1 // -*- indent-tabs-mode: nil; js-indent-level: 2 -*-
2 // This Source Code Form is subject to the terms of the Mozilla Public
3 // License, v. 2.0. If a copy of the MPL was not distributed with this
4 // file, You can obtain one at http://mozilla.org/MPL/2.0/.
8 // Tests enterprise root certificate support. When configured to do so, the
9 // platform will attempt to find and import enterprise root certificates. This
10 // feature is specific to Windows.
12 do_get_profile(); // must be called before getting nsIX509CertDB
14 const { TestUtils } = ChromeUtils.importESModule(
15 "resource://testing-common/TestUtils.sys.mjs"
18 async function check_no_enterprise_roots_imported(
23 let enterpriseRoots = nssComponent.getEnterpriseRoots();
24 notEqual(enterpriseRoots, null, "enterprise roots list should not be null");
26 enterpriseRoots.length,
28 "should not have imported any enterprise roots"
31 let cert = certDB.findCertByDBKey(dbKey);
32 // If the garbage-collector hasn't run, there may be reachable copies of
33 // imported enterprise root certificates. If so, they shouldn't be trusted
34 // to issue TLS server auth certificates.
36 await asyncTestCertificateUsages(certDB, cert, []);
41 async function check_some_enterprise_roots_imported(nssComponent, certDB) {
42 let enterpriseRoots = nssComponent.getEnterpriseRoots();
43 notEqual(enterpriseRoots, null, "enterprise roots list should not be null");
45 enterpriseRoots.length,
47 "should have imported some enterprise roots"
49 let foundNonBuiltIn = false;
50 let savedDBKey = null;
51 for (let certDer of enterpriseRoots) {
52 let cert = certDB.constructX509(certDer);
53 notEqual(cert, null, "should be able to decode cert from DER");
55 foundNonBuiltIn = true;
56 savedDBKey = cert.dbKey;
57 info("saving dbKey from " + cert.commonName);
58 await asyncTestCertificateUsages(certDB, cert, [certificateUsageSSLCA]);
62 ok(foundNonBuiltIn, "should have found non-built-in root");
66 add_task(async function run_test() {
67 let nssComponent = Cc["@mozilla.org/psm;1"].getService(Ci.nsINSSComponent);
68 let certDB = Cc["@mozilla.org/security/x509certdb;1"].getService(
71 nssComponent.getEnterpriseRoots(); // blocks until roots are loaded
72 await check_some_enterprise_roots_imported(nssComponent, certDB);
73 Services.prefs.setBoolPref("security.enterprise_roots.enabled", false);
74 await check_no_enterprise_roots_imported(nssComponent, certDB);
75 Services.prefs.setBoolPref("security.enterprise_roots.enabled", true);
76 await TestUtils.topicObserved("psm:enterprise-certs-imported");
77 let savedDBKey = await check_some_enterprise_roots_imported(
81 Services.prefs.setBoolPref("security.enterprise_roots.enabled", false);
82 await check_no_enterprise_roots_imported(nssComponent, certDB, savedDBKey);