OneCRL

[Gervase Markham]

OneCRL is Mozilla's push-based revocation system. Up to now, it's been a
little bit opaque. Thanks to the ever-excellent Rob Stradling, we now
have a web page showing all the certs in OneCRL:
https://crt.sh/mozilla-onecrl
This shows what's on it, and information about why by linking to the
relevant bugs.

If you want to download OneCRL yourself, the URL is:
https://firefox.settings.services.mozilla.com/v1/buckets/blocklists/collections/certificates/records
It's JSON.

Gerv

[Adrian R.]

Is there any way of allowing users to add locally on their machine a certificate to the OneCRL scope? (but don't allow local scope to override the mozilla-published one - it should always have priority)

back in september i revoked locally on my machine the WoSign roots and i tried to use the new certificate manager addon but not even that was able to revoke the WoSign cross-sign.

https://github.com/sidstamm/FirefoxCertificateManager/issues/56

how can i revoke locally such intermediates without revoking the root CA itself?

Adrian R.

[Gervase Markham]

On 16/11/16 23:33, Adrian R. wrote:
> Is there any way of allowing users to add locally on their machine a
> certificate to the OneCRL scope? (but don't allow local scope to
> override the mozilla-published one - it should always have priority)

I don't understand this. OneCRL is a revocation list, not a trust list.
So what would it mean to "not allow local scope to override the Mozilla
scope"? If you were able to "locally" add a cert to OneCRL, how could
that ever be overridden by the Mozilla list?

> back in september i revoked locally on my machine the WoSign roots
> and i tried to use the new certificate manager addon but not even
> that was able to revoke the WoSign cross-sign.
>
> https://github.com/sidstamm/FirefoxCertificateManager/issues/56
>
> how can i revoke locally such intermediates without revoking the root
> CA itself?

OneCRL is not the right route for this. I suspect the answer is that you
need to import the cross-sign cert into your certificate manager and
explicitly mark it as untrusted. On the Authorities tab in Certificate
Manager, use the "Import" button, and then later the "Edit Trust" button
and uncheck all boxes.

Gerv