Added EV policy OID and root sha1 fingerprint for GlobalSign Root CA - R3

Added EV policy OID and root sha1 fingerprint for GlobalSign Root CA - R3

BUG=58437
TEST=go to <https://2029.globalsign.com>; and verify the EV status

Unit Test (This test has been DISABLED because it fails
when "./netunittests" is run, though it passes individually.):
"net_unittests --gtest_filter=X509CertificateTest.GlobalSignR3EVTest"

Committed: http://src.chromium.org/viewvc/chrome?view=rev&revision=86632

[rkn, 2011-05-18 18:05:59]

please review

[wtc, 2011-05-18 23:53:21]

You wrote the unit test correctly.  I suggest some changes
below.

http://codereview.chromium.org/7037031/diff/5001/net/base/x509_certificate_un...
File net/base/x509_certificate_unittest.cc (right):

http://codereview.chromium.org/7037031/diff/5001/net/base/x509_certificate_un...
net/base/x509_certificate_unittest.cc:491: // pass with an expired error
Our Style Guide recommends that we use proper punctuation in
comments.  So please add periods (.) at the end of sentences.

Remove the "the" before "certificate".

http://codereview.chromium.org/7037031/diff/5001/net/base/x509_certificate_un...
net/base/x509_certificate_unittest.cc:514: X509Certificate::VERIFY_EV_CERT;
This line should be aligned with the X509Certificate on
the previous line.

http://codereview.chromium.org/7037031/diff/5001/net/base/x509_certificate_un...
net/base/x509_certificate_unittest.cc:518: EXPECT_NE(0,
verify_result.cert_status & CERT_STATUS_IS_EV);
To allow the test to fail with ERR_CERT_DATE_INVALID,
you need to write the EXPECT macros in a different way.

  if (error == OK) {
    EXPECT_NE(0, verify_result.cert_status & CERT_STATUS_IS_EV);
  } else {
    EXPECT_EQ(ERR_CERT_DATE_INVALID, error);
  }

Note: ERR_CERT_DATE_INVALID is defined in src/net/base/net_errors.h,
which uses src/net/base/net_error_list.h.  Please study
those two files to see how that is done with macro tricks.

[wtc, 2011-05-20 00:34:08]

Please remove

  Note that this test requires the files
  "2029_globalsign_com_cert.pem" and
  "2029_globalsign_extended_validation_sha256_ca_cert.pem"
  in /src/net/data/ssl/certificates/. These files exist on
  my machine, but I don't think they are included with this
  changelist.

from the description of the CL because it is no longer true.

http://codereview.chromium.org/7037031/diff/7001/net/base/ev_root_ca_metadata.cc
File net/base/ev_root_ca_metadata.cc (right):

http://codereview.chromium.org/7037031/diff/7001/net/base/ev_root_ca_metadata...
net/base/ev_root_ca_metadata.cc:125: // GlobalSign
Can you take the opportunity to change this CA name to
"GlobalSign Root CA - R2"?

http://codereview.chromium.org/7037031/diff/7001/net/base/x509_certificate_un...
File net/base/x509_certificate_unittest.cc (right):

http://codereview.chromium.org/7037031/diff/7001/net/base/x509_certificate_un...
net/base/x509_certificate_unittest.cc:491: // pass if error ==
ERR_CERT_DATE_INVALID.
Please add a comment to explain why this test is disabled,
and that it is intended to be enabled and run manually.
You can just copy the comment from the description of the
CL.

http://codereview.chromium.org/7037031/diff/7001/net/data/ssl/certificates/20...
File
net/data/ssl/certificates/2029_globalsign_extended_validation_sha256_ca_cert.pem
(right):

http://codereview.chromium.org/7037031/diff/7001/net/data/ssl/certificates/20...
net/data/ssl/certificates/2029_globalsign_extended_validation_sha256_ca_cert.pem:1:
-----BEGIN CERTIFICATE-----
Please rename this file
globalsign_ev_sha256_ca_cert.pem.

I.e., remove "2029" and abbreviate "extended validation".

I suggest you do this in three steps.

1. do "gcl change globalsign_ev"

and remove 2029_globalsign_extended_validation_sha256_ca_cert.pem
from the CL.

2. Use the "svn move" command to rename the file.
Run "svn help move" to find out the command line.
I think it's "svn move oldname newname".

3. do "gcl change globalsign_ev"

and add globalsign_ev_sha256_ca_cert.pem to the CL.

[rkn1, 2011-05-20 17:48:36]

http://codereview.chromium.org/7037031/diff/7001/net/base/ev_root_ca_metadata.cc
File net/base/ev_root_ca_metadata.cc (right):

http://codereview.chromium.org/7037031/diff/7001/net/base/ev_root_ca_metadata...
net/base/ev_root_ca_metadata.cc:125: // GlobalSign
On 2011/05/20 00:34:08, wtc wrote:
> Can you take the opportunity to change this CA name to
> "GlobalSign Root CA - R2"?

Done.

http://codereview.chromium.org/7037031/diff/7001/net/base/x509_certificate_un...
File net/base/x509_certificate_unittest.cc (right):

http://codereview.chromium.org/7037031/diff/7001/net/base/x509_certificate_un...
net/base/x509_certificate_unittest.cc:491: // pass if error ==
ERR_CERT_DATE_INVALID.
On 2011/05/20 00:34:08, wtc wrote:
> Please add a comment to explain why this test is disabled,
> and that it is intended to be enabled and run manually.
> You can just copy the comment from the description of the
> CL.

Done.

http://codereview.chromium.org/7037031/diff/7001/net/data/ssl/certificates/20...
File
net/data/ssl/certificates/2029_globalsign_extended_validation_sha256_ca_cert.pem
(right):

http://codereview.chromium.org/7037031/diff/7001/net/data/ssl/certificates/20...
net/data/ssl/certificates/2029_globalsign_extended_validation_sha256_ca_cert.pem:1:
-----BEGIN CERTIFICATE-----
On 2011/05/20 00:34:08, wtc wrote:
> Please rename this file
> globalsign_ev_sha256_ca_cert.pem.
> 
> I.e., remove "2029" and abbreviate "extended validation".
> 
> I suggest you do this in three steps.
> 
> 1. do "gcl change globalsign_ev"
> 
> and remove 2029_globalsign_extended_validation_sha256_ca_cert.pem
> from the CL.
> 
> 2. Use the "svn move" command to rename the file.
> Run "svn help move" to find out the command line.
> I think it's "svn move oldname newname".
> 
> 3. do "gcl change globalsign_ev"
> 
> and add globalsign_ev_sha256_ca_cert.pem to the CL.

Done.

[wtc, 2011-05-20 17:49:54]

LGTM.

[rkn, 2011-05-24 01:43:57]

http://codereview.chromium.org/7037031/diff/5001/net/base/x509_certificate_un...
File net/base/x509_certificate_unittest.cc (right):

http://codereview.chromium.org/7037031/diff/5001/net/base/x509_certificate_un...
net/base/x509_certificate_unittest.cc:491: // pass with an expired error
On 2011/05/18 23:53:22, wtc wrote:
> Our Style Guide recommends that we use proper punctuation in
> comments.  So please add periods (.) at the end of sentences.
> 
> Remove the "the" before "certificate".

Done.

http://codereview.chromium.org/7037031/diff/5001/net/base/x509_certificate_un...
net/base/x509_certificate_unittest.cc:514: X509Certificate::VERIFY_EV_CERT;
On 2011/05/18 23:53:22, wtc wrote:
> This line should be aligned with the X509Certificate on
> the previous line.

Done.

http://codereview.chromium.org/7037031/diff/5001/net/base/x509_certificate_un...
net/base/x509_certificate_unittest.cc:518: EXPECT_NE(0,
verify_result.cert_status & CERT_STATUS_IS_EV);
On 2011/05/18 23:53:22, wtc wrote:
> To allow the test to fail with ERR_CERT_DATE_INVALID,
> you need to write the EXPECT macros in a different way.
> 
>   if (error == OK) {
>     EXPECT_NE(0, verify_result.cert_status & CERT_STATUS_IS_EV);
>   } else {
>     EXPECT_EQ(ERR_CERT_DATE_INVALID, error);
>   }
> 
> Note: ERR_CERT_DATE_INVALID is defined in src/net/base/net_errors.h,
> which uses src/net/base/net_error_list.h.  Please study
> those two files to see how that is done with macro tricks.

Done.

[wtc, 2011-05-24 02:12:23]

LGTM.

[commit-bot: I haz the power, 2011-05-25 16:23:17]

Change committed as 86632