No Bug, mozilla-esr115 repo-update HSTS HPKP remote-settings tld-suffixes - a=repo-update, r=dmeehan

Differential Revision: https://phabricator.services.mozilla.com/D208120

Differential Revision: https://phabricator.services.mozilla.com/D207426

Bug 1888488: update staging content signing root certificate to new cas_new root certificate  a=RyanVM

This is the cas_new root (https://bugzilla.mozilla.org/attachment.cgi?id=9390855) converted from PEM to DER with: `openssl x509 -in cas-new-root-2024-03-12.crt -inform PEM -outform DER`

Original Revision: https://phabricator.services.mozilla.com/D206040

Differential Revision: https://phabricator.services.mozilla.com/D207263

Differential Revision: https://phabricator.services.mozilla.com/D206893

Original Revision: https://phabricator.services.mozilla.com/D206106

Differential Revision: https://phabricator.services.mozilla.com/D206750

Differential Revision: https://phabricator.services.mozilla.com/D206614

Original Revision: https://phabricator.services.mozilla.com/D204326

Differential Revision: https://phabricator.services.mozilla.com/D205134

Differential Revision: https://phabricator.services.mozilla.com/D206232

Differential Revision: https://phabricator.services.mozilla.com/D206068

Differential Revision: https://phabricator.services.mozilla.com/D206010

Bug 1886830: update staging content signing root certificate to new cas_cur root certificate  a=RyanVM

This certificate is `cas-cur-root-2024-03-12.crt` from bug 1882192 (https://bugzilla.mozilla.org/attachment.cgi?id=9390858), and has been converted to DER with:

$ openssl x509 -in cas-cur-root-2024-03-12.crt -inform PEM -outform DER

Original Revision: https://phabricator.services.mozilla.com/D205356

Differential Revision: https://phabricator.services.mozilla.com/D205774

Generated from the crt file from bug 1882192 with:

openssl x509 -inform PEM -in /tmp/cas-cur-intermediate-amo-2024-03-12.crt -outform DER -out security/manager/ssl/addons-stage-intermediate.crt

Differential Revision: https://phabricator.services.mozilla.com/D204778

addons-stage.crt is the DER-encoded version of the
cas-cur-root-2024-03-12.crt file from bug 1882192, generated with:

openssl x509 -inform PEM -in /tmp/cas-cur-root-2024-03-12.crt -outform DER -out security/manager/ssl/addons-stage.crt

The four zip files are from bug 1885457, and are the same file, but
signed with the new certificate.

Differential Revision: https://phabricator.services.mozilla.com/D204706

Differential Revision: https://phabricator.services.mozilla.com/D205554

Differential Revision: https://phabricator.services.mozilla.com/D205325

Differential Revision: https://phabricator.services.mozilla.com/D204888

Differential Revision: https://phabricator.services.mozilla.com/D204210

Differential Revision: https://phabricator.services.mozilla.com/D203895

Differential Revision: https://phabricator.services.mozilla.com/D203411

Original Revision: https://phabricator.services.mozilla.com/D202015

Differential Revision: https://phabricator.services.mozilla.com/D202017

Differential Revision: https://phabricator.services.mozilla.com/D202705

Bug 1851570 - [for esr] Allow necko to know when client auth is selected to drive TLS handshake, r=necko, a=dsmith

Differential Revision: https://phabricator.services.mozilla.com/D201722

Bug 1851570 - [for esr] Allow necko to know when client auth is selected to drive TLS handshake, r=necko-reviewers,valentin, a=dsmith

Differential Revision: https://phabricator.services.mozilla.com/D201722

Differential Revision: https://phabricator.services.mozilla.com/D202407

Differential Revision: https://phabricator.services.mozilla.com/D201951

Differential Revision: https://phabricator.services.mozilla.com/D201069

Differential Revision: https://phabricator.services.mozilla.com/D199418

Differential Revision: https://phabricator.services.mozilla.com/D200615

Bug 1874627 - regenerate expiring test certificates for 2024 (branch patch), this time with certificates included. r=jschank a=test-only


* the certificates were regenerated using `./mach generate-test-certs`
* the build/pgo/certs/ changes were made using
  `./mach python build/pgo/genpgocert.py`
* the zip files in security/manager/ssl/tests/unit/test_signed_apps/ were
  updated per the directions in the corresponding moz.build file
* security/manager/ssl/tests/unit/test_cert_override_read.js needed manual
  updating

These certificates and other test artifacts will now expire in 2025.

Differential Revision: https://phabricator.services.mozilla.com/D199156

* the certificates were regenerated using `./mach generate-test-certs`
* the build/pgo/certs/ changes were made using
  `./mach python build/pgo/genpgocert.py`
* the zip files in security/manager/ssl/tests/unit/test_signed_apps/ were
  updated per the directions in the corresponding moz.build file
* security/manager/ssl/tests/unit/test_cert_override_read.js needed manual
  updating

These certificates and other test artifacts will now expire in 2025.

Test Plan:
https://treeherder.mozilla.org/jobs?repo=try&revision=04e3780551b5e83a70b51acd84e1b3383a249f14

Differential Revision: https://phabricator.services.mozilla.com/D199156

Differential Revision: https://phabricator.services.mozilla.com/D198526

This matches the behavior of XUL trees, and also what we did for the
languages listboxes and bug 1860214.

This is enough to fix the bug, but more in-depth fix incoming too.

Differential Revision: https://phabricator.services.mozilla.com/D198395

Differential Revision: https://phabricator.services.mozilla.com/D198258

No Bug, mozilla-esr115 repo-update HSTS HPKP remote-settings tld-suffixes - a=repo-update, r=dmeehan

Differential Revision: https://phabricator.services.mozilla.com/D197900

Differential Revision: https://phabricator.services.mozilla.com/D197672

Bug 1870262 - a subdomain of any HSTS superdomain that asserts includeSubdomains is HSTS (ESR115) r=jschanck, a=dmeehan


Previously, the HSTS implementation would only consider the first superdomain
that had any HSTS information and use the presence or absence of the
includeSubdomains directive to determine if the subdomain was HSTS. However,
the specification actually stipulates that if any superdomain that is HSTS
asserts includeSubdomains, the subdomain is HSTS.

Differential Revision: https://phabricator.services.mozilla.com/D197550

Differential Revision: https://phabricator.services.mozilla.com/D197473

Differential Revision: https://phabricator.services.mozilla.com/D197372

No Bug, mozilla-esr115 repo-update HSTS HPKP remote-settings tld-suffixes - a=repo-update, r=dmeehan

Differential Revision: https://phabricator.services.mozilla.com/D197059