Skip to content
This repository has been archived by the owner on Apr 3, 2020. It is now read-only.

crosswalk-23: Stop enforcing Certificate Transparency verification #3966

Merged

Conversation

rakuco
Copy link
Member

@rakuco rakuco commented Dec 15, 2016

Chromium started enforcing some Certificate Transparency policies by default
in M53, and refuses to load certain websites when the CT verification fails
while establishing the TLS connection; this affected Crosswalk because we
were using the default CT verifier and policy enforcer, but we did not add
any of the logs approved by the Chromium project (see
net/cert/ct_known_logs_static-inc.h).

Instead of doing so, stop requiring websites to pass Chromium's Certificate
Transparency checks altogether after getting some clarification from
upstream. The biggest impediment to us following Chromium's policy is that
Crosswalk's release cycle would need to match Chromium's very closely to
avoid two risks:

  1. Chromium approves new CT logs, they start being used in new certificates,
    Crosswalk does not recognize the new logs and refuses to load a website
    with a valid certificate.
  2. Chromium disqualifies a CT log, while Crosswalk does not and can end up
    trusting a certificate that Chromium no longer trusts.

Additionally, the aforementioned list of built-in logs that Chromium uses
stops being recognized 70 days after the build date, which can lead our
users to a false sense of security if they do not update their own apps with
a more recent Crosswalk (which we might not even have released yet).

See the discussion in https://crbug.com/669978 for more information.

BUG=XWALK-7398

(cherry picked from commit 1c749f9)

Chromium started enforcing some Certificate Transparency policies by default
in M53, and refuses to load certain websites when the CT verification fails
while establishing the TLS connection; this affected Crosswalk because we
were using the default CT verifier and policy enforcer, but we did not add
any of the logs approved by the Chromium project (see
net/cert/ct_known_logs_static-inc.h).

Instead of doing so, stop requiring websites to pass Chromium's Certificate
Transparency checks altogether after getting some clarification from
upstream. The biggest impediment to us following Chromium's policy is that
Crosswalk's release cycle would need to match Chromium's very closely to
avoid two risks:
1) Chromium approves new CT logs, they start being used in new certificates,
   Crosswalk does not recognize the new logs and refuses to load a website
   with a valid certificate.
2) Chromium disqualifies a CT log, while Crosswalk does not and can end up
   trusting a certificate that Chromium no longer trusts.

Additionally, the aforementioned list of built-in logs that Chromium uses
stops being recognized 70 days after the build date, which can lead our
users to a false sense of security if they do not update their own apps with
a more recent Crosswalk (which we might not even have released yet).

See the discussion in https://crbug.com/669978 for more information.

BUG=XWALK-7398

(cherry picked from commit 1c749f9)
@rakuco
Copy link
Member Author

rakuco commented Dec 15, 2016

@xzhan96 @fujunwei @lincsoon @darktears

@rakuco
Copy link
Member Author

rakuco commented Dec 19, 2016

@xzhan96 @fujunwei @lincsoon @darktears reping

@xzhan96
Copy link
Contributor

xzhan96 commented Dec 20, 2016

lgtm

@rakuco rakuco merged commit 91a149c into crosswalk-project:crosswalk-23 Dec 20, 2016
@rakuco rakuco deleted the xw23-do-not-enforce-ct-checks branch December 20, 2016 08:23
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants