diff options
| author | agl@chromium.org <agl@chromium.org@0039d316-1c4b-4281-b951-d872f2087c98> | 2010-08-28 15:53:50 +0000 |
|---|---|---|
| committer | agl@chromium.org <agl@chromium.org@0039d316-1c4b-4281-b951-d872f2087c98> | 2010-08-28 15:53:50 +0000 |
| commit | 899c3e93acbd41bcd3c5ce5d09eddef8f45ab3ff (patch) | |
| tree | 38b3e5caabeb273244b348e1bd101181aa6ce576 /chrome/app/generated_resources.grd | |
| parent | 40251a21ba6eea816755b1bcb9edf305c782aeda (diff) | |
| download | chromium_src-899c3e93acbd41bcd3c5ce5d09eddef8f45ab3ff.zip chromium_src-899c3e93acbd41bcd3c5ce5d09eddef8f45ab3ff.tar.gz chromium_src-899c3e93acbd41bcd3c5ce5d09eddef8f45ab3ff.tar.bz2 | |
https: add support for DNS exclusion and switch to TXT records.
(This code has no effect unless --enable-dnssec-certs is given.)
The existing DNSSEC code will process embeded chains in certificates
and validate CERT records there in. The format of the CERT record was
just something made up as a proof of concept. This change switches
that code to using TXT records which are at least used by some other
code.
Additionally, when --enable-dnssec-certs is given. TXT record lookups
are triggered for each HTTPS connection. If DNSSEC secure, these
lookups can validate a HTTPS certificate. Even without DNSSEC, they
can by used for exclusion: if TLS fingerprints are given, but the
certificate doesn't match any of them, then the certificate is
rejected.
The next step in this series will be to perform the TXT lookup for
some percentage of dev channel users in order to measure the latency
impact. For this experiment, all behavioural changes will be disabled.
BUG=none
TEST=net_unittests
http://codereview.chromium.org/3148037/show
git-svn-id: svn://svn.chromium.org/chrome/trunk/src@57787 0039d316-1c4b-4281-b951-d872f2087c98
Diffstat (limited to 'chrome/app/generated_resources.grd')
| -rw-r--r-- | chrome/app/generated_resources.grd | 13 |
1 files changed, 13 insertions, 0 deletions
diff --git a/chrome/app/generated_resources.grd b/chrome/app/generated_resources.grd index 0c004e2..b08c02e 100644 --- a/chrome/app/generated_resources.grd +++ b/chrome/app/generated_resources.grd @@ -2525,6 +2525,19 @@ each locale. --> Server's certificate is signed using a weak signature algorithm </message> + <message name="IDS_CERT_ERROR_NOT_IN_DNS_TITLE" desc="Title of the error page for a certificate which was excluded by DNS data"> + Unlisted Server Certificate + </message> + <message name="IDS_CERT_ERROR_NOT_IN_DNS_DESCRIPTION" desc="Description of the error for a certificate which was excluded by DNS data"> + Server's certificate is not included in DNS + </message> + <message name="IDS_CERT_ERROR_NOT_IN_DNS_DETAILS" desc="Details of the error for a certificate which was excluded by DNS data"> + This site lists all its valid certificates in DNS. However the server used one which isn't listed. + </message> + <message name="IDS_CERT_ERROR_NOT_IN_DNS_EXTRA_INFO" desc="Extra for when a certificate was excluded by DNS data"> + This is an experimental scheme where by HTTPS certificates can be authenticated and rejected by (DNSSEC secured) DNS records. If you are seeing this message then you have enabled experiemental features using command line options. You can remove those command line options to ignore this error. + </message> + <message name="IDS_CERT_ERROR_UNKNOWN_ERROR_TITLE" desc="Title of the error page for an unknown ssl error"> Unknown server certificate error </message> |