mirror of
https://github.com/mozilla/gecko-dev.git
synced 2024-11-07 20:17:37 +00:00
196 lines
8.1 KiB
JSON
196 lines
8.1 KiB
JSON
// -*- Mode: javascript; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*-
|
|
// This Source Code Form is subject to the terms of the Mozilla Public
|
|
// License, v. 2.0. If a copy of the MPL was not distributed with this
|
|
// file, You can obtain one at http://mozilla.org/MPL/2.0/.
|
|
|
|
// The top-level element is a dictionary with two keys: "pinsets" maps details
|
|
// of certificate pinning to a name and "entries" contains the HPKP details for
|
|
// each host.
|
|
//
|
|
// "pinsets" is a list of objects. Each object has the following members:
|
|
// name: (string) the name of the pinset
|
|
// static_spki_hashes: (list of strings) the set of allowed SPKIs hashes
|
|
//
|
|
// For a given pinset, a certificate is accepted if at least one of the
|
|
// "static_spki_hashes" SPKIs is found in the chain.
|
|
// SPKIs are specified as names, which must match up with the name given
|
|
// in the Mozilla root store.
|
|
//
|
|
// "entries" is a list of objects. Each object has the following members:
|
|
// name: (string) the DNS name of the host in question
|
|
// include_subdomains: (optional bool) whether subdomains of |name| are also covered
|
|
// pins: (string) the |name| member of an object in |pinsets|
|
|
|
|
// equifax -> aus3
|
|
// Geotrust Primary -> www.mozilla.org
|
|
// Geotrust Global -> *. addons.mozilla.org
|
|
{
|
|
"chromium_data" : {
|
|
"cert_file_url": "https://src.chromium.org/chrome/trunk/src/net/http/transport_security_state_static.certs",
|
|
"json_file_url": "https://src.chromium.org/chrome/trunk/src/net/http/transport_security_state_static.json",
|
|
"substitute_pinsets": {
|
|
// Use the larger google_root_pems pinset instead of google
|
|
"google": "google_root_pems"
|
|
},
|
|
"production_domains": [
|
|
// Chrome's test domain.
|
|
"pinningtest.appspot.com",
|
|
// Twitter
|
|
"api.twitter.com",
|
|
"business.twitter.com",
|
|
"dev.twitter.com",
|
|
"mobile.twitter.com",
|
|
"oauth.twitter.com",
|
|
"platform.twitter.com",
|
|
"twimg.com",
|
|
"twitter.com",
|
|
"www.twitter.com"
|
|
]
|
|
},
|
|
"pinsets": [
|
|
{
|
|
// From bug 772756, mozilla uses GeoTrust, Digicert and Thawte. Our
|
|
// cdn sites use Verisign and Baltimore. We exclude 1024-bit root certs
|
|
// from all providers. geotrust ca info:
|
|
// http://www.geotrust.com/resources/root-certificates/index.html
|
|
"name": "mozilla",
|
|
"sha256_hashes": [
|
|
"Baltimore CyberTrust Root",
|
|
"DigiCert Assured ID Root CA",
|
|
"DigiCert Global Root CA",
|
|
"DigiCert High Assurance EV Root CA",
|
|
"GeoTrust Global CA",
|
|
"GeoTrust Global CA 2",
|
|
"GeoTrust Primary Certification Authority",
|
|
"GeoTrust Primary Certification Authority - G2",
|
|
"GeoTrust Primary Certification Authority - G3",
|
|
"GeoTrust Universal CA",
|
|
"GeoTrust Universal CA 2",
|
|
"thawte Primary Root CA",
|
|
"thawte Primary Root CA - G2",
|
|
"thawte Primary Root CA - G3",
|
|
"Verisign Class 1 Public Primary Certification Authority - G3",
|
|
"Verisign Class 2 Public Primary Certification Authority - G3",
|
|
"Verisign Class 3 Public Primary Certification Authority - G3",
|
|
"VeriSign Class 3 Public Primary Certification Authority - G4",
|
|
"VeriSign Class 3 Public Primary Certification Authority - G5",
|
|
"Verisign Class 4 Public Primary Certification Authority - G3",
|
|
"VeriSign Universal Root Certification Authority"
|
|
]
|
|
},
|
|
// For pinning tests on pinning.example.com, the certificate must be 'End
|
|
// Entity Test Cert'
|
|
{
|
|
"name": "mozilla_test",
|
|
"sha256_hashes": [
|
|
"End Entity Test Cert"
|
|
]
|
|
},
|
|
// Google's root PEMs. Chrome pins only to their intermediate certs, but
|
|
// they'd like us to be more liberal. For the initial list, we are using
|
|
// the certs from http://pki.google.com/roots.pem.
|
|
{
|
|
"name": "google_root_pems",
|
|
"sha256_hashes": [
|
|
"AddTrust External Root",
|
|
"AddTrust Low-Value Services Root",
|
|
"AddTrust Public Services Root",
|
|
"AddTrust Qualified Certificates Root",
|
|
"AffirmTrust Commercial",
|
|
"AffirmTrust Networking",
|
|
"AffirmTrust Premium",
|
|
"AffirmTrust Premium ECC",
|
|
"America Online Root Certification Authority 1",
|
|
"America Online Root Certification Authority 2",
|
|
"Baltimore CyberTrust Root",
|
|
"Comodo AAA Services root",
|
|
"COMODO Certification Authority",
|
|
"COMODO ECC Certification Authority",
|
|
"Comodo Secure Services root",
|
|
"Comodo Trusted Services root",
|
|
"Cybertrust Global Root",
|
|
"DigiCert Assured ID Root CA",
|
|
"DigiCert Global Root CA",
|
|
"DigiCert High Assurance EV Root CA",
|
|
"Entrust.net Premium 2048 Secure Server CA",
|
|
"Entrust.net Secure Server CA",
|
|
"Entrust Root Certification Authority",
|
|
"Equifax Secure CA",
|
|
"Equifax Secure eBusiness CA 1",
|
|
// We have no built-in for this.
|
|
// "Equifax Secure eBusiness CA 2",
|
|
"Equifax Secure Global eBusiness CA",
|
|
"GeoTrust Global CA",
|
|
"GeoTrust Global CA 2",
|
|
"GeoTrust Primary Certification Authority",
|
|
"GeoTrust Primary Certification Authority - G2",
|
|
"GeoTrust Primary Certification Authority - G3",
|
|
"GeoTrust Universal CA",
|
|
"GeoTrust Universal CA 2",
|
|
"GlobalSign Root CA",
|
|
"GlobalSign Root CA - R2",
|
|
"GlobalSign Root CA - R3",
|
|
"Go Daddy Class 2 CA",
|
|
"Go Daddy Root Certificate Authority - G2",
|
|
"GTE CyberTrust Global Root",
|
|
"Network Solutions Certificate Authority",
|
|
"RSA Root Certificate 1",
|
|
"Starfield Class 2 CA",
|
|
"Starfield Root Certificate Authority - G2",
|
|
"Starfield Services Root Certificate Authority - G2",
|
|
"StartCom Certification Authority",
|
|
"StartCom Certification Authority",
|
|
"StartCom Certification Authority G2",
|
|
"TC TrustCenter Class 2 CA II",
|
|
"TC TrustCenter Class 3 CA II",
|
|
"TC TrustCenter Universal CA I",
|
|
"TC TrustCenter Universal CA III",
|
|
"Thawte Premium Server CA",
|
|
"thawte Primary Root CA",
|
|
"thawte Primary Root CA - G2",
|
|
"thawte Primary Root CA - G3",
|
|
"Thawte Server CA",
|
|
"UTN DATACorp SGC Root CA",
|
|
"UTN USERFirst Hardware Root CA",
|
|
"ValiCert Class 1 VA",
|
|
"ValiCert Class 2 VA",
|
|
"Verisign Class 3 Public Primary Certification Authority",
|
|
"Verisign Class 3 Public Primary Certification Authority",
|
|
"Verisign Class 3 Public Primary Certification Authority - G2",
|
|
"Verisign Class 3 Public Primary Certification Authority - G3",
|
|
"VeriSign Class 3 Public Primary Certification Authority - G4",
|
|
"VeriSign Class 3 Public Primary Certification Authority - G5",
|
|
"Verisign Class 4 Public Primary Certification Authority - G3",
|
|
"VeriSign Universal Root Certification Authority",
|
|
"XRamp Global CA Root"
|
|
]
|
|
}
|
|
],
|
|
|
|
"entries": [
|
|
// Only domains that are operationally crucial to Firefox can have per-host
|
|
// telemetry reporting (the "id") field
|
|
{ "name": "addons.mozilla.org", "include_subdomains": true,
|
|
"pins": "mozilla", "test_mode": true, "id": 1 },
|
|
{ "name": "addons.mozilla.net", "include_subdomains": true,
|
|
"pins": "mozilla", "test_mode": true, "id": 2 },
|
|
{ "name": "aus4.mozilla.org", "include_subdomains": true,
|
|
"pins": "mozilla", "test_mode": true, "id": 3 },
|
|
{ "name": "cdn.mozilla.net", "include_subdomains": true,
|
|
"pins": "mozilla", "test_mode": false },
|
|
{ "name": "cdn.mozilla.org", "include_subdomains": true,
|
|
"pins": "mozilla", "test_mode": false },
|
|
{ "name": "media.mozilla.com", "include_subdomains": true,
|
|
"pins": "mozilla", "test_mode": false },
|
|
{ "name": "include-subdomains.pinning.example.com",
|
|
"include_subdomains": true, "pins": "mozilla_test",
|
|
"test_mode": false },
|
|
// Example domain to collect per-host stats for telemetry tests.
|
|
{ "name": "exclude-subdomains.pinning.example.com",
|
|
"include_subdomains": false, "pins": "mozilla_test",
|
|
"test_mode": false, "id": 0 },
|
|
{ "name": "test-mode.pinning.example.com", "include_subdomains": true,
|
|
"pins": "mozilla_test", "test_mode": true }
|
|
]
|
|
}
|