
	Comment 10 • 9 years ago

Posted the site compatibility doc: https://www.fxsitecompat.com/en-US/docs/2015/ev-certs-valid-for-more-than-27-months-will-be-treated-as-dv-certs/

	Jean-Yves Perrier [:teoli]
	Comment 11 • 9 years ago

Added an entry in:
https://developer.mozilla.org/en-US/Firefox/Releases/45#Security