De-prioritize 2.23.140.1.1 when searching for EV policy.

De-prioritize 2.23.140.1.1 when searching for EV policy.

This fixes an issue where Symantec issued certificates containing
multiple EV policy OIDs were not being recognized as EV.

BUG=705285
Review-Url: https://codereview.chromium.org/2772283004
Cr-Commit-Position: refs/heads/master@{#459987}
Committed: https://chromium.googlesource.com/chromium/src/+/58d31a73a5143a2faee4f41fa5a2072aa8a34a9e

[eroman, 2017-03-27 23:56:38]

The CQ bit was checked by eroman@chromium.org to run a CQ dry run

[commit-bot: I haz the power, 2017-03-27 23:57:07]

Dry run: CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[commit-bot: I haz the power, 2017-03-27 23:59:51]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2017-03-27 23:59:52]

Dry run: Try jobs failed on following builders:
  ios-device on master.tryserver.chromium.mac (JOB_FAILED,
http://build.chromium.org/p/tryserver.chromium.mac/builders/ios-device/builds...)
  ios-device-xcode-clang on master.tryserver.chromium.mac (JOB_FAILED,
http://build.chromium.org/p/tryserver.chromium.mac/builders/ios-device-xcode-...)
  mac_chromium_rel_ng on master.tryserver.chromium.mac (JOB_FAILED,
http://build.chromium.org/p/tryserver.chromium.mac/builders/mac_chromium_rel_...)

[eroman, 2017-03-28 00:02:38]

The CQ bit was checked by eroman@chromium.org to run a CQ dry run

[commit-bot: I haz the power, 2017-03-28 00:03:47]

Dry run: CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[eroman, 2017-03-28 00:04:10]

The CQ bit was checked by eroman@chromium.org to run a CQ dry run

[commit-bot: I haz the power, 2017-03-28 00:04:43]

Dry run: CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[commit-bot: I haz the power, 2017-03-28 00:13:34]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2017-03-28 00:13:34]

Dry run: Try jobs failed on following builders:
  ios-simulator-xcode-clang on master.tryserver.chromium.mac (JOB_FAILED,
http://build.chromium.org/p/tryserver.chromium.mac/builders/ios-simulator-xco...)
  mac_chromium_compile_dbg_ng on master.tryserver.chromium.mac (JOB_FAILED,
http://build.chromium.org/p/tryserver.chromium.mac/builders/mac_chromium_comp...)
  mac_chromium_rel_ng on master.tryserver.chromium.mac (JOB_FAILED,
http://build.chromium.org/p/tryserver.chromium.mac/builders/mac_chromium_rel_...)

[eroman, 2017-03-28 00:13:38]

eroman@chromium.org changed reviewers:
+ mattm@chromium.org, rsleevi@chromium.org

[eroman, 2017-03-28 00:13:39]

* Tried to keep this small to make it merge-friendly

* There are additional tests I need to follow-up with (this only includes a
regression test from the bug)

* A more robust fix IMO would be to test all the OIDs, not just a single one as
we do today. Target certificates with more than one recognized EV policy OID may
still have problems. And there is at least one trust anchor which registers both
2.23.140.1.1  and a CA-specific OID.

[eroman, 2017-03-28 00:18:38]

The CQ bit was checked by eroman@chromium.org to run a CQ dry run

[commit-bot: I haz the power, 2017-03-28 00:19:23]

Dry run: CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[mattm, 2017-03-28 00:43:39]

lgtm

[commit-bot: I haz the power, 2017-03-28 00:54:17]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2017-03-28 00:54:18]

Dry run: Try jobs failed on following builders:
  win_chromium_x64_rel_ng on master.tryserver.chromium.win (JOB_FAILED,
http://build.chromium.org/p/tryserver.chromium.win/builders/win_chromium_x64_...)

[eroman, 2017-03-28 00:57:34]

The CQ bit was checked by eroman@chromium.org to run a CQ dry run

[commit-bot: I haz the power, 2017-03-28 00:57:59]

Dry run: CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[commit-bot: I haz the power, 2017-03-28 02:06:31]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2017-03-28 02:06:32]

Dry run: This issue passed the CQ dry run.

[eroman, 2017-03-28 02:07:08]

The CQ bit was checked by eroman@chromium.org

[eroman, 2017-03-28 02:07:08]

The patchset sent to the CQ was uploaded after l-g-t-m from mattm@chromium.org
Link to the patchset: https://codereview.chromium.org/2772283004/#ps80001
(title: "fix win compile")

[commit-bot: I haz the power, 2017-03-28 02:07:49]

CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[commit-bot: I haz the power, 2017-03-28 02:14:00]

CQ is committing da patch.

Bot data: {"patchset_id": 80001, "attempt_start_ts": 1490666828145120,
"parent_rev": "10db17210b3b675ba92c3d4d0a25baa7687546f1", "commit_rev":
"58d31a73a5143a2faee4f41fa5a2072aa8a34a9e"}

[commit-bot: I haz the power, 2017-03-28 02:14:45]

Description was changed from

==========
De-prioritize 2.23.140.1.1 when searching for EV policy.

This fixes an issue where Symantec issued certificates containing
multiple EV policy OIDs were not being recognized as EV.

BUG=705285
==========

to

==========
De-prioritize 2.23.140.1.1 when searching for EV policy.

This fixes an issue where Symantec issued certificates containing
multiple EV policy OIDs were not being recognized as EV.

BUG=705285

Review-Url: https://codereview.chromium.org/2772283004
Cr-Commit-Position: refs/heads/master@{#459987}
Committed:
https://chromium.googlesource.com/chromium/src/+/58d31a73a5143a2faee4f41fa5a2...
==========

[commit-bot: I haz the power, 2017-03-28 02:14:46]

Committed patchset #5 (id:80001) as
https://chromium.googlesource.com/chromium/src/+/58d31a73a5143a2faee4f41fa5a2...

[RE66, 2017-03-28 03:55:30]

On 2017/03/28 02:14:46, commit-bot: I haz the power wrote:
> Committed patchset #5 (id:80001) as
>
https://chromium.googlesource.com/chromium/src/+/58d31a73a5143a2faee4f41fa5a2...

Does publishing openliy
net/data/ssl/certificates/trustcenter.websecurity.symantec.com.pem
is a huge security risk ?

[Ryan Sleevi, 2017-03-28 05:37:39]

On 2017/03/28 03:55:30, RE66 wrote:
> On 2017/03/28 02:14:46, commit-bot: I haz the power wrote:
> > Committed patchset #5 (id:80001) as
> >
>
https://chromium.googlesource.com/chromium/src/+/58d31a73a5143a2faee4f41fa5a2...
> 
> Does publishing openliy
> net/data/ssl/certificates/trustcenter.websecurity.symantec.com.pem
> is a huge security risk ?

No. This is a public certificate, not the private key.
https://crt.sh/?id=79567825 easily has this information made publicly available
- by Symantec.