1 // Copyright (c) 2006-2008 The Chromium Authors. All rights reserved. 2 // Use of this source code is governed by a BSD-style license that can be 3 // found in the LICENSE file. 4 5 #include "net/base/ev_root_ca_metadata.h" 6 7 #if defined(USE_NSS) 8 #include <cert.h> 9 #include <pkcs11n.h> 10 #include <secerr.h> 11 #include <secoid.h> 12 #endif 13 14 #include "base/logging.h" 15 #include "base/singleton.h" 16 17 namespace net { 18 19 // Raw metadata. 20 struct EVMetadata { 21 // The SHA-1 fingerprint of the root CA certificate, used as a unique 22 // identifier for a root CA certificate. 23 X509Certificate::Fingerprint fingerprint; 24 25 // The EV policy OID of the root CA. 26 // Note: a root CA may have multiple EV policies. When that actually 27 // happens, we'll need to support that. 28 const char* policy_oid; 29 }; 30 31 static const EVMetadata ev_root_ca_metadata[] = { 32 // AddTrust External CA Root 33 // https://addtrustexternalcaroot-ev.comodoca.com 34 { { { 0x02, 0xfa, 0xf3, 0xe2, 0x91, 0x43, 0x54, 0x68, 0x60, 0x78, 35 0x57, 0x69, 0x4d, 0xf5, 0xe4, 0x5b, 0x68, 0x85, 0x18, 0x68 } }, 36 "1.3.6.1.4.1.6449.1.2.1.5.1" 37 }, 38 // COMODO Certification Authority 39 // https://secure.comodo.com/ 40 { { { 0x66, 0x31, 0xbf, 0x9e, 0xf7, 0x4f, 0x9e, 0xb6, 0xc9, 0xd5, 41 0xa6, 0x0c, 0xba, 0x6a, 0xbe, 0xd1, 0xf7, 0xbd, 0xef, 0x7b } }, 42 "1.3.6.1.4.1.6449.1.2.1.5.1" 43 }, 44 // COMODO ECC Certification Authority 45 // https://comodoecccertificationauthority-ev.comodoca.com/ 46 { { { 0x9f, 0x74, 0x4e, 0x9f, 0x2b, 0x4d, 0xba, 0xec, 0x0f, 0x31, 47 0x2c, 0x50, 0xb6, 0x56, 0x3b, 0x8e, 0x2d, 0x93, 0xc3, 0x11 } }, 48 "1.3.6.1.4.1.6449.1.2.1.5.1" 49 }, 50 // Cybertrust Global Root 51 // https://evup.cybertrust.ne.jp/ctj-ev-upgrader/evseal.gif 52 { { { 0x5f, 0x43, 0xe5, 0xb1, 0xbf, 0xf8, 0x78, 0x8c, 0xac, 0x1c, 53 0xc7, 0xca, 0x4a, 0x9a, 0xc6, 0x22, 0x2b, 0xcc, 0x34, 0xc6 } }, 54 "1.3.6.1.4.1.6334.1.100.1" 55 }, 56 // DigiCert High Assurance EV Root CA 57 // https://www.digicert.com 58 { { { 0x5f, 0xb7, 0xee, 0x06, 0x33, 0xe2, 0x59, 0xdb, 0xad, 0x0c, 59 0x4c, 0x9a, 0xe6, 0xd3, 0x8f, 0x1a, 0x61, 0xc7, 0xdc, 0x25 } }, 60 "2.16.840.1.114412.2.1" 61 }, 62 // DigiNotar Root CA 63 // https://www.evssl.nl 64 // https://www.polisdirect.nl 65 { { { 0xc0, 0x60, 0xed, 0x44, 0xcb, 0xd8, 0x81, 0xbd, 0x0e, 0xf8, 66 0x6c, 0x0b, 0xa2, 0x87, 0xdd, 0xcf, 0x81, 0x67, 0x47, 0x8c } }, 67 "2.16.528.1.1001.1.1.1.12.6.1.1.1" 68 }, 69 // Entrust.net Secure Server Certification Authority 70 // https://www.entrust.net/ 71 { { { 0x99, 0xa6, 0x9b, 0xe6, 0x1a, 0xfe, 0x88, 0x6b, 0x4d, 0x2b, 72 0x82, 0x00, 0x7c, 0xb8, 0x54, 0xfc, 0x31, 0x7e, 0x15, 0x39 } }, 73 "2.16.840.1.114028.10.1.2" 74 }, 75 // Entrust Root Certification Authority 76 // https://www.entrust.net/ 77 { { { 0xb3, 0x1e, 0xb1, 0xb7, 0x40, 0xe3, 0x6c, 0x84, 0x02, 0xda, 78 0xdc, 0x37, 0xd4, 0x4d, 0xf5, 0xd4, 0x67, 0x49, 0x52, 0xf9 } }, 79 "2.16.840.1.114028.10.1.2" 80 }, 81 // Equifax Secure Certificate Authority (GeoTrust) 82 // https://www.geotrust.com/ 83 { { { 0xd2, 0x32, 0x09, 0xad, 0x23, 0xd3, 0x14, 0x23, 0x21, 0x74, 84 0xe4, 0x0d, 0x7f, 0x9d, 0x62, 0x13, 0x97, 0x86, 0x63, 0x3a } }, 85 "1.3.6.1.4.1.14370.1.6" 86 }, 87 // GeoTrust Primary Certification Authority 88 // https://www.geotrust.com/ 89 { { { 0x32, 0x3c, 0x11, 0x8e, 0x1b, 0xf7, 0xb8, 0xb6, 0x52, 0x54, 90 0xe2, 0xe2, 0x10, 0x0d, 0xd6, 0x02, 0x90, 0x37, 0xf0, 0x96 } }, 91 "1.3.6.1.4.1.14370.1.6" 92 }, 93 // GlobalSign 94 // https://www.globalsign.com/ 95 { { { 0x75, 0xe0, 0xab, 0xb6, 0x13, 0x85, 0x12, 0x27, 0x1c, 0x04, 96 0xf8, 0x5f, 0xdd, 0xde, 0x38, 0xe4, 0xb7, 0x24, 0x2e, 0xfe } }, 97 "1.3.6.1.4.1.4146.1.1" 98 }, 99 // GlobalSign Root CA 100 { { { 0xb1, 0xbc, 0x96, 0x8b, 0xd4, 0xf4, 0x9d, 0x62, 0x2a, 0xa8, 101 0x9a, 0x81, 0xf2, 0x15, 0x01, 0x52, 0xa4, 0x1d, 0x82, 0x9c } }, 102 "1.3.6.1.4.1.4146.1.1" 103 }, 104 // Go Daddy Class 2 Certification Authority 105 // https://www.godaddy.com/ 106 { { { 0x27, 0x96, 0xba, 0xe6, 0x3f, 0x18, 0x01, 0xe2, 0x77, 0x26, 107 0x1b, 0xa0, 0xd7, 0x77, 0x70, 0x02, 0x8f, 0x20, 0xee, 0xe4 } }, 108 "2.16.840.1.114413.1.7.23.3" 109 }, 110 // GTE CyberTrust Global Root 111 // https://www.cybertrust.ne.jp/ 112 { { { 0x97, 0x81, 0x79, 0x50, 0xd8, 0x1c, 0x96, 0x70, 0xcc, 0x34, 113 0xd8, 0x09, 0xcf, 0x79, 0x44, 0x31, 0x36, 0x7e, 0xf4, 0x74 } }, 114 "1.3.6.1.4.1.6334.1.100.1" 115 }, 116 // Network Solutions Certificate Authority 117 // https://www.networksolutions.com/website-packages/index.jsp 118 { { { 0x74, 0xf8, 0xa3, 0xc3, 0xef, 0xe7, 0xb3, 0x90, 0x06, 0x4b, 119 0x83, 0x90, 0x3c, 0x21, 0x64, 0x60, 0x20, 0xe5, 0xdf, 0xce } }, 120 "1.3.6.1.4.1.782.1.2.1.8.1" 121 }, 122 // QuoVadis Root CA 2 123 // https://www.quovadis.bm/ 124 { { { 0xca, 0x3a, 0xfb, 0xcf, 0x12, 0x40, 0x36, 0x4b, 0x44, 0xb2, 125 0x16, 0x20, 0x88, 0x80, 0x48, 0x39, 0x19, 0x93, 0x7c, 0xf7 } }, 126 "1.3.6.1.4.1.8024.0.2.100.1.2" 127 }, 128 // SecureTrust CA, SecureTrust Corporation 129 // https://www.securetrust.com 130 // https://www.trustwave.com/ 131 { { { 0x87, 0x82, 0xc6, 0xc3, 0x04, 0x35, 0x3b, 0xcf, 0xd2, 0x96, 132 0x92, 0xd2, 0x59, 0x3e, 0x7d, 0x44, 0xd9, 0x34, 0xff, 0x11 } }, 133 "2.16.840.1.114404.1.1.2.4.1" 134 }, 135 // Secure Global CA, SecureTrust Corporation 136 { { { 0x3a, 0x44, 0x73, 0x5a, 0xe5, 0x81, 0x90, 0x1f, 0x24, 0x86, 137 0x61, 0x46, 0x1e, 0x3b, 0x9c, 0xc4, 0x5f, 0xf5, 0x3a, 0x1b } }, 138 "2.16.840.1.114404.1.1.2.4.1" 139 }, 140 // Security Communication RootCA1 141 // https://www.secomtrust.net/contact/form.html 142 { { { 0x36, 0xb1, 0x2b, 0x49, 0xf9, 0x81, 0x9e, 0xd7, 0x4c, 0x9e, 143 0xbc, 0x38, 0x0f, 0xc6, 0x56, 0x8f, 0x5d, 0xac, 0xb2, 0xf7 } }, 144 "1.2.392.200091.100.721.1" 145 }, 146 // Security Communication EV RootCA1 147 // https://www.secomtrust.net/contact/form.html 148 { { { 0xfe, 0xb8, 0xc4, 0x32, 0xdc, 0xf9, 0x76, 0x9a, 0xce, 0xae, 149 0x3d, 0xd8, 0x90, 0x8f, 0xfd, 0x28, 0x86, 0x65, 0x64, 0x7d } }, 150 "1.2.392.200091.100.721.1" 151 }, 152 // Starfield Class 2 Certification Authority 153 // https://www.starfieldtech.com/ 154 { { { 0xad, 0x7e, 0x1c, 0x28, 0xb0, 0x64, 0xef, 0x8f, 0x60, 0x03, 155 0x40, 0x20, 0x14, 0xc3, 0xd0, 0xe3, 0x37, 0x0e, 0xb5, 0x8a } }, 156 "2.16.840.1.114414.1.7.23.3" 157 }, 158 // SwissSign Gold CA - G2 159 // https://testevg2.swisssign.net/ 160 { { { 0xd8, 0xc5, 0x38, 0x8a, 0xb7, 0x30, 0x1b, 0x1b, 0x6e, 0xd4, 161 0x7a, 0xe6, 0x45, 0x25, 0x3a, 0x6f, 0x9f, 0x1a, 0x27, 0x61 } }, 162 "2.16.756.1.89.1.2.1.1" 163 }, 164 // Thawte Premium Server CA 165 // https://www.thawte.com/ 166 { { { 0x62, 0x7f, 0x8d, 0x78, 0x27, 0x65, 0x63, 0x99, 0xd2, 0x7d, 167 0x7f, 0x90, 0x44, 0xc9, 0xfe, 0xb3, 0xf3, 0x3e, 0xfa, 0x9a } }, 168 "2.16.840.1.113733.1.7.48.1" 169 }, 170 // thawte Primary Root CA 171 // https://www.thawte.com/ 172 { { { 0x91, 0xc6, 0xd6, 0xee, 0x3e, 0x8a, 0xc8, 0x63, 0x84, 0xe5, 173 0x48, 0xc2, 0x99, 0x29, 0x5c, 0x75, 0x6c, 0x81, 0x7b, 0x81 } }, 174 "2.16.840.1.113733.1.7.48.1" 175 }, 176 // UTN - DATACorp SGC 177 { { { 0x58, 0x11, 0x9f, 0x0e, 0x12, 0x82, 0x87, 0xea, 0x50, 0xfd, 178 0xd9, 0x87, 0x45, 0x6f, 0x4f, 0x78, 0xdc, 0xfa, 0xd6, 0xd4 } }, 179 "1.3.6.1.4.1.6449.1.2.1.5.1" 180 }, 181 // UTN-USERFirst-Hardware 182 { { { 0x04, 0x83, 0xed, 0x33, 0x99, 0xac, 0x36, 0x08, 0x05, 0x87, 183 0x22, 0xed, 0xbc, 0x5e, 0x46, 0x00, 0xe3, 0xbe, 0xf9, 0xd7 } }, 184 "1.3.6.1.4.1.6449.1.2.1.5.1" 185 }, 186 // ValiCert Class 2 Policy Validation Authority 187 // TODO(wtc): bug 1165107: this CA has another policy OID 188 // "2.16.840.1.114414.1.7.23.3". 189 { { { 0x31, 0x7a, 0x2a, 0xd0, 0x7f, 0x2b, 0x33, 0x5e, 0xf5, 0xa1, 190 0xc3, 0x4e, 0x4b, 0x57, 0xe8, 0xb7, 0xd8, 0xf1, 0xfc, 0xa6 } }, 191 "2.16.840.1.114413.1.7.23.3" 192 }, 193 // VeriSign Class 3 Public Primary Certification Authority 194 // https://www.verisign.com/ 195 { { { 0x74, 0x2c, 0x31, 0x92, 0xe6, 0x07, 0xe4, 0x24, 0xeb, 0x45, 196 0x49, 0x54, 0x2b, 0xe1, 0xbb, 0xc5, 0x3e, 0x61, 0x74, 0xe2 } }, 197 "2.16.840.1.113733.1.7.23.6" 198 }, 199 // VeriSign Class 3 Public Primary Certification Authority - G5 200 // https://www.verisign.com/ 201 { { { 0x4e, 0xb6, 0xd5, 0x78, 0x49, 0x9b, 0x1c, 0xcf, 0x5f, 0x58, 202 0x1e, 0xad, 0x56, 0xbe, 0x3d, 0x9b, 0x67, 0x44, 0xa5, 0xe5 } }, 203 "2.16.840.1.113733.1.7.23.6" 204 }, 205 // Wells Fargo WellsSecure Public Root Certificate Authority 206 // https://nerys.wellsfargo.com/test.html 207 { { { 0xe7, 0xb4, 0xf6, 0x9d, 0x61, 0xec, 0x90, 0x69, 0xdb, 0x7e, 208 0x90, 0xa7, 0x40, 0x1a, 0x3c, 0xf4, 0x7d, 0x4f, 0xe8, 0xee } }, 209 "2.16.840.1.114171.500.9" 210 }, 211 // XRamp Global Certification Authority 212 { { { 0xb8, 0x01, 0x86, 0xd1, 0xeb, 0x9c, 0x86, 0xa5, 0x41, 0x04, 213 0xcf, 0x30, 0x54, 0xf3, 0x4c, 0x52, 0xb7, 0xe5, 0x58, 0xc6 } }, 214 "2.16.840.1.114404.1.1.2.4.1" 215 } 216 }; 217 218 // static 219 EVRootCAMetadata* EVRootCAMetadata::GetInstance() { 220 return Singleton<EVRootCAMetadata>::get(); 221 } 222 223 bool EVRootCAMetadata::GetPolicyOID( 224 const X509Certificate::Fingerprint& fingerprint, 225 PolicyOID* policy_oid) const { 226 PolicyOidMap::const_iterator iter = ev_policy_.find(fingerprint); 227 if (iter == ev_policy_.end()) 228 return false; 229 *policy_oid = iter->second; 230 return true; 231 } 232 233 EVRootCAMetadata::EVRootCAMetadata() { 234 // Constructs the object from the raw metadata in ev_root_ca_metadata. 235 #if defined(USE_NSS) 236 for (size_t i = 0; i < arraysize(ev_root_ca_metadata); i++) { 237 const EVMetadata& metadata = ev_root_ca_metadata[i]; 238 PRUint8 buf[1024]; 239 SECItem oid_item; 240 oid_item.data = buf; 241 oid_item.len = sizeof(buf); 242 SECStatus status = SEC_StringToOID(NULL, &oid_item, metadata.policy_oid, 0); 243 if (status != SECSuccess) { 244 LOG(ERROR) << "Failed to convert to OID: " << metadata.policy_oid; 245 continue; 246 } 247 // Register the OID. 248 SECOidData od; 249 od.oid.len = oid_item.len; 250 od.oid.data = oid_item.data; 251 od.offset = SEC_OID_UNKNOWN; 252 od.desc = metadata.policy_oid; 253 od.mechanism = CKM_INVALID_MECHANISM; 254 od.supportedExtension = INVALID_CERT_EXTENSION; 255 SECOidTag policy = SECOID_AddEntry(&od); 256 DCHECK(policy != SEC_OID_UNKNOWN); 257 ev_policy_[metadata.fingerprint] = policy; 258 policy_oids_.push_back(policy); 259 } 260 #else 261 for (size_t i = 0; i < arraysize(ev_root_ca_metadata); i++) { 262 const EVMetadata& metadata = ev_root_ca_metadata[i]; 263 ev_policy_[metadata.fingerprint] = metadata.policy_oid; 264 // Multiple root CA certs may use the same EV policy OID. Having 265 // duplicates in the policy_oids_ array does no harm, so we don't 266 // bother detecting duplicates. 267 policy_oids_.push_back(metadata.policy_oid); 268 } 269 #endif 270 } 271 272 } // namespace net 273
