Repository navigation
tools: generate distrust-after dates from certdata.txt - #67414
Draft
UlisesGascon wants to merge 2 commits into
Draft
UlisesGascon wants to merge 2 commits into
UlisesGascon wants to merge 2 commits into
Conversation
Mozilla keeps emSign Root CA - G1, Izenpe.com and Firmaprofesional CIF A62634068 in its root store but distrusts TLS server certificates they issued after 2026-11-16, 2026-04-15 and 2026-08-06 respectively (CKA_NSS_SERVER_DISTRUST_AFTER). tools/mk-ca-bundle.pl does not carry that attribute into node_root_certs.h, so Node.js keeps accepting new certificates from these roots that browsers reject. Add a distrust-after table next to the SPKI blocklist in the certificate verify callback. When a client verifies a server chain through a listed key and the leaf's notBefore is after the key's cutoff, the chain fails with CERT_REVOKED; certificates issued up to the cutoff keep working. Client certificates are not affected: the attribute is Mozilla's server authentication policy, the roots stay trusted anchors otherwise, and this matches the scope of the 2016 StartCom/WoSign cutoff. Node.js has no Certificate Transparency checking, so a backdated notBefore is not detected, as with that cutoff. Fixes: nodejs#67391 Refs: https://bugzilla.mozilla.org/show_bug.cgi?id=2089115 Assisted-by: Claude, Codex, Mistral Signed-off-by: Ulises Gascon <ulisesgascongonzalez@gmail.com>
Mozilla's CKA_NSS_SERVER_DISTRUST_AFTER dates are enforced by the distrust-after table in src/crypto/crypto_context.cc, which so far had to be typed by hand: find the root in certdata.txt, hash its public key, convert the date to an epoch. The emSign G1 entry was first written with the wrong year, which is the kind of slip a generator avoids. Add tools/mk-root-certs-distrust.mjs, which reads tools/certdata.txt and src/node_root_certs.h and writes src/node_root_certs_distrust.h with one entry per bundled root that carries a distrust-after date. The verify callback includes that header as kDistrustAfterBundled and keeps the hand-written table for dates Mozilla publishes between NSS releases and for the test fixture. update-root-certs.mjs runs the generator after mk-ca-bundle.pl and reports date changes in the commit message it produces, so the weekly root-certificates job picks new dates up with no extra step. A test regenerates the header and fails when the committed copy is out of date with certdata.txt. With the current certdata.txt snapshot the generated table holds Izenpe.com only; emSign Root CA - G1 and Firmaprofesional stay in the hand-written table until the next root certificate update brings their dates in. Refs: nodejs#67391 Assisted-by: Claude, Codex, Mistral Signed-off-by: Ulises Gascon <ulisesgascongonzalez@gmail.com>
Collaborator
|
Review requested:
|
nodejs-github-bot
added
c++
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The distrust-after table added in #67412 had to be typed by hand: find the root in
certdata.txt, hash its public key, convert the date to an epoch. The first draft of the G1 entry had the wrong year.This adds
tools/mk-root-certs-distrust.mjs, which readstools/certdata.txtandsrc/node_root_certs.hand writessrc/node_root_certs_distrust.hwith one entry per bundled root that carries a distrust-after date. The verify callback includes that header; the hand-written table shrinks to dates Mozilla publishes between NSS releases and the test fixture.update-root-certs.mjsruns the generator aftermk-ca-bundle.pland lists date changes in the commit message it produces, so the weeklyroot-certificatesjob picks new dates up with no extra step. A test regenerates the header and fails when the committed copy is out of date withcertdata.txt.With the current
certdata.txtsnapshot the generated header holds Izenpe.com only. emSign Root CA - G1 and Firmaprofesional stay in the hand-written table until the next root certificate update brings their dates in, at which point those two entries can be dropped.Depends on
This branch includes the commit (c67c30c) from #67412, which must land first. Only the second commit (93d1f5d) is for review here.
mainContext
Refs: #67391
Assisted-by: Claude, Codex, Mistral