OLD | NEW |
1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 // This file contains the HSTS preloaded list in a machine readable format. | 5 // This file contains the HSTS preloaded list in a machine readable format. |
6 | 6 |
7 // The top-level element is a dictionary with two keys: "pinsets" maps details | 7 // The top-level element is a dictionary with two keys: "pinsets" maps details |
8 // of certificate pinning to a name and "entries" contains the HSTS details for | 8 // of certificate pinning to a name and "entries" contains the HSTS details for |
9 // each host. | 9 // each host. |
10 // | 10 // |
11 // "pinsets" is a list of objects. Each object has the following members: | 11 // "pinsets" is a list of objects. Each object has the following members: |
12 // name: (string) the name of the pinset | 12 // name: (string) the name of the pinset |
13 // static_spki_hashes: (list of strings) the set of allowed SPKIs hashes | 13 // static_spki_hashes: (list of strings) the set of allowed SPKIs hashes |
14 // bad_static_spki_hashes: (optional list of strings) the set of forbidden | 14 // bad_static_spki_hashes: (optional list of strings) the set of forbidden |
15 // SPKIs hashes | 15 // SPKIs hashes |
16 // | 16 // |
17 // For a given pinset, a certificate is accepted if at least one of the | 17 // For a given pinset, a certificate is accepted if at least one of the |
18 // "static_spki_hashes" SPKIs is found in the chain and none of the | 18 // "static_spki_hashes" SPKIs is found in the chain and none of the |
19 // "bad_static_spki_hashes" SPKIs are. SPKIs are specified as names, which must | 19 // "bad_static_spki_hashes" SPKIs are. SPKIs are specified as names, which must |
20 // match up with the file of certificates. | 20 // match up with the file of certificates. |
21 // | 21 // |
22 // "entries" is a list of objects. Each object has the following members: | 22 // "entries" is a list of objects. Each object has the following members: |
23 // name: (string) the DNS name of the host in question | 23 // name: (string) the DNS name of the host in question |
24 // include_subdomains: (optional bool) whether subdomains of |name| are also | 24 // include_subdomains: (optional bool) whether subdomains of |name| are also |
25 // covered | 25 // covered |
26 // mode: (optional string) "force-https" iff covered names should require | 26 // mode: (optional string) "force-https" iff covered names should require |
27 // HTTPS | 27 // HTTPS |
28 // pins: (optional string) the |name| member of an object in |pinsets| | 28 // pins: (optional string) the |name| member of an object in |pinsets| |
29 // snionly: (optional bool) if true then this entry is only enforced if TLS is | |
30 // enabled because the site in question only serves the correct | |
31 // certificate if SNI is sent. Note that this only covers the case where | |
32 // TLS has been disabled by explicit configuration. If TLS was disabled | |
33 // because of SSLv3 fallback, then the entry is still in force and a | |
34 // fatal certificate error will result. Spurious certificate errors are | |
35 // an unfortunate result of SSLv3 fallback. | |
36 | 29 |
37 { | 30 { |
38 "pinsets": [ | 31 "pinsets": [ |
39 { | 32 { |
40 "name": "test", | 33 "name": "test", |
41 "static_spki_hashes": [ | 34 "static_spki_hashes": [ |
42 "TestSPKI" | 35 "TestSPKI" |
43 ] | 36 ] |
44 }, | 37 }, |
45 { | 38 { |
(...skipping 2840 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
2886 "GOOGLETAGSERVICES_COM", | 2879 "GOOGLETAGSERVICES_COM", |
2887 "DROPBOX_COM", | 2880 "DROPBOX_COM", |
2888 "YOUTUBE_NOCOOKIE_COM", | 2881 "YOUTUBE_NOCOOKIE_COM", |
2889 "2MDN_NET", | 2882 "2MDN_NET", |
2890 "FACEBOOK_COM", | 2883 "FACEBOOK_COM", |
2891 "SPIDEROAK_COM", | 2884 "SPIDEROAK_COM", |
2892 "BLOGGER_COM", | 2885 "BLOGGER_COM", |
2893 "CHROME_COM" | 2886 "CHROME_COM" |
2894 ] | 2887 ] |
2895 } | 2888 } |
OLD | NEW |