security/certverifier/ExtendedValidation.cpp@b8a032363ba2
security/certverifier/ExtendedValidation.cpp
Thu, 22 Jan 2015 13:21:57 +0100
- author
- Michael Schloh von Bennewitz <michael@schloh.com>
- date
- Thu, 22 Jan 2015 13:21:57 +0100
- branch
- TOR_BUG_9701
- changeset 15
- b8a032363ba2
- permissions
- -rw-r--r--
Incorporate requested changes from Mozilla in review:
https://bugzilla.mozilla.org/show_bug.cgi?id=1123480#c6
1 /* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*-
2 *
3 * This Source Code Form is subject to the terms of the Mozilla Public
4 * License, v. 2.0. If a copy of the MPL was not distributed with this
5 * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
7 #include "ExtendedValidation.h"
9 #include "cert.h"
10 #include "certdb.h"
11 #include "base64.h"
12 #include "pkix/nullptr.h"
13 #include "pk11pub.h"
14 #include "secerr.h"
15 #include "prerror.h"
16 #include "prinit.h"
18 #ifdef PR_LOGGING
19 extern PRLogModuleInfo* gPIPNSSLog;
20 #endif
22 #define CONST_OID static const unsigned char
23 #define OI(x) { siDEROID, (unsigned char*) x, sizeof x }
25 struct nsMyTrustedEVInfo
26 {
27 const char* dotted_oid;
28 const char* oid_name; // Set this to null to signal an invalid structure,
29 // (We can't have an empty list, so we'll use a dummy entry)
30 SECOidTag oid_tag;
31 const unsigned char ev_root_sha1_fingerprint[20];
32 const char* issuer_base64;
33 const char* serial_base64;
34 CERTCertificate* cert;
35 };
37 // HOWTO enable additional CA root certificates for EV:
38 //
39 // For each combination of "root certificate" and "policy OID",
40 // one entry must be added to the array named myTrustedEVInfos.
41 //
42 // We use the combination of "issuer name" and "serial number" to
43 // uniquely identify the certificate. In order to avoid problems
44 // because of encodings when comparing certificates, we don't
45 // use plain text representation, we rather use the original encoding
46 // as it can be found in the root certificate (in base64 format).
47 //
48 // We can use the NSS utility named "pp" to extract the encoding.
49 //
50 // Build standalone NSS including the NSS tools, then run
51 // pp -t certificate-identity -i the-cert-filename
52 //
53 // You will need the output from sections "Issuer", "Fingerprint (SHA1)",
54 // "Issuer DER Base64" and "Serial DER Base64".
55 //
56 // The new section consists of 8 lines:
57 //
58 // - a comment that should contain the human readable issuer name
59 // of the certificate, as printed by the pp tool
60 // - the EV policy OID that is associated to the EV grant
61 // - a text description of the EV policy OID. The array can contain
62 // multiple entries with the same OID.
63 // Please make sure to use the identical OID text description for
64 // all entries with the same policy OID (use the text search
65 // feature of your text editor to find duplicates).
66 // When adding a new policy OID that is not yet contained in the array,
67 // please make sure that your new description is different from
68 // all the other descriptions (again use the text search feature
69 // to be sure).
70 // - the constant SEC_OID_UNKNOWN
71 // (it will be replaced at runtime with another identifier)
72 // - the SHA1 fingerprint
73 // - the "Issuer DER Base64" as printed by the pp tool.
74 // Remove all whitespaces. If you use multiple lines, make sure that
75 // only the final line will be followed by a comma.
76 // - the "Serial DER Base64" (as printed by pp)
77 // - nullptr
78 //
79 // After adding an entry, test it locally against the test site that
80 // has been provided by the CA. Note that you must use a version of NSS
81 // where the root certificate has already been added and marked as trusted
82 // for issueing SSL server certificates (at least).
83 //
84 // If you are able to connect to the site without certificate errors,
85 // but you don't see the EV status indicator, then most likely the CA
86 // has a problem in their infrastructure. The most common problems are
87 // related to the CA's OCSP infrastructure, either they use an incorrect
88 // OCSP signing certificate, or OCSP for the intermediate certificates
89 // isn't working, or OCSP isn't working at all.
91 static struct nsMyTrustedEVInfo myTrustedEVInfos[] = {
92 // IMPORTANT! When extending this list,
93 // pairs of dotted_oid and oid_name should always be unique pairs.
94 // In other words, if you add another list, that uses the same dotted_oid
95 // as an existing entry, then please use the same oid_name.
96 #ifdef DEBUG
97 // Debug EV certificates should all use the OID (repeating EV OID is OK):
98 // 1.3.6.1.4.1.13769.666.666.666.1.500.9.1.
99 // If you add or remove debug EV certs you must also modify IdentityInfoInit
100 // (there is another #ifdef DEBUG section there) so that the correct number of
101 // certs are skipped as these debug EV certs are NOT part of the default trust
102 // store.
103 {
104 // This is the testing EV signature (xpcshell) (RSA)
105 // CN=XPCShell EV Testing (untrustworthy) CA,OU=Security Engineering,O=Mozilla - EV debug test CA,L=Mountain View,ST=CA,C=US"
106 "1.3.6.1.4.1.13769.666.666.666.1.500.9.1",
107 "DEBUGtesting EV OID",
108 SEC_OID_UNKNOWN,
109 { 0x9C, 0x62, 0xEF, 0xDB, 0xAE, 0xF9, 0xEB, 0x36, 0x58, 0xFB,
110 0x3B, 0xD3, 0x47, 0x64, 0x93, 0x9D, 0x86, 0x29, 0x6A, 0xE0 },
111 "MIGnMQswCQYDVQQGEwJVUzELMAkGA1UECAwCQ0ExFjAUBgNVBAcMDU1vdW50YWlu"
112 "IFZpZXcxIzAhBgNVBAoMGk1vemlsbGEgLSBFViBkZWJ1ZyB0ZXN0IENBMR0wGwYD"
113 "VQQLDBRTZWN1cml0eSBFbmdpbmVlcmluZzEvMC0GA1UEAwwmWFBDU2hlbGwgRVYg"
114 "VGVzdGluZyAodW50cnVzdHdvcnRoeSkgQ0E=",
115 "At+3zdo=",
116 nullptr
117 },
118 #endif
119 {
120 // OU=Security Communication EV RootCA1,O="SECOM Trust Systems CO.,LTD.",C=JP
121 "1.2.392.200091.100.721.1",
122 "SECOM EV OID",
123 SEC_OID_UNKNOWN,
124 { 0xFE, 0xB8, 0xC4, 0x32, 0xDC, 0xF9, 0x76, 0x9A, 0xCE, 0xAE,
125 0x3D, 0xD8, 0x90, 0x8F, 0xFD, 0x28, 0x86, 0x65, 0x64, 0x7D },
126 "MGAxCzAJBgNVBAYTAkpQMSUwIwYDVQQKExxTRUNPTSBUcnVzdCBTeXN0ZW1zIENP"
127 "LixMVEQuMSowKAYDVQQLEyFTZWN1cml0eSBDb21tdW5pY2F0aW9uIEVWIFJvb3RD"
128 "QTE=",
129 "AA==",
130 nullptr
131 },
132 {
133 // CN=Cybertrust Global Root,O=Cybertrust, Inc
134 "1.3.6.1.4.1.6334.1.100.1",
135 "Cybertrust EV OID",
136 SEC_OID_UNKNOWN,
137 { 0x5F, 0x43, 0xE5, 0xB1, 0xBF, 0xF8, 0x78, 0x8C, 0xAC, 0x1C,
138 0xC7, 0xCA, 0x4A, 0x9A, 0xC6, 0x22, 0x2B, 0xCC, 0x34, 0xC6 },
139 "MDsxGDAWBgNVBAoTD0N5YmVydHJ1c3QsIEluYzEfMB0GA1UEAxMWQ3liZXJ0cnVz"
140 "dCBHbG9iYWwgUm9vdA==",
141 "BAAAAAABD4WqLUg=",
142 nullptr
143 },
144 {
145 // CN=SwissSign Gold CA - G2,O=SwissSign AG,C=CH
146 "2.16.756.1.89.1.2.1.1",
147 "SwissSign EV OID",
148 SEC_OID_UNKNOWN,
149 { 0xD8, 0xC5, 0x38, 0x8A, 0xB7, 0x30, 0x1B, 0x1B, 0x6E, 0xD4,
150 0x7A, 0xE6, 0x45, 0x25, 0x3A, 0x6F, 0x9F, 0x1A, 0x27, 0x61 },
151 "MEUxCzAJBgNVBAYTAkNIMRUwEwYDVQQKEwxTd2lzc1NpZ24gQUcxHzAdBgNVBAMT"
152 "FlN3aXNzU2lnbiBHb2xkIENBIC0gRzI=",
153 "ALtAHEP1Xk+w",
154 nullptr
155 },
156 {
157 // CN=StartCom Certification Authority,OU=Secure Digital Certificate Signing,O=StartCom Ltd.,C=IL
158 "1.3.6.1.4.1.23223.1.1.1",
159 "StartCom EV OID",
160 SEC_OID_UNKNOWN,
161 { 0x3E, 0x2B, 0xF7, 0xF2, 0x03, 0x1B, 0x96, 0xF3, 0x8C, 0xE6,
162 0xC4, 0xD8, 0xA8, 0x5D, 0x3E, 0x2D, 0x58, 0x47, 0x6A, 0x0F },
163 "MH0xCzAJBgNVBAYTAklMMRYwFAYDVQQKEw1TdGFydENvbSBMdGQuMSswKQYDVQQL"
164 "EyJTZWN1cmUgRGlnaXRhbCBDZXJ0aWZpY2F0ZSBTaWduaW5nMSkwJwYDVQQDEyBT"
165 "dGFydENvbSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eQ==",
166 "AQ==",
167 nullptr
168 },
169 {
170 // CN=StartCom Certification Authority,OU=Secure Digital Certificate Signing,O=StartCom Ltd.,C=IL
171 "1.3.6.1.4.1.23223.1.1.1",
172 "StartCom EV OID",
173 SEC_OID_UNKNOWN,
174 { 0xA3, 0xF1, 0x33, 0x3F, 0xE2, 0x42, 0xBF, 0xCF, 0xC5, 0xD1,
175 0x4E, 0x8F, 0x39, 0x42, 0x98, 0x40, 0x68, 0x10, 0xD1, 0xA0 },
176 "MH0xCzAJBgNVBAYTAklMMRYwFAYDVQQKEw1TdGFydENvbSBMdGQuMSswKQYDVQQL"
177 "EyJTZWN1cmUgRGlnaXRhbCBDZXJ0aWZpY2F0ZSBTaWduaW5nMSkwJwYDVQQDEyBT"
178 "dGFydENvbSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eQ==",
179 "LQ==",
180 nullptr
181 },
182 {
183 // CN=StartCom Certification Authority G2,O=StartCom Ltd.,C=IL
184 "1.3.6.1.4.1.23223.1.1.1",
185 "StartCom EV OID",
186 SEC_OID_UNKNOWN,
187 { 0x31, 0xF1, 0xFD, 0x68, 0x22, 0x63, 0x20, 0xEE, 0xC6, 0x3B,
188 0x3F, 0x9D, 0xEA, 0x4A, 0x3E, 0x53, 0x7C, 0x7C, 0x39, 0x17 },
189 "MFMxCzAJBgNVBAYTAklMMRYwFAYDVQQKEw1TdGFydENvbSBMdGQuMSwwKgYDVQQD"
190 "EyNTdGFydENvbSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eSBHMg==",
191 "Ow==",
192 nullptr
193 },
194 {
195 // CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU="(c) 2006 VeriSign, Inc. - For authorized use only",OU=VeriSign Trust Network,O="VeriSign, Inc.",C=US
196 "2.16.840.1.113733.1.7.23.6",
197 "VeriSign EV OID",
198 SEC_OID_UNKNOWN,
199 { 0x4E, 0xB6, 0xD5, 0x78, 0x49, 0x9B, 0x1C, 0xCF, 0x5F, 0x58,
200 0x1E, 0xAD, 0x56, 0xBE, 0x3D, 0x9B, 0x67, 0x44, 0xA5, 0xE5 },
201 "MIHKMQswCQYDVQQGEwJVUzEXMBUGA1UEChMOVmVyaVNpZ24sIEluYy4xHzAdBgNV"
202 "BAsTFlZlcmlTaWduIFRydXN0IE5ldHdvcmsxOjA4BgNVBAsTMShjKSAyMDA2IFZl"
203 "cmlTaWduLCBJbmMuIC0gRm9yIGF1dGhvcml6ZWQgdXNlIG9ubHkxRTBDBgNVBAMT"
204 "PFZlcmlTaWduIENsYXNzIDMgUHVibGljIFByaW1hcnkgQ2VydGlmaWNhdGlvbiBB"
205 "dXRob3JpdHkgLSBHNQ==",
206 "GNrRniZ96LtKIVjNzGs7Sg==",
207 nullptr
208 },
209 {
210 // CN=GeoTrust Primary Certification Authority,O=GeoTrust Inc.,C=US
211 "1.3.6.1.4.1.14370.1.6",
212 "GeoTrust EV OID",
213 SEC_OID_UNKNOWN,
214 { 0x32, 0x3C, 0x11, 0x8E, 0x1B, 0xF7, 0xB8, 0xB6, 0x52, 0x54,
215 0xE2, 0xE2, 0x10, 0x0D, 0xD6, 0x02, 0x90, 0x37, 0xF0, 0x96 },
216 "MFgxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1HZW9UcnVzdCBJbmMuMTEwLwYDVQQD"
217 "EyhHZW9UcnVzdCBQcmltYXJ5IENlcnRpZmljYXRpb24gQXV0aG9yaXR5",
218 "GKy1av1pthU6Y2yv2vrEoQ==",
219 nullptr
220 },
221 {
222 // CN=thawte Primary Root CA,OU="(c) 2006 thawte, Inc. - For authorized use only",OU=Certification Services Division,O="thawte, Inc.",C=US
223 "2.16.840.1.113733.1.7.48.1",
224 "Thawte EV OID",
225 SEC_OID_UNKNOWN,
226 { 0x91, 0xC6, 0xD6, 0xEE, 0x3E, 0x8A, 0xC8, 0x63, 0x84, 0xE5,
227 0x48, 0xC2, 0x99, 0x29, 0x5C, 0x75, 0x6C, 0x81, 0x7B, 0x81 },
228 "MIGpMQswCQYDVQQGEwJVUzEVMBMGA1UEChMMdGhhd3RlLCBJbmMuMSgwJgYDVQQL"
229 "Ex9DZXJ0aWZpY2F0aW9uIFNlcnZpY2VzIERpdmlzaW9uMTgwNgYDVQQLEy8oYykg"
230 "MjAwNiB0aGF3dGUsIEluYy4gLSBGb3IgYXV0aG9yaXplZCB1c2Ugb25seTEfMB0G"
231 "A1UEAxMWdGhhd3RlIFByaW1hcnkgUm9vdCBDQQ==",
232 "NE7VVyDV7exJ9C/ON9srbQ==",
233 nullptr
234 },
235 {
236 // CN=XRamp Global Certification Authority,O=XRamp Security Services Inc,OU=www.xrampsecurity.com,C=US
237 "2.16.840.1.114404.1.1.2.4.1",
238 "Trustwave EV OID",
239 SEC_OID_UNKNOWN,
240 { 0xB8, 0x01, 0x86, 0xD1, 0xEB, 0x9C, 0x86, 0xA5, 0x41, 0x04,
241 0xCF, 0x30, 0x54, 0xF3, 0x4C, 0x52, 0xB7, 0xE5, 0x58, 0xC6 },
242 "MIGCMQswCQYDVQQGEwJVUzEeMBwGA1UECxMVd3d3LnhyYW1wc2VjdXJpdHkuY29t"
243 "MSQwIgYDVQQKExtYUmFtcCBTZWN1cml0eSBTZXJ2aWNlcyBJbmMxLTArBgNVBAMT"
244 "JFhSYW1wIEdsb2JhbCBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eQ==",
245 "UJRs7Bjq1ZxN1ZfvdY+grQ==",
246 nullptr
247 },
248 {
249 // CN=SecureTrust CA,O=SecureTrust Corporation,C=US
250 "2.16.840.1.114404.1.1.2.4.1",
251 "Trustwave EV OID",
252 SEC_OID_UNKNOWN,
253 { 0x87, 0x82, 0xC6, 0xC3, 0x04, 0x35, 0x3B, 0xCF, 0xD2, 0x96,
254 0x92, 0xD2, 0x59, 0x3E, 0x7D, 0x44, 0xD9, 0x34, 0xFF, 0x11 },
255 "MEgxCzAJBgNVBAYTAlVTMSAwHgYDVQQKExdTZWN1cmVUcnVzdCBDb3Jwb3JhdGlv"
256 "bjEXMBUGA1UEAxMOU2VjdXJlVHJ1c3QgQ0E=",
257 "DPCOXAgWpa1Cf/DrJxhZ0A==",
258 nullptr
259 },
260 {
261 // CN=Secure Global CA,O=SecureTrust Corporation,C=US
262 "2.16.840.1.114404.1.1.2.4.1",
263 "Trustwave EV OID",
264 SEC_OID_UNKNOWN,
265 { 0x3A, 0x44, 0x73, 0x5A, 0xE5, 0x81, 0x90, 0x1F, 0x24, 0x86,
266 0x61, 0x46, 0x1E, 0x3B, 0x9C, 0xC4, 0x5F, 0xF5, 0x3A, 0x1B },
267 "MEoxCzAJBgNVBAYTAlVTMSAwHgYDVQQKExdTZWN1cmVUcnVzdCBDb3Jwb3JhdGlv"
268 "bjEZMBcGA1UEAxMQU2VjdXJlIEdsb2JhbCBDQQ==",
269 "B1YipOjUiolN9BPI8PjqpQ==",
270 nullptr
271 },
272 {
273 // CN=COMODO ECC Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
274 "1.3.6.1.4.1.6449.1.2.1.5.1",
275 "Comodo EV OID",
276 SEC_OID_UNKNOWN,
277 { 0x9F, 0x74, 0x4E, 0x9F, 0x2B, 0x4D, 0xBA, 0xEC, 0x0F, 0x31,
278 0x2C, 0x50, 0xB6, 0x56, 0x3B, 0x8E, 0x2D, 0x93, 0xC3, 0x11 },
279 "MIGFMQswCQYDVQQGEwJHQjEbMBkGA1UECBMSR3JlYXRlciBNYW5jaGVzdGVyMRAw"
280 "DgYDVQQHEwdTYWxmb3JkMRowGAYDVQQKExFDT01PRE8gQ0EgTGltaXRlZDErMCkG"
281 "A1UEAxMiQ09NT0RPIEVDQyBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eQ==",
282 "H0evqmIAcFBUTAGem2OZKg==",
283 nullptr
284 },
285 {
286 // CN=COMODO Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
287 "1.3.6.1.4.1.6449.1.2.1.5.1",
288 "Comodo EV OID",
289 SEC_OID_UNKNOWN,
290 { 0x66, 0x31, 0xBF, 0x9E, 0xF7, 0x4F, 0x9E, 0xB6, 0xC9, 0xD5,
291 0xA6, 0x0C, 0xBA, 0x6A, 0xBE, 0xD1, 0xF7, 0xBD, 0xEF, 0x7B },
292 "MIGBMQswCQYDVQQGEwJHQjEbMBkGA1UECBMSR3JlYXRlciBNYW5jaGVzdGVyMRAw"
293 "DgYDVQQHEwdTYWxmb3JkMRowGAYDVQQKExFDT01PRE8gQ0EgTGltaXRlZDEnMCUG"
294 "A1UEAxMeQ09NT0RPIENlcnRpZmljYXRpb24gQXV0aG9yaXR5",
295 "ToEtioJl4AsC7j41AkblPQ==",
296 nullptr
297 },
298 {
299 // CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE
300 "1.3.6.1.4.1.6449.1.2.1.5.1",
301 "Comodo EV OID",
302 SEC_OID_UNKNOWN,
303 { 0x02, 0xFA, 0xF3, 0xE2, 0x91, 0x43, 0x54, 0x68, 0x60, 0x78,
304 0x57, 0x69, 0x4D, 0xF5, 0xE4, 0x5B, 0x68, 0x85, 0x18, 0x68 },
305 "MG8xCzAJBgNVBAYTAlNFMRQwEgYDVQQKEwtBZGRUcnVzdCBBQjEmMCQGA1UECxMd"
306 "QWRkVHJ1c3QgRXh0ZXJuYWwgVFRQIE5ldHdvcmsxIjAgBgNVBAMTGUFkZFRydXN0"
307 "IEV4dGVybmFsIENBIFJvb3Q=",
308 "AQ==",
309 nullptr
310 },
311 {
312 // CN=UTN - DATACorp SGC,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US
313 "1.3.6.1.4.1.6449.1.2.1.5.1",
314 "Comodo EV OID",
315 SEC_OID_UNKNOWN,
316 { 0x58, 0x11, 0x9F, 0x0E, 0x12, 0x82, 0x87, 0xEA, 0x50, 0xFD,
317 0xD9, 0x87, 0x45, 0x6F, 0x4F, 0x78, 0xDC, 0xFA, 0xD6, 0xD4 },
318 "MIGTMQswCQYDVQQGEwJVUzELMAkGA1UECBMCVVQxFzAVBgNVBAcTDlNhbHQgTGFr"
319 "ZSBDaXR5MR4wHAYDVQQKExVUaGUgVVNFUlRSVVNUIE5ldHdvcmsxITAfBgNVBAsT"
320 "GGh0dHA6Ly93d3cudXNlcnRydXN0LmNvbTEbMBkGA1UEAxMSVVROIC0gREFUQUNv"
321 "cnAgU0dD",
322 "RL4Mi1AAIbQR0ypoBqmtaQ==",
323 nullptr
324 },
325 {
326 // CN=UTN-USERFirst-Hardware,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US
327 "1.3.6.1.4.1.6449.1.2.1.5.1",
328 "Comodo EV OID",
329 SEC_OID_UNKNOWN,
330 { 0x04, 0x83, 0xED, 0x33, 0x99, 0xAC, 0x36, 0x08, 0x05, 0x87,
331 0x22, 0xED, 0xBC, 0x5E, 0x46, 0x00, 0xE3, 0xBE, 0xF9, 0xD7 },
332 "MIGXMQswCQYDVQQGEwJVUzELMAkGA1UECBMCVVQxFzAVBgNVBAcTDlNhbHQgTGFr"
333 "ZSBDaXR5MR4wHAYDVQQKExVUaGUgVVNFUlRSVVNUIE5ldHdvcmsxITAfBgNVBAsT"
334 "GGh0dHA6Ly93d3cudXNlcnRydXN0LmNvbTEfMB0GA1UEAxMWVVROLVVTRVJGaXJz"
335 "dC1IYXJkd2FyZQ==",
336 "RL4Mi1AAJLQR0zYq/mUK/Q==",
337 nullptr
338 },
339 {
340 // OU=Go Daddy Class 2 Certification Authority,O=\"The Go Daddy Group, Inc.\",C=US
341 "2.16.840.1.114413.1.7.23.3",
342 "Go Daddy EV OID a",
343 SEC_OID_UNKNOWN,
344 { 0x27, 0x96, 0xBA, 0xE6, 0x3F, 0x18, 0x01, 0xE2, 0x77, 0x26,
345 0x1B, 0xA0, 0xD7, 0x77, 0x70, 0x02, 0x8F, 0x20, 0xEE, 0xE4 },
346 "MGMxCzAJBgNVBAYTAlVTMSEwHwYDVQQKExhUaGUgR28gRGFkZHkgR3JvdXAsIElu"
347 "Yy4xMTAvBgNVBAsTKEdvIERhZGR5IENsYXNzIDIgQ2VydGlmaWNhdGlvbiBBdXRo"
348 "b3JpdHk=",
349 "AA==",
350 nullptr
351 },
352 {
353 // CN=Go Daddy Root Certificate Authority - G2,O="GoDaddy.com, Inc.",L=Scottsdale,ST=Arizona,C=US
354 "2.16.840.1.114413.1.7.23.3",
355 "Go Daddy EV OID a",
356 SEC_OID_UNKNOWN,
357 { 0x47, 0xBE, 0xAB, 0xC9, 0x22, 0xEA, 0xE8, 0x0E, 0x78, 0x78,
358 0x34, 0x62, 0xA7, 0x9F, 0x45, 0xC2, 0x54, 0xFD, 0xE6, 0x8B },
359 "MIGDMQswCQYDVQQGEwJVUzEQMA4GA1UECBMHQXJpem9uYTETMBEGA1UEBxMKU2Nv"
360 "dHRzZGFsZTEaMBgGA1UEChMRR29EYWRkeS5jb20sIEluYy4xMTAvBgNVBAMTKEdv"
361 "IERhZGR5IFJvb3QgQ2VydGlmaWNhdGUgQXV0aG9yaXR5IC0gRzI=",
362 "AA==",
363 nullptr
364 },
365 {
366 // OU=Starfield Class 2 Certification Authority,O=\"Starfield Technologies, Inc.\",C=US
367 "2.16.840.1.114414.1.7.23.3",
368 "Go Daddy EV OID b",
369 SEC_OID_UNKNOWN,
370 { 0xAD, 0x7E, 0x1C, 0x28, 0xB0, 0x64, 0xEF, 0x8F, 0x60, 0x03,
371 0x40, 0x20, 0x14, 0xC3, 0xD0, 0xE3, 0x37, 0x0E, 0xB5, 0x8A },
372 "MGgxCzAJBgNVBAYTAlVTMSUwIwYDVQQKExxTdGFyZmllbGQgVGVjaG5vbG9naWVz"
373 "LCBJbmMuMTIwMAYDVQQLEylTdGFyZmllbGQgQ2xhc3MgMiBDZXJ0aWZpY2F0aW9u"
374 "IEF1dGhvcml0eQ==",
375 "AA==",
376 nullptr
377 },
378 {
379 // CN=Starfield Root Certificate Authority - G2,O="Starfield Technologies, Inc.",L=Scottsdale,ST=Arizona,C=US
380 "2.16.840.1.114414.1.7.23.3",
381 "Go Daddy EV OID b",
382 SEC_OID_UNKNOWN,
383 { 0xB5, 0x1C, 0x06, 0x7C, 0xEE, 0x2B, 0x0C, 0x3D, 0xF8, 0x55,
384 0xAB, 0x2D, 0x92, 0xF4, 0xFE, 0x39, 0xD4, 0xE7, 0x0F, 0x0E },
385 "MIGPMQswCQYDVQQGEwJVUzEQMA4GA1UECBMHQXJpem9uYTETMBEGA1UEBxMKU2Nv"
386 "dHRzZGFsZTElMCMGA1UEChMcU3RhcmZpZWxkIFRlY2hub2xvZ2llcywgSW5jLjEy"
387 "MDAGA1UEAxMpU3RhcmZpZWxkIFJvb3QgQ2VydGlmaWNhdGUgQXV0aG9yaXR5IC0g"
388 "RzI=",
389 "AA==",
390 nullptr
391 },
392 {
393 // CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
394 "2.16.840.1.114412.2.1",
395 "DigiCert EV OID",
396 SEC_OID_UNKNOWN,
397 { 0x5F, 0xB7, 0xEE, 0x06, 0x33, 0xE2, 0x59, 0xDB, 0xAD, 0x0C,
398 0x4C, 0x9A, 0xE6, 0xD3, 0X8F, 0x1A, 0x61, 0xC7, 0xDC, 0x25 },
399 "MGwxCzAJBgNVBAYTAlVTMRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsT"
400 "EHd3dy5kaWdpY2VydC5jb20xKzApBgNVBAMTIkRpZ2lDZXJ0IEhpZ2ggQXNzdXJh"
401 "bmNlIEVWIFJvb3QgQ0E=",
402 "AqxcJmoLQJuPC3nyrkYldw==",
403 nullptr
404 },
405 {
406 // CN=QuoVadis Root CA 2,O=QuoVadis Limited,C=BM
407 "1.3.6.1.4.1.8024.0.2.100.1.2",
408 "Quo Vadis EV OID",
409 SEC_OID_UNKNOWN,
410 { 0xCA, 0x3A, 0xFB, 0xCF, 0x12, 0x40, 0x36, 0x4B, 0x44, 0xB2,
411 0x16, 0x20, 0x88, 0x80, 0x48, 0x39, 0x19, 0x93, 0x7C, 0xF7 },
412 "MEUxCzAJBgNVBAYTAkJNMRkwFwYDVQQKExBRdW9WYWRpcyBMaW1pdGVkMRswGQYD"
413 "VQQDExJRdW9WYWRpcyBSb290IENBIDI=",
414 "BQk=",
415 nullptr
416 },
417 {
418 // CN=Network Solutions Certificate Authority,O=Network Solutions L.L.C.,C=US
419 "1.3.6.1.4.1.782.1.2.1.8.1",
420 "Network Solutions EV OID",
421 SEC_OID_UNKNOWN,
422 { 0x74, 0xF8, 0xA3, 0xC3, 0xEF, 0xE7, 0xB3, 0x90, 0x06, 0x4B,
423 0x83, 0x90, 0x3C, 0x21, 0x64, 0x60, 0x20, 0xE5, 0xDF, 0xCE },
424 "MGIxCzAJBgNVBAYTAlVTMSEwHwYDVQQKExhOZXR3b3JrIFNvbHV0aW9ucyBMLkwu"
425 "Qy4xMDAuBgNVBAMTJ05ldHdvcmsgU29sdXRpb25zIENlcnRpZmljYXRlIEF1dGhv"
426 "cml0eQ==",
427 "V8szb8JcFuZHFhfjkDFo4A==",
428 nullptr
429 },
430 {
431 // CN=Entrust Root Certification Authority,OU="(c) 2006 Entrust, Inc.",OU=www.entrust.net/CPS is incorporated by reference,O="Entrust, Inc.",C=US
432 "2.16.840.1.114028.10.1.2",
433 "Entrust EV OID",
434 SEC_OID_UNKNOWN,
435 { 0xB3, 0x1E, 0xB1, 0xB7, 0x40, 0xE3, 0x6C, 0x84, 0x02, 0xDA,
436 0xDC, 0x37, 0xD4, 0x4D, 0xF5, 0xD4, 0x67, 0x49, 0x52, 0xF9 },
437 "MIGwMQswCQYDVQQGEwJVUzEWMBQGA1UEChMNRW50cnVzdCwgSW5jLjE5MDcGA1UE"
438 "CxMwd3d3LmVudHJ1c3QubmV0L0NQUyBpcyBpbmNvcnBvcmF0ZWQgYnkgcmVmZXJl"
439 "bmNlMR8wHQYDVQQLExYoYykgMjAwNiBFbnRydXN0LCBJbmMuMS0wKwYDVQQDEyRF"
440 "bnRydXN0IFJvb3QgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHk=",
441 "RWtQVA==",
442 nullptr
443 },
444 {
445 // CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE
446 "1.3.6.1.4.1.4146.1.1",
447 "GlobalSign EV OID",
448 SEC_OID_UNKNOWN,
449 { 0xB1, 0xBC, 0x96, 0x8B, 0xD4, 0xF4, 0x9D, 0x62, 0x2A, 0xA8,
450 0x9A, 0x81, 0xF2, 0x15, 0x01, 0x52, 0xA4, 0x1D, 0x82, 0x9C },
451 "MFcxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9iYWxTaWduIG52LXNhMRAwDgYD"
452 "VQQLEwdSb290IENBMRswGQYDVQQDExJHbG9iYWxTaWduIFJvb3QgQ0E=",
453 "BAAAAAABFUtaw5Q=",
454 nullptr
455 },
456 {
457 // CN=GlobalSign,O=GlobalSign,OU=GlobalSign Root CA - R2
458 "1.3.6.1.4.1.4146.1.1",
459 "GlobalSign EV OID",
460 SEC_OID_UNKNOWN,
461 { 0x75, 0xE0, 0xAB, 0xB6, 0x13, 0x85, 0x12, 0x27, 0x1C, 0x04,
462 0xF8, 0x5F, 0xDD, 0xDE, 0x38, 0xE4, 0xB7, 0x24, 0x2E, 0xFE },
463 "MEwxIDAeBgNVBAsTF0dsb2JhbFNpZ24gUm9vdCBDQSAtIFIyMRMwEQYDVQQKEwpH"
464 "bG9iYWxTaWduMRMwEQYDVQQDEwpHbG9iYWxTaWdu",
465 "BAAAAAABD4Ym5g0=",
466 nullptr
467 },
468 {
469 // CN=GlobalSign,O=GlobalSign,OU=GlobalSign Root CA - R3
470 "1.3.6.1.4.1.4146.1.1",
471 "GlobalSign EV OID",
472 SEC_OID_UNKNOWN,
473 { 0xD6, 0x9B, 0x56, 0x11, 0x48, 0xF0, 0x1C, 0x77, 0xC5, 0x45,
474 0x78, 0xC1, 0x09, 0x26, 0xDF, 0x5B, 0x85, 0x69, 0x76, 0xAD },
475 "MEwxIDAeBgNVBAsTF0dsb2JhbFNpZ24gUm9vdCBDQSAtIFIzMRMwEQYDVQQKEwpH"
476 "bG9iYWxTaWduMRMwEQYDVQQDEwpHbG9iYWxTaWdu",
477 "BAAAAAABIVhTCKI=",
478 nullptr
479 },
480 {
481 // CN=Buypass Class 3 CA 1,O=Buypass AS-983163327,C=NO
482 "2.16.578.1.26.1.3.3",
483 "Buypass EV OID",
484 SEC_OID_UNKNOWN,
485 { 0x61, 0x57, 0x3A, 0x11, 0xDF, 0x0E, 0xD8, 0x7E, 0xD5, 0x92,
486 0x65, 0x22, 0xEA, 0xD0, 0x56, 0xD7, 0x44, 0xB3, 0x23, 0x71 },
487 "MEsxCzAJBgNVBAYTAk5PMR0wGwYDVQQKDBRCdXlwYXNzIEFTLTk4MzE2MzMyNzEd"
488 "MBsGA1UEAwwUQnV5cGFzcyBDbGFzcyAzIENBIDE=",
489 "Ag==",
490 nullptr
491 },
492 {
493 // CN=Buypass Class 3 Root CA,O=Buypass AS-983163327,C=NO
494 "2.16.578.1.26.1.3.3",
495 "Buypass EV OID",
496 SEC_OID_UNKNOWN,
497 { 0xDA, 0xFA, 0xF7, 0xFA, 0x66, 0x84, 0xEC, 0x06, 0x8F, 0x14,
498 0x50, 0xBD, 0xC7, 0xC2, 0x81, 0xA5, 0xBC, 0xA9, 0x64, 0x57 },
499 "ME4xCzAJBgNVBAYTAk5PMR0wGwYDVQQKDBRCdXlwYXNzIEFTLTk4MzE2MzMyNzEg"
500 "MB4GA1UEAwwXQnV5cGFzcyBDbGFzcyAzIFJvb3QgQ0E=",
501 "Ag==",
502 nullptr
503 },
504 {
505 // CN=Class 2 Primary CA,O=Certplus,C=FR
506 "1.3.6.1.4.1.22234.2.5.2.3.1",
507 "Certplus EV OID",
508 SEC_OID_UNKNOWN,
509 { 0x74, 0x20, 0x74, 0x41, 0x72, 0x9C, 0xDD, 0x92, 0xEC, 0x79,
510 0x31, 0xD8, 0x23, 0x10, 0x8D, 0xC2, 0x81, 0x92, 0xE2, 0xBB },
511 "MD0xCzAJBgNVBAYTAkZSMREwDwYDVQQKEwhDZXJ0cGx1czEbMBkGA1UEAxMSQ2xh"
512 "c3MgMiBQcmltYXJ5IENB",
513 "AIW9S/PY2uNp9pTXX8OlRCM=",
514 nullptr
515 },
516 {
517 // CN=Chambers of Commerce Root - 2008,O=AC Camerfirma S.A.,serialNumber=A82743287,L=Madrid (see current address at www.camerfirma.com/address),C=EU
518 "1.3.6.1.4.1.17326.10.14.2.1.2",
519 "Camerfirma EV OID a",
520 SEC_OID_UNKNOWN,
521 { 0x78, 0x6A, 0x74, 0xAC, 0x76, 0xAB, 0x14, 0x7F, 0x9C, 0x6A,
522 0x30, 0x50, 0xBA, 0x9E, 0xA8, 0x7E, 0xFE, 0x9A, 0xCE, 0x3C },
523 "MIGuMQswCQYDVQQGEwJFVTFDMEEGA1UEBxM6TWFkcmlkIChzZWUgY3VycmVudCBh"
524 "ZGRyZXNzIGF0IHd3dy5jYW1lcmZpcm1hLmNvbS9hZGRyZXNzKTESMBAGA1UEBRMJ"
525 "QTgyNzQzMjg3MRswGQYDVQQKExJBQyBDYW1lcmZpcm1hIFMuQS4xKTAnBgNVBAMT"
526 "IENoYW1iZXJzIG9mIENvbW1lcmNlIFJvb3QgLSAyMDA4",
527 "AKPaQn6ksa7a",
528 nullptr
529 },
530 {
531 // CN=Global Chambersign Root - 2008,O=AC Camerfirma S.A.,serialNumber=A82743287,L=Madrid (see current address at www.camerfirma.com/address),C=EU
532 "1.3.6.1.4.1.17326.10.8.12.1.2",
533 "Camerfirma EV OID b",
534 SEC_OID_UNKNOWN,
535 { 0x4A, 0xBD, 0xEE, 0xEC, 0x95, 0x0D, 0x35, 0x9C, 0x89, 0xAE,
536 0xC7, 0x52, 0xA1, 0x2C, 0x5B, 0x29, 0xF6, 0xD6, 0xAA, 0x0C },
537 "MIGsMQswCQYDVQQGEwJFVTFDMEEGA1UEBxM6TWFkcmlkIChzZWUgY3VycmVudCBh"
538 "ZGRyZXNzIGF0IHd3dy5jYW1lcmZpcm1hLmNvbS9hZGRyZXNzKTESMBAGA1UEBRMJ"
539 "QTgyNzQzMjg3MRswGQYDVQQKExJBQyBDYW1lcmZpcm1hIFMuQS4xJzAlBgNVBAMT"
540 "Hkdsb2JhbCBDaGFtYmVyc2lnbiBSb290IC0gMjAwOA==",
541 "AMnN0+nVfSPO",
542 nullptr
543 },
544 {
545 // CN=TC TrustCenter Universal CA III,OU=TC TrustCenter Universal CA,O=TC TrustCenter GmbH,C=DE
546 "1.2.276.0.44.1.1.1.4",
547 "TC TrustCenter EV OID",
548 SEC_OID_UNKNOWN,
549 { 0x96, 0x56, 0xCD, 0x7B, 0x57, 0x96, 0x98, 0x95, 0xD0, 0xE1,
550 0x41, 0x46, 0x68, 0x06, 0xFB, 0xB8, 0xC6, 0x11, 0x06, 0x87 },
551 "MHsxCzAJBgNVBAYTAkRFMRwwGgYDVQQKExNUQyBUcnVzdENlbnRlciBHbWJIMSQw"
552 "IgYDVQQLExtUQyBUcnVzdENlbnRlciBVbml2ZXJzYWwgQ0ExKDAmBgNVBAMTH1RD"
553 "IFRydXN0Q2VudGVyIFVuaXZlcnNhbCBDQSBJSUk=",
554 "YyUAAQACFI0zFQLkbPQ=",
555 nullptr
556 },
557 {
558 // CN=AffirmTrust Commercial,O=AffirmTrust,C=US
559 "1.3.6.1.4.1.34697.2.1",
560 "AffirmTrust EV OID a",
561 SEC_OID_UNKNOWN,
562 { 0xF9, 0xB5, 0xB6, 0x32, 0x45, 0x5F, 0x9C, 0xBE, 0xEC, 0x57,
563 0x5F, 0x80, 0xDC, 0xE9, 0x6E, 0x2C, 0xC7, 0xB2, 0x78, 0xB7 },
564 "MEQxCzAJBgNVBAYTAlVTMRQwEgYDVQQKDAtBZmZpcm1UcnVzdDEfMB0GA1UEAwwW"
565 "QWZmaXJtVHJ1c3QgQ29tbWVyY2lhbA==",
566 "d3cGJyapsXw=",
567 nullptr
568 },
569 {
570 // CN=AffirmTrust Networking,O=AffirmTrust,C=US
571 "1.3.6.1.4.1.34697.2.2",
572 "AffirmTrust EV OID b",
573 SEC_OID_UNKNOWN,
574 { 0x29, 0x36, 0x21, 0x02, 0x8B, 0x20, 0xED, 0x02, 0xF5, 0x66,
575 0xC5, 0x32, 0xD1, 0xD6, 0xED, 0x90, 0x9F, 0x45, 0x00, 0x2F },
576 "MEQxCzAJBgNVBAYTAlVTMRQwEgYDVQQKDAtBZmZpcm1UcnVzdDEfMB0GA1UEAwwW"
577 "QWZmaXJtVHJ1c3QgTmV0d29ya2luZw==",
578 "fE8EORzUmS0=",
579 nullptr
580 },
581 {
582 // CN=AffirmTrust Premium,O=AffirmTrust,C=US
583 "1.3.6.1.4.1.34697.2.3",
584 "AffirmTrust EV OID c",
585 SEC_OID_UNKNOWN,
586 { 0xD8, 0xA6, 0x33, 0x2C, 0xE0, 0x03, 0x6F, 0xB1, 0x85, 0xF6,
587 0x63, 0x4F, 0x7D, 0x6A, 0x06, 0x65, 0x26, 0x32, 0x28, 0x27 },
588 "MEExCzAJBgNVBAYTAlVTMRQwEgYDVQQKDAtBZmZpcm1UcnVzdDEcMBoGA1UEAwwT"
589 "QWZmaXJtVHJ1c3QgUHJlbWl1bQ==",
590 "bYwURrGmCu4=",
591 nullptr
592 },
593 {
594 // CN=AffirmTrust Premium ECC,O=AffirmTrust,C=US
595 "1.3.6.1.4.1.34697.2.4",
596 "AffirmTrust EV OID d",
597 SEC_OID_UNKNOWN,
598 { 0xB8, 0x23, 0x6B, 0x00, 0x2F, 0x1D, 0x16, 0x86, 0x53, 0x01,
599 0x55, 0x6C, 0x11, 0xA4, 0x37, 0xCA, 0xEB, 0xFF, 0xC3, 0xBB },
600 "MEUxCzAJBgNVBAYTAlVTMRQwEgYDVQQKDAtBZmZpcm1UcnVzdDEgMB4GA1UEAwwX"
601 "QWZmaXJtVHJ1c3QgUHJlbWl1bSBFQ0M=",
602 "dJclisc/elQ=",
603 nullptr
604 },
605 {
606 // CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL
607 "1.2.616.1.113527.2.5.1.1",
608 "Certum EV OID",
609 SEC_OID_UNKNOWN,
610 { 0x07, 0xE0, 0x32, 0xE0, 0x20, 0xB7, 0x2C, 0x3F, 0x19, 0x2F,
611 0x06, 0x28, 0xA2, 0x59, 0x3A, 0x19, 0xA7, 0x0F, 0x06, 0x9E },
612 "MH4xCzAJBgNVBAYTAlBMMSIwIAYDVQQKExlVbml6ZXRvIFRlY2hub2xvZ2llcyBT"
613 "LkEuMScwJQYDVQQLEx5DZXJ0dW0gQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkxIjAg"
614 "BgNVBAMTGUNlcnR1bSBUcnVzdGVkIE5ldHdvcmsgQ0E=",
615 "BETA",
616 nullptr
617 },
618 {
619 // CN=Izenpe.com,O=IZENPE S.A.,C=ES
620 "1.3.6.1.4.1.14777.6.1.1",
621 "Izenpe EV OID 1",
622 SEC_OID_UNKNOWN,
623 { 0x2F, 0x78, 0x3D, 0x25, 0x52, 0x18, 0xA7, 0x4A, 0x65, 0x39,
624 0x71, 0xB5, 0x2C, 0xA2, 0x9C, 0x45, 0x15, 0x6F, 0xE9, 0x19 },
625 "MDgxCzAJBgNVBAYTAkVTMRQwEgYDVQQKDAtJWkVOUEUgUy5BLjETMBEGA1UEAwwK"
626 "SXplbnBlLmNvbQ==",
627 "ALC3WhZIX7/hy/WL1xnmfQ==",
628 nullptr
629 },
630 {
631 // CN=Izenpe.com,O=IZENPE S.A.,C=ES
632 "1.3.6.1.4.1.14777.6.1.2",
633 "Izenpe EV OID 2",
634 SEC_OID_UNKNOWN,
635 { 0x2F, 0x78, 0x3D, 0x25, 0x52, 0x18, 0xA7, 0x4A, 0x65, 0x39,
636 0x71, 0xB5, 0x2C, 0xA2, 0x9C, 0x45, 0x15, 0x6F, 0xE9, 0x19 },
637 "MDgxCzAJBgNVBAYTAkVTMRQwEgYDVQQKDAtJWkVOUEUgUy5BLjETMBEGA1UEAwwK"
638 "SXplbnBlLmNvbQ==",
639 "ALC3WhZIX7/hy/WL1xnmfQ==",
640 nullptr
641 },
642 {
643 // CN=A-Trust-nQual-03,OU=A-Trust-nQual-03,O=A-Trust Ges. f. Sicherheitssysteme im elektr. Datenverkehr GmbH,C=AT
644 "1.2.40.0.17.1.22",
645 "A-Trust EV OID",
646 SEC_OID_UNKNOWN,
647 { 0xD3, 0xC0, 0x63, 0xF2, 0x19, 0xED, 0x07, 0x3E, 0x34, 0xAD,
648 0x5D, 0x75, 0x0B, 0x32, 0x76, 0x29, 0xFF, 0xD5, 0x9A, 0xF2 },
649 "MIGNMQswCQYDVQQGEwJBVDFIMEYGA1UECgw/QS1UcnVzdCBHZXMuIGYuIFNpY2hl"
650 "cmhlaXRzc3lzdGVtZSBpbSBlbGVrdHIuIERhdGVudmVya2VociBHbWJIMRkwFwYD"
651 "VQQLDBBBLVRydXN0LW5RdWFsLTAzMRkwFwYDVQQDDBBBLVRydXN0LW5RdWFsLTAz",
652 "AWwe",
653 nullptr
654 },
655 {
656 // CN=T-TeleSec GlobalRoot Class 3,OU=T-Systems Trust Center,O=T-Systems Enterprise Services GmbH,C=DE
657 "1.3.6.1.4.1.7879.13.24.1",
658 "T-Systems EV OID",
659 SEC_OID_UNKNOWN,
660 { 0x55, 0xA6, 0x72, 0x3E, 0xCB, 0xF2, 0xEC, 0xCD, 0xC3, 0x23,
661 0x74, 0x70, 0x19, 0x9D, 0x2A, 0xBE, 0x11, 0xE3, 0x81, 0xD1 },
662 "MIGCMQswCQYDVQQGEwJERTErMCkGA1UECgwiVC1TeXN0ZW1zIEVudGVycHJpc2Ug"
663 "U2VydmljZXMgR21iSDEfMB0GA1UECwwWVC1TeXN0ZW1zIFRydXN0IENlbnRlcjEl"
664 "MCMGA1UEAwwcVC1UZWxlU2VjIEdsb2JhbFJvb3QgQ2xhc3MgMw==",
665 "AQ==",
666 nullptr
667 },
668 {
669 // CN=TURKTRUST Elektronik Sertifika Hizmet Saglayicisi,O=TURKTRUST Bilgi Illetisim ve Bilisim Guvenligi Hizmetleri A.S.,C=TR
670 "2.16.792.3.0.3.1.1.5",
671 "TurkTrust EV OID",
672 SEC_OID_UNKNOWN,
673 { 0xF1, 0x7F, 0x6F, 0xB6, 0x31, 0xDC, 0x99, 0xE3, 0xA3, 0xC8,
674 0x7F, 0xFE, 0x1C, 0xF1, 0x81, 0x10, 0x88, 0xD9, 0x60, 0x33 },
675 "MIG/MT8wPQYDVQQDDDZUw5xSS1RSVVNUIEVsZWt0cm9uaWsgU2VydGlmaWthIEhp"
676 "em1ldCBTYcSfbGF5xLFjxLFzxLExCzAJBgNVBAYTAlRSMQ8wDQYDVQQHDAZBbmth"
677 "cmExXjBcBgNVBAoMVVTDnFJLVFJVU1QgQmlsZ2kgxLBsZXRpxZ9pbSB2ZSBCaWxp"
678 "xZ9pbSBHw7x2ZW5sacSfaSBIaXptZXRsZXJpIEEuxZ4uIChjKSBBcmFsxLFrIDIw"
679 "MDc=",
680 "AQ==",
681 nullptr
682 },
683 {
684 // CN=China Internet Network Information Center EV Certificates Root,O=China Internet Network Information Center,C=CN
685 "1.3.6.1.4.1.29836.1.10",
686 "CNNIC EV OID",
687 SEC_OID_UNKNOWN,
688 { 0x4F, 0x99, 0xAA, 0x93, 0xFB, 0x2B, 0xD1, 0x37, 0x26, 0xA1,
689 0x99, 0x4A, 0xCE, 0x7F, 0xF0, 0x05, 0xF2, 0x93, 0x5D, 0x1E },
690 "MIGKMQswCQYDVQQGEwJDTjEyMDAGA1UECgwpQ2hpbmEgSW50ZXJuZXQgTmV0d29y"
691 "ayBJbmZvcm1hdGlvbiBDZW50ZXIxRzBFBgNVBAMMPkNoaW5hIEludGVybmV0IE5l"
692 "dHdvcmsgSW5mb3JtYXRpb24gQ2VudGVyIEVWIENlcnRpZmljYXRlcyBSb290",
693 "SJ8AAQ==",
694 nullptr
695 },
696 {
697 // CN=TWCA Root Certification Authority,OU=Root CA,O=TAIWAN-CA,C=TW
698 "1.3.6.1.4.1.40869.1.1.22.3",
699 "TWCA EV OID",
700 SEC_OID_UNKNOWN,
701 { 0xCF, 0x9E, 0x87, 0x6D, 0xD3, 0xEB, 0xFC, 0x42, 0x26, 0x97,
702 0xA3, 0xB5, 0xA3, 0x7A, 0xA0, 0x76, 0xA9, 0x06, 0x23, 0x48 },
703 "MF8xCzAJBgNVBAYTAlRXMRIwEAYDVQQKDAlUQUlXQU4tQ0ExEDAOBgNVBAsMB1Jv"
704 "b3QgQ0ExKjAoBgNVBAMMIVRXQ0EgUm9vdCBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0"
705 "eQ==",
706 "AQ==",
707 nullptr
708 },
709 {
710 // CN=D-TRUST Root Class 3 CA 2 EV 2009,O=D-Trust GmbH,C=DE
711 "1.3.6.1.4.1.4788.2.202.1",
712 "D-TRUST EV OID",
713 SEC_OID_UNKNOWN,
714 { 0x96, 0xC9, 0x1B, 0x0B, 0x95, 0xB4, 0x10, 0x98, 0x42, 0xFA,
715 0xD0, 0xD8, 0x22, 0x79, 0xFE, 0x60, 0xFA, 0xB9, 0x16, 0x83 },
716 "MFAxCzAJBgNVBAYTAkRFMRUwEwYDVQQKDAxELVRydXN0IEdtYkgxKjAoBgNVBAMM"
717 "IUQtVFJVU1QgUm9vdCBDbGFzcyAzIENBIDIgRVYgMjAwOQ==",
718 "CYP0",
719 nullptr
720 },
721 {
722 // CN=Swisscom Root EV CA 2,OU=Digital Certificate Services,O=Swisscom,C=ch
723 "2.16.756.1.83.21.0",
724 "Swisscom EV OID",
725 SEC_OID_UNKNOWN,
726 { 0xE7, 0xA1, 0x90, 0x29, 0xD3, 0xD5, 0x52, 0xDC, 0x0D, 0x0F,
727 0xC6, 0x92, 0xD3, 0xEA, 0x88, 0x0D, 0x15, 0x2E, 0x1A, 0x6B },
728 "MGcxCzAJBgNVBAYTAmNoMREwDwYDVQQKEwhTd2lzc2NvbTElMCMGA1UECxMcRGln"
729 "aXRhbCBDZXJ0aWZpY2F0ZSBTZXJ2aWNlczEeMBwGA1UEAxMVU3dpc3Njb20gUm9v"
730 "dCBFViBDQSAy",
731 "APL6ZOJ0Y9ON/RAdBB92ylg=",
732 nullptr
733 },
734 {
735 // CN=VeriSign Universal Root Certification Authority,OU="(c) 2008 VeriSign, Inc. - For authorized use only",OU=VeriSign Trust Network,O="VeriSign, Inc.",C=US
736 "2.16.840.1.113733.1.7.23.6",
737 "VeriSign EV OID",
738 SEC_OID_UNKNOWN,
739 { 0x36, 0x79, 0xCA, 0x35, 0x66, 0x87, 0x72, 0x30, 0x4D, 0x30,
740 0xA5, 0xFB, 0x87, 0x3B, 0x0F, 0xA7, 0x7B, 0xB7, 0x0D, 0x54 },
741 "MIG9MQswCQYDVQQGEwJVUzEXMBUGA1UEChMOVmVyaVNpZ24sIEluYy4xHzAdBgNV"
742 "BAsTFlZlcmlTaWduIFRydXN0IE5ldHdvcmsxOjA4BgNVBAsTMShjKSAyMDA4IFZl"
743 "cmlTaWduLCBJbmMuIC0gRm9yIGF1dGhvcml6ZWQgdXNlIG9ubHkxODA2BgNVBAMT"
744 "L1ZlcmlTaWduIFVuaXZlcnNhbCBSb290IENlcnRpZmljYXRpb24gQXV0aG9yaXR5",
745 "QBrEZCGzEyEDDrvkEhrFHQ==",
746 nullptr
747 },
748 {
749 // CN=GeoTrust Primary Certification Authority - G3,OU=(c) 2008 GeoTrust Inc. - For authorized use only,O=GeoTrust Inc.,C=US
750 "1.3.6.1.4.1.14370.1.6",
751 "GeoTrust EV OID",
752 SEC_OID_UNKNOWN,
753 { 0x03, 0x9E, 0xED, 0xB8, 0x0B, 0xE7, 0xA0, 0x3C, 0x69, 0x53,
754 0x89, 0x3B, 0x20, 0xD2, 0xD9, 0x32, 0x3A, 0x4C, 0x2A, 0xFD },
755 "MIGYMQswCQYDVQQGEwJVUzEWMBQGA1UEChMNR2VvVHJ1c3QgSW5jLjE5MDcGA1UE"
756 "CxMwKGMpIDIwMDggR2VvVHJ1c3QgSW5jLiAtIEZvciBhdXRob3JpemVkIHVzZSBv"
757 "bmx5MTYwNAYDVQQDEy1HZW9UcnVzdCBQcmltYXJ5IENlcnRpZmljYXRpb24gQXV0"
758 "aG9yaXR5IC0gRzM=",
759 "FaxulBmyeUtB9iepwxgPHw==",
760 nullptr
761 },
762 {
763 // CN=thawte Primary Root CA - G3,OU="(c) 2008 thawte, Inc. - For authorized use only",OU=Certification Services Division,O="thawte, Inc.",C=US
764 "2.16.840.1.113733.1.7.48.1",
765 "Thawte EV OID",
766 SEC_OID_UNKNOWN,
767 { 0xF1, 0x8B, 0x53, 0x8D, 0x1B, 0xE9, 0x03, 0xB6, 0xA6, 0xF0,
768 0x56, 0x43, 0x5B, 0x17, 0x15, 0x89, 0xCA, 0xF3, 0x6B, 0xF2 },
769 "MIGuMQswCQYDVQQGEwJVUzEVMBMGA1UEChMMdGhhd3RlLCBJbmMuMSgwJgYDVQQL"
770 "Ex9DZXJ0aWZpY2F0aW9uIFNlcnZpY2VzIERpdmlzaW9uMTgwNgYDVQQLEy8oYykg"
771 "MjAwOCB0aGF3dGUsIEluYy4gLSBGb3IgYXV0aG9yaXplZCB1c2Ugb25seTEkMCIG"
772 "A1UEAxMbdGhhd3RlIFByaW1hcnkgUm9vdCBDQSAtIEcz",
773 "YAGXt0an6rS0mtZLL/eQ+w==",
774 nullptr
775 },
776 {
777 // CN = Autoridad de Certificacion Firmaprofesional CIF A62634068, C = ES
778 "1.3.6.1.4.1.13177.10.1.3.10",
779 "Firmaprofesional EV OID",
780 SEC_OID_UNKNOWN,
781 { 0xAE, 0xC5, 0xFB, 0x3F, 0xC8, 0xE1, 0xBF, 0xC4, 0xE5, 0x4F,
782 0x03, 0x07, 0x5A, 0x9A, 0xE8, 0x00, 0xB7, 0xF7, 0xB6, 0xFA },
783 "MFExCzAJBgNVBAYTAkVTMUIwQAYDVQQDDDlBdXRvcmlkYWQgZGUgQ2VydGlmaWNh"
784 "Y2lvbiBGaXJtYXByb2Zlc2lvbmFsIENJRiBBNjI2MzQwNjg=",
785 "U+w77vuySF8=",
786 nullptr
787 },
788 {
789 // CN = TWCA Global Root CA, OU = Root CA, O = TAIWAN-CA, C = TW
790 "1.3.6.1.4.1.40869.1.1.22.3",
791 "TWCA EV OID",
792 SEC_OID_UNKNOWN,
793 { 0x9C, 0xBB, 0x48, 0x53, 0xF6, 0xA4, 0xF6, 0xD3, 0x52, 0xA4,
794 0xE8, 0x32, 0x52, 0x55, 0x60, 0x13, 0xF5, 0xAD, 0xAF, 0x65 },
795 "MFExCzAJBgNVBAYTAlRXMRIwEAYDVQQKEwlUQUlXQU4tQ0ExEDAOBgNVBAsTB1Jv"
796 "b3QgQ0ExHDAaBgNVBAMTE1RXQ0EgR2xvYmFsIFJvb3QgQ0E=",
797 "DL4=",
798 nullptr
799 },
800 {
801 // CN = E-Tugra Certification Authority, OU = E-Tugra Sertifikasyon Merkezi, O = E-Tuğra EBG Bilişim Teknolojileri ve Hizmetleri A.Ş., L = Ankara, C = TR
802 "2.16.792.3.0.4.1.1.4",
803 "ETugra EV OID",
804 SEC_OID_UNKNOWN,
805 { 0x51, 0xC6, 0xE7, 0x08, 0x49, 0x06, 0x6E, 0xF3, 0x92, 0xD4,
806 0x5C, 0xA0, 0x0D, 0x6D, 0xA3, 0x62, 0x8F, 0xC3, 0x52, 0x39 },
807 "MIGyMQswCQYDVQQGEwJUUjEPMA0GA1UEBwwGQW5rYXJhMUAwPgYDVQQKDDdFLVR1"
808 "xJ9yYSBFQkcgQmlsacWfaW0gVGVrbm9sb2ppbGVyaSB2ZSBIaXptZXRsZXJpIEEu"
809 "xZ4uMSYwJAYDVQQLDB1FLVR1Z3JhIFNlcnRpZmlrYXN5b24gTWVya2V6aTEoMCYG"
810 "A1UEAwwfRS1UdWdyYSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eQ==",
811 "amg+nFGby1M=",
812 nullptr
813 }
814 };
816 static SECOidTag
817 register_oid(const SECItem* oid_item, const char* oid_name)
818 {
819 if (!oid_item)
820 return SEC_OID_UNKNOWN;
822 SECOidData od;
823 od.oid.len = oid_item->len;
824 od.oid.data = oid_item->data;
825 od.offset = SEC_OID_UNKNOWN;
826 od.desc = oid_name;
827 od.mechanism = CKM_INVALID_MECHANISM;
828 od.supportedExtension = INVALID_CERT_EXTENSION;
829 return SECOID_AddEntry(&od);
830 }
832 #ifndef NSS_NO_LIBPKIX
833 static void
834 addToCertListIfTrusted(CERTCertList* certList, CERTCertificate* cert) {
835 CERTCertTrust nssTrust;
836 if (CERT_GetCertTrust(cert, &nssTrust) != SECSuccess) {
837 return;
838 }
839 unsigned int flags = SEC_GET_TRUST_FLAGS(&nssTrust, trustSSL);
841 if (flags & CERTDB_TRUSTED_CA) {
842 CERT_AddCertToListTail(certList, CERT_DupCertificate(cert));
843 }
844 }
845 #endif
847 static bool
848 isEVPolicy(SECOidTag policyOIDTag)
849 {
850 for (size_t iEV = 0; iEV < PR_ARRAY_SIZE(myTrustedEVInfos); ++iEV) {
851 nsMyTrustedEVInfo& entry = myTrustedEVInfos[iEV];
852 if (policyOIDTag == entry.oid_tag) {
853 return true;
854 }
855 }
857 return false;
858 }
860 namespace mozilla { namespace psm {
862 #ifndef NSS_NO_LIBPKIX
863 CERTCertList*
864 GetRootsForOid(SECOidTag oid_tag)
865 {
866 CERTCertList* certList = CERT_NewCertList();
867 if (!certList)
868 return nullptr;
870 for (size_t iEV = 0; iEV < PR_ARRAY_SIZE(myTrustedEVInfos); ++iEV) {
871 nsMyTrustedEVInfo& entry = myTrustedEVInfos[iEV];
872 if (entry.oid_tag == oid_tag) {
873 addToCertListIfTrusted(certList, entry.cert);
874 }
875 }
877 return certList;
878 }
879 #endif
881 bool
882 CertIsAuthoritativeForEVPolicy(const CERTCertificate* cert,
883 SECOidTag policyOidTag)
884 {
885 PR_ASSERT(cert);
886 PR_ASSERT(policyOidTag != SEC_OID_UNKNOWN);
887 if (!cert || !policyOidTag) {
888 return false;
889 }
891 for (size_t iEV = 0; iEV < PR_ARRAY_SIZE(myTrustedEVInfos); ++iEV) {
892 nsMyTrustedEVInfo& entry = myTrustedEVInfos[iEV];
893 if (entry.oid_tag == policyOidTag && entry.cert &&
894 CERT_CompareCerts(cert, entry.cert)) {
895 return true;
896 }
897 }
899 return false;
900 }
902 static PRStatus
903 IdentityInfoInit()
904 {
905 for (size_t iEV = 0; iEV < PR_ARRAY_SIZE(myTrustedEVInfos); ++iEV) {
906 nsMyTrustedEVInfo& entry = myTrustedEVInfos[iEV];
908 SECStatus rv;
909 CERTIssuerAndSN ias;
911 rv = ATOB_ConvertAsciiToItem(&ias.derIssuer, const_cast<char*>(entry.issuer_base64));
912 PR_ASSERT(rv == SECSuccess);
913 if (rv != SECSuccess) {
914 return PR_FAILURE;
915 }
916 rv = ATOB_ConvertAsciiToItem(&ias.serialNumber,
917 const_cast<char*>(entry.serial_base64));
918 PR_ASSERT(rv == SECSuccess);
919 if (rv != SECSuccess) {
920 SECITEM_FreeItem(&ias.derIssuer, false);
921 return PR_FAILURE;
922 }
924 ias.serialNumber.type = siUnsignedInteger;
926 entry.cert = CERT_FindCertByIssuerAndSN(nullptr, &ias);
928 SECITEM_FreeItem(&ias.derIssuer, false);
929 SECITEM_FreeItem(&ias.serialNumber, false);
931 // If an entry is missing in the NSS root database, it may be because the
932 // root database is out of sync with what we expect (e.g. a different
933 // version of system NSS is installed). We will just silently avoid
934 // treating that root cert as EV.
935 if (!entry.cert) {
936 #ifdef DEBUG
937 // The debug CA info is at position 0, and is NOT on the NSS root db
938 if (iEV == 0) {
939 continue;
940 }
941 #endif
942 PR_NOT_REACHED("Could not find EV root in NSS storage");
943 continue;
944 }
946 unsigned char certFingerprint[20];
947 rv = PK11_HashBuf(SEC_OID_SHA1, certFingerprint,
948 entry.cert->derCert.data, entry.cert->derCert.len);
949 PR_ASSERT(rv == SECSuccess);
950 if (rv == SECSuccess) {
951 bool same = !memcmp(certFingerprint, entry.ev_root_sha1_fingerprint, 20);
952 PR_ASSERT(same);
953 if (same) {
955 SECItem ev_oid_item;
956 ev_oid_item.data = nullptr;
957 ev_oid_item.len = 0;
958 rv = SEC_StringToOID(nullptr, &ev_oid_item, entry.dotted_oid, 0);
959 PR_ASSERT(rv == SECSuccess);
960 if (rv == SECSuccess) {
961 entry.oid_tag = register_oid(&ev_oid_item, entry.oid_name);
962 if (entry.oid_tag == SEC_OID_UNKNOWN) {
963 rv = SECFailure;
964 }
965 SECITEM_FreeItem(&ev_oid_item, false);
966 }
967 } else {
968 PR_SetError(SEC_ERROR_BAD_DATA, 0);
969 rv = SECFailure;
970 }
971 }
973 if (rv != SECSuccess) {
974 CERT_DestroyCertificate(entry.cert);
975 entry.cert = nullptr;
976 entry.oid_tag = SEC_OID_UNKNOWN;
977 return PR_FAILURE;
978 }
979 }
981 return PR_SUCCESS;
982 }
984 static PRCallOnceType sIdentityInfoCallOnce;
986 void
987 EnsureIdentityInfoLoaded()
988 {
989 (void) PR_CallOnce(&sIdentityInfoCallOnce, IdentityInfoInit);
990 }
992 void
993 CleanupIdentityInfo()
994 {
995 for (size_t iEV = 0; iEV < PR_ARRAY_SIZE(myTrustedEVInfos); ++iEV) {
996 nsMyTrustedEVInfo &entry = myTrustedEVInfos[iEV];
997 if (entry.cert) {
998 CERT_DestroyCertificate(entry.cert);
999 entry.cert = nullptr;
1000 }
1001 }
1003 memset(&sIdentityInfoCallOnce, 0, sizeof(PRCallOnceType));
1004 }
1006 // Find the first policy OID that is known to be an EV policy OID.
1007 SECStatus
1008 GetFirstEVPolicy(CERTCertificate* cert, SECOidTag& outOidTag)
1009 {
1010 if (!cert)
1011 return SECFailure;
1013 if (cert->extensions) {
1014 for (int i=0; cert->extensions[i]; i++) {
1015 const SECItem* oid = &cert->extensions[i]->id;
1017 SECOidTag oidTag = SECOID_FindOIDTag(oid);
1018 if (oidTag != SEC_OID_X509_CERTIFICATE_POLICIES)
1019 continue;
1021 SECItem* value = &cert->extensions[i]->value;
1023 CERTCertificatePolicies* policies;
1024 CERTPolicyInfo** policyInfos;
1026 policies = CERT_DecodeCertificatePoliciesExtension(value);
1027 if (!policies)
1028 continue;
1030 policyInfos = policies->policyInfos;
1032 bool found = false;
1033 while (*policyInfos) {
1034 const CERTPolicyInfo* policyInfo = *policyInfos++;
1036 SECOidTag oid_tag = policyInfo->oid;
1037 if (oid_tag != SEC_OID_UNKNOWN && isEVPolicy(oid_tag)) {
1038 // in our list of OIDs accepted for EV
1039 outOidTag = oid_tag;
1040 found = true;
1041 break;
1042 }
1043 }
1044 CERT_DestroyCertificatePoliciesExtension(policies);
1045 if (found)
1046 return SECSuccess;
1047 }
1048 }
1050 return SECFailure;
1051 }
1053 } } // namespace mozilla::psm
