net: block retired Fraunhofer intermediate.

net/cert/cert_verify_proc.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/cert/cert_verify_proc.h"
 
 #include "base/basictypes.h"
 #include "base/metrics/histogram.h"
 #include "base/sha1.h"
 #include "base/strings/stringprintf.h"
@@ skipping 398 matching lines @@
     {0xe1, 0x2d, 0x89, 0xf5, 0x6d, 0x22, 0x76, 0xf8, 0x30, 0xe6,
      0xce, 0xaf, 0xa6, 0x6c, 0x72, 0x5c, 0x0b, 0x41, 0xa9, 0x32},
     // Cyberoam CA certificate. Private key leaked, but this certificate would
     // only have been installed by Cyberoam customers. The certificate expires
     // in 2036, but we can probably remove in a couple of years (2014).
     {0xd9, 0xf5, 0xc6, 0xce, 0x57, 0xff, 0xaa, 0x39, 0xcc, 0x7e,
      0xd1, 0x72, 0xbd, 0x53, 0xe0, 0xd3, 0x07, 0x83, 0x4b, 0xd1},
     // Win32/Sirefef.gen!C generates fake certificates with this public key.
     {0xa4, 0xf5, 0x6e, 0x9e, 0x1d, 0x9a, 0x3b, 0x7b, 0x1a, 0xc3,
      0x31, 0xcf, 0x64, 0xfc, 0x76, 0x2c, 0xd0, 0x51, 0xfb, 0xa4},
-    // ANSSI certificate under which a MITM proxy was mistakenly operated.
-    // Expires: Jul 18 10:05:28 2014 GMT
-    {0x3e, 0xcf, 0x4b, 0xbb, 0xe4, 0x60, 0x96, 0xd5, 0x14, 0xbb,
-     0x53, 0x9b, 0xb9, 0x13, 0xd7, 0x7a, 0xa4, 0xef, 0x31, 0xbf},
     // Three retired intermediate certificates from Symantec. No compromise;
     // just for robustness. All expire May 17 23:59:59 2018.
     // See https://bugzilla.mozilla.org/show_bug.cgi?id=966060
     {0x68, 0x5e, 0xec, 0x0a, 0x39, 0xf6, 0x68, 0xae, 0x8f, 0xd8,
      0x96, 0x4f, 0x98, 0x74, 0x76, 0xb4, 0x50, 0x4f, 0xd2, 0xbe},
     {0x0e, 0x50, 0x2d, 0x4d, 0xd1, 0xe1, 0x60, 0x36, 0x8a, 0x31,
      0xf0, 0x6a, 0x81, 0x04, 0x31, 0xba, 0x6f, 0x72, 0xc0, 0x41},
     {0x93, 0xd1, 0x53, 0x22, 0x29, 0xcc, 0x2a, 0xbd, 0x21, 0xdf,
      0xf5, 0x97, 0xee, 0x32, 0x0f, 0xe4, 0x24, 0x6f, 0x3d, 0x0c},
     // C=IN, O=National Informatics Centre, OU=NICCA, CN=NIC Certifying
     // Authority. Issued by C=IN, O=India PKI, CN=CCA India 2007.
     // Expires July 4th, 2015.
     {0xf5, 0x71, 0x79, 0xfa, 0xea, 0x10, 0xc5, 0x43, 0x8c, 0xb0,
      0xc6, 0xe1, 0xcc, 0x27, 0x7b, 0x6e, 0x0d, 0xb2, 0xff, 0x54},
     // C=IN, O=National Informatics Centre, CN=NIC CA 2011. Issued by
     // C=IN, O=India PKI, CN=CCA India 2011.
     // Expires March 11th 2016.
     {0x07, 0x7a, 0xc7, 0xde, 0x8d, 0xa5, 0x58, 0x64, 0x3a, 0x06,
      0xc5, 0x36, 0x9e, 0x55, 0x4f, 0xae, 0xb3, 0xdf, 0xa1, 0x66},
     // C=IN, O=National Informatics Centre, CN=NIC CA 2014. Issued by
     // C=IN, O=India PKI, CN=CCA India 2014.
     // Expires: March 5th, 2024.
     {0xe5, 0x8e, 0x31, 0x5b, 0xaa, 0xee, 0xaa, 0xc6, 0xe7, 0x2e,
      0xc9, 0x57, 0x36, 0x70, 0xca, 0x2f, 0x25, 0x4e, 0xc3, 0x47},
+    // C=DE, O=Fraunhofer, OU=Fraunhofer Corporate PKI,
+    // CN=Fraunhofer Service CA 2007.
+    // Expires: Jun 30 2019.
+    // No compromise, just for robustness. See
+    // https://bugzilla.mozilla.org/show_bug.cgi?id=1076940
+    {0x38, 0x4d, 0x0c, 0x1d, 0xc4, 0x77, 0xa7, 0xb3, 0xf8, 0x67,
+     0x86, 0xd0, 0x18, 0x51, 0x9f, 0x58, 0x9f, 0x1e, 0x9e, 0x25},
   };
 
   for (unsigned i = 0; i < kNumHashes; i++) {
     for (HashValueVector::const_iterator j = public_key_hashes.begin();
          j != public_key_hashes.end(); ++j) {
       if (j->tag == HASH_VALUE_SHA1 &&
           memcmp(j->data(), kHashes[i], base::kSHA1Length) == 0) {
         return true;
       }
     }
@@ skipping 148 matching lines @@
             return true;
         }
       }
     }
   }
 
   return false;
 }
 
 }  // namespace net