Only disable SHA-1 for local trust anchors if there's a PrefService

Only disable SHA-1 for local trust anchors if there's a PrefService

SHA-1 is being phased out, and beginning with M57, SHA-1 certificates
signed by locally installed trust anchors is being disabled by default.
To re-enable, Enterprises should set an EnableSha1ForLocalAnchors policy
to allow it.

However, for platforms without enterprise policies, or for embedders,
this raises a question about what the default state should be - enabled
or disabled. As Chrome itself expects there to be non-trivial impact
(thus, the policy, supported until 1 Jan 2019), it is safer to leave
the current behaviour, enabling SHA-1 for these certs, on by default,
and leave it to embedders to disable (via the
SSLConfig/SSLConfigService).

If embedders support preferences, that's seen as sufficient support to
enable some degree of run-time control/flexibility, thus the default
is moved from //net to //components/ssl_config. Embedders using
//net will continue to support SHA-1 anchors by default, while embedders
that include //components/ssl_config (and use it) will disable it by
default.

BUG=673036
Committed: https://crrev.com/f344fae16403754aab4567c1edb158ee658a8b07
Cr-Commit-Position: refs/heads/master@{#441481}

[Ryan Sleevi, 2017-01-04 01:37:08]

rsleevi@chromium.org changed reviewers:
+ eroman@chromium.org

[Ryan Sleevi, 2017-01-04 01:37:08]

Still debating the best way to test this, but take a look.

[eroman, 2017-01-04 01:50:56]

lgtm

[Ryan Sleevi, 2017-01-04 19:35:37]

Added some more tests after our talk in person.

[eroman, 2017-01-04 20:04:27]

lgtm

[Ryan Sleevi, 2017-01-04 21:11:44]

The CQ bit was checked by rsleevi@chromium.org

[commit-bot: I haz the power, 2017-01-04 21:12:23]

CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[commit-bot: I haz the power, 2017-01-04 22:08:50]

CQ is committing da patch.

Bot data: {"patchset_id": 40001, "attempt_start_ts": 1483564304857900,
"parent_rev": "dea2d29bcca92956951f324957f501cda57332b2", "commit_rev":
"c8c01e824d0276ebd32695088bb4a4a084dc0bb1"}

[commit-bot: I haz the power, 2017-01-04 22:09:22]

Description was changed from

==========
Only disable SHA-1 for local trust anchors if there's a PrefService

SHA-1 is being phased out, and beginning with M57, SHA-1 certificates
signed by locally installed trust anchors is being disabled by default.
To re-enable, Enterprises should set an EnableSha1ForLocalAnchors policy
to allow it.

However, for platforms without enterprise policies, or for embedders,
this raises a question about what the default state should be - enabled
or disabled. As Chrome itself expects there to be non-trivial impact
(thus, the policy, supported until 1 Jan 2019), it is safer to leave
the current behaviour, enabling SHA-1 for these certs, on by default,
and leave it to embedders to disable (via the
SSLConfig/SSLConfigService).

If embedders support preferences, that's seen as sufficient support to
enable some degree of run-time control/flexibility, thus the default
is moved from //net to //components/ssl_config. Embedders using
//net will continue to support SHA-1 anchors by default, while embedders
that include //components/ssl_config (and use it) will disable it by
default.

BUG=673036
==========

to

==========
Only disable SHA-1 for local trust anchors if there's a PrefService

SHA-1 is being phased out, and beginning with M57, SHA-1 certificates
signed by locally installed trust anchors is being disabled by default.
To re-enable, Enterprises should set an EnableSha1ForLocalAnchors policy
to allow it.

However, for platforms without enterprise policies, or for embedders,
this raises a question about what the default state should be - enabled
or disabled. As Chrome itself expects there to be non-trivial impact
(thus, the policy, supported until 1 Jan 2019), it is safer to leave
the current behaviour, enabling SHA-1 for these certs, on by default,
and leave it to embedders to disable (via the
SSLConfig/SSLConfigService).

If embedders support preferences, that's seen as sufficient support to
enable some degree of run-time control/flexibility, thus the default
is moved from //net to //components/ssl_config. Embedders using
//net will continue to support SHA-1 anchors by default, while embedders
that include //components/ssl_config (and use it) will disable it by
default.

BUG=673036

Review-Url: https://codereview.chromium.org/2613533004
==========

[commit-bot: I haz the power, 2017-01-04 22:09:23]

Committed patchset #3 (id:40001)

[commit-bot: I haz the power, 2017-01-04 22:11:23]

Description was changed from

==========
Only disable SHA-1 for local trust anchors if there's a PrefService

SHA-1 is being phased out, and beginning with M57, SHA-1 certificates
signed by locally installed trust anchors is being disabled by default.
To re-enable, Enterprises should set an EnableSha1ForLocalAnchors policy
to allow it.

However, for platforms without enterprise policies, or for embedders,
this raises a question about what the default state should be - enabled
or disabled. As Chrome itself expects there to be non-trivial impact
(thus, the policy, supported until 1 Jan 2019), it is safer to leave
the current behaviour, enabling SHA-1 for these certs, on by default,
and leave it to embedders to disable (via the
SSLConfig/SSLConfigService).

If embedders support preferences, that's seen as sufficient support to
enable some degree of run-time control/flexibility, thus the default
is moved from //net to //components/ssl_config. Embedders using
//net will continue to support SHA-1 anchors by default, while embedders
that include //components/ssl_config (and use it) will disable it by
default.

BUG=673036

Review-Url: https://codereview.chromium.org/2613533004
==========

to

==========
Only disable SHA-1 for local trust anchors if there's a PrefService

SHA-1 is being phased out, and beginning with M57, SHA-1 certificates
signed by locally installed trust anchors is being disabled by default.
To re-enable, Enterprises should set an EnableSha1ForLocalAnchors policy
to allow it.

However, for platforms without enterprise policies, or for embedders,
this raises a question about what the default state should be - enabled
or disabled. As Chrome itself expects there to be non-trivial impact
(thus, the policy, supported until 1 Jan 2019), it is safer to leave
the current behaviour, enabling SHA-1 for these certs, on by default,
and leave it to embedders to disable (via the
SSLConfig/SSLConfigService).

If embedders support preferences, that's seen as sufficient support to
enable some degree of run-time control/flexibility, thus the default
is moved from //net to //components/ssl_config. Embedders using
//net will continue to support SHA-1 anchors by default, while embedders
that include //components/ssl_config (and use it) will disable it by
default.

BUG=673036

Committed: https://crrev.com/f344fae16403754aab4567c1edb158ee658a8b07
Cr-Commit-Position: refs/heads/master@{#441481}
==========

[commit-bot: I haz the power, 2017-01-04 22:11:24]

Patchset 3 (id:??) landed as
https://crrev.com/f344fae16403754aab4567c1edb158ee658a8b07
Cr-Commit-Position: refs/heads/master@{#441481}