security/manager/tools/PreloadedHPKPins.json

   1 // -*- Mode: javascript; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*-
   2 // This Source Code Form is subject to the terms of the Mozilla Public
   3 // License, v. 2.0. If a copy of the MPL was not distributed with this
   4 // file, You can obtain one at http://mozilla.org/MPL/2.0/.
   5
   6 // The top-level element is a dictionary with two keys: "pinsets" maps details
   7 // of certificate pinning to a name and "entries" contains the HPKP details for
   8 // each host.
   9 //
  10 // "pinsets" is a list of objects. Each object has the following members:
  11 //   name: (string) the name of the pinset
  12 //   sha256_hashes: (list of strings) the set of allowed SPKIs hashes
  13 //
  14 // For a given pinset, a certificate is accepted if at least one of the
  15 // Subject Public Key Infos (SPKIs) is found in the chain.  SPKIs are specified
  16 // as names, which must match up with the name given in the Mozilla root store.
  17 //
  18 // "entries" is a list of objects. Each object has the following members:
  19 //   name: (string) the DNS name of the host in question
  20 //   include_subdomains: (optional bool) whether subdomains of |name| are also covered
  21 //   pins: (string) the |name| member of an object in |pinsets|
  22 //
  23 // "extra_certificates" is a list of base64-encoded certificates. These are used in
  24 // pinsets that reference certificates not in our root program (for example,
  25 // Facebook or intermediate CA certs).
  26
  27 {
  28   "chromium_data" : {
  29     "cert_file_url": "https://chromium.googlesource.com/chromium/src/+/refs/heads/main/net/http/transport_security_state_static.pins?format=TEXT",
  30     "json_file_url": "https://chromium.googlesource.com/chromium/src/+/refs/heads/main/net/http/transport_security_state_static_pins.json?format=TEXT",
  31     "substitute_pinsets": {
  32       // Use the larger google_root_pems pinset instead of google
  33       "google": "google_root_pems"
  34     },
  35     "production_pinsets": [
  36       "google_root_pems",
  37       "facebook",
  38       "ncsccs"
  39     ],
  40     "production_domains": [
  41       // Chrome's test domains.
  42       "pinningtest.appspot.com",
  43       "pinning-test.badssl.com",
  44       // Tor
  45       "torproject.org",
  46       "blog.torproject.org",
  47       "check.torproject.org",
  48       "dist.torproject.org",
  49       "www.torproject.org",
  50       // SpiderOak
  51       "spideroak.com"
  52     ],
  53     "exclude_domains" : []
  54    },
  55   "pinsets": [
  56     {
  57       "name": "mozilla_services",
  58       "sha256_hashes": [
  59         // Current Digicert root hierarchy (G1)
  60         // Digicert is migrating users off this root hierarchy
  61         // https://knowledge.digicert.com/generalinformation/digicert-root-and-intermediate-ca-certificate-updates-2023.html
  62         "DigiCert Global Root CA",
  63         "DigiCert High Assurance EV Root CA",
  64         // New Digicert root hierarchy (G2)
  65         // Digicert is migrating users to this root hierarchy
  66         // https://knowledge.digicert.com/generalinformation/digicert-root-and-intermediate-ca-certificate-updates-2023.html
  67         "DigiCert Global Root G2",
  68         // Future Digicert root hierarchy (G5)
  69         // Digicert will be switching to this root hierarchy in the future
  70         // https://knowledge.digicert.com/generalinformation/digicert-g5-root-and-intermediate-ca-certificate-migration.html
  71         "DigiCert TLS ECC P384 Root G5",
  72         "DigiCert TLS RSA4096 Root G5",
  73         // Current Let’s Encrypt root hierachy
  74         // https://letsencrypt.org/certificates/
  75         "ISRG Root X1"
  76       ]
  77     },
  78     // For pinning tests on pinning.example.com, the certificate must be 'End
  79     // Entity Test Cert'
  80     {
  81       "name": "mozilla_test",
  82       "sha256_hashes": [
  83         "End Entity Test Cert"
  84       ]
  85     },
  86     // Google's root PEMs. Chrome pins only to their intermediate certs, but
  87     // they'd like us to be more liberal. For the initial list, we are using
  88     // the certs from https://pki.google.com/roots.pem.
  89     // We have no built-in for commented out CAs.
  90     // This list should be updated via the dumpGoogleRoots.js script.
  91     {
  92       "name": "google_root_pems",
  93       "sha256_hashes": [
  94         "AffirmTrust Commercial",
  95         "AffirmTrust Networking",
  96         "AffirmTrust Premium",
  97         "AffirmTrust Premium ECC",
  98         "Baltimore CyberTrust Root",
  99         "Comodo AAA Services root",
 100         "COMODO Certification Authority",
 101         "COMODO ECC Certification Authority",
 102         "COMODO RSA Certification Authority",
 103         "DigiCert Assured ID Root CA",
 104         "DigiCert Assured ID Root G2",
 105         "DigiCert Assured ID Root G3",
 106         "DigiCert Global Root CA",
 107         "DigiCert Global Root G2",
 108         "DigiCert Global Root G3",
 109         "DigiCert High Assurance EV Root CA",
 110         "DigiCert Trusted Root G4",
 111         "Entrust Root Certification Authority",
 112         "Entrust Root Certification Authority - EC1",
 113         "Entrust Root Certification Authority - G2",
 114         "Entrust.net Premium 2048 Secure Server CA",
 115         // "GlobalSign",
 116         "GlobalSign ECC Root CA - R5",
 117         "GlobalSign Root CA",
 118         "GlobalSign Root CA - R3",
 119         "GlobalSign Root CA - R6",
 120         "Go Daddy Class 2 CA",
 121         "Go Daddy Root Certificate Authority - G2",
 122         // "GTS Root R1",
 123         // "GTS Root R2",
 124         // "GTS Root R3",
 125         // "GTS Root R4",
 126         "Starfield Class 2 CA",
 127         "Starfield Root Certificate Authority - G2",
 128         "USERTrust ECC Certification Authority",
 129         "USERTrust RSA Certification Authority"
 130       ]
 131     }
 132     // The list above should be updated via the dumpGoogleRoots.js script.
 133   ],
 134
 135   "entries": [
 136     // Only domains that are operationally crucial to Firefox can have per-host
 137     // telemetry reporting (the "id") field
 138     { "name": "addons.mozilla.org", "include_subdomains": true,
 139       "pins": "mozilla_services", "test_mode": false, "id": 1 },
 140     { "name": "addons.mozilla.net", "include_subdomains": true,
 141       "pins": "mozilla_services", "test_mode": false, "id": 2 },
 142     // AUS servers MUST remain in test mode
 143     // see: https://bugzilla.mozilla.org/show_bug.cgi?id=1301956#c23
 144     { "name": "aus4.mozilla.org", "include_subdomains": true,
 145       "pins": "mozilla_services", "test_mode": true, "id": 3 },
 146     { "name": "aus5.mozilla.org", "include_subdomains": true,
 147       "pins": "mozilla_services", "test_mode": true, "id": 7 },
 148     // Catchall for applications hosted under firefox.com
 149     // see https://bugzilla.mozilla.org/show_bug.cgi?id=1494431
 150     { "name": "firefox.com", "include_subdomains": true,
 151       "pins": "mozilla_services", "test_mode": true, "id": 15 },
 152     // Firefox Accounts & sync
 153     // superseded by catchall for firefox.com, but leaving for tracking
 154     { "name": "accounts.firefox.com", "include_subdomains": true,
 155       "pins": "mozilla_services", "test_mode": false, "id": 4 },
 156     { "name": "api.accounts.firefox.com", "include_subdomains": true,
 157       "pins": "mozilla_services", "test_mode": false, "id": 5 },
 158     { "name": "sync.services.mozilla.com", "include_subdomains": true,
 159       "pins": "mozilla_services", "test_mode": false, "id": 13 },
 160     // Catch-all for all CDN resources, including product delivery
 161     // Telemetry IDs added in bug 1521983.
 162     { "name": "cdn.mozilla.net", "include_subdomains": true,
 163       "pins": "mozilla_services", "test_mode": false, "id": 16 },
 164     { "name": "cdn.mozilla.org", "include_subdomains": true,
 165       "pins": "mozilla_services", "test_mode": false, "id": 17 },
 166     { "name": "download.mozilla.org", "include_subdomains": false,
 167       "pins": "mozilla_services", "test_mode": false, "id": 14 },
 168     // Catch-all for everything hosted under services.mozilla.com
 169     { "name": "services.mozilla.com", "include_subdomains": true,
 170       "pins": "mozilla_services", "test_mode": false, "id": 6 },
 171     // Catch-all for everything hosted under telemetry.mozilla.org
 172     // MUST remain in test mode in order to receive telemetry on broken pins
 173     { "name": "telemetry.mozilla.org", "include_subdomains": true,
 174       "pins": "mozilla_services", "test_mode": true, "id": 8 },
 175     // Test Pilot
 176     // superseded by catchall for firefox.com, but leaving for tracking
 177     { "name": "testpilot.firefox.com", "include_subdomains": false,
 178       "pins": "mozilla_services", "test_mode": false, "id": 9 },
 179     // Crash report sites
 180     { "name": "crash-reports.mozilla.com", "include_subdomains": false,
 181       "pins": "mozilla_services", "test_mode": false, "id": 10 },
 182     { "name": "crash-reports-xpsp2.mozilla.com", "include_subdomains": false,
 183       "pins": "mozilla_services", "test_mode": false, "id": 11 },
 184     { "name": "crash-stats.mozilla.org", "include_subdomains": false,
 185       "pins": "mozilla_services", "test_mode": false, "id": 12 },
 186     { "name": "include-subdomains.pinning.example.com",
 187       "include_subdomains": true, "pins": "mozilla_test",
 188       "test_mode": false },
 189     // Example domain to collect per-host stats for telemetry tests.
 190     { "name": "exclude-subdomains.pinning.example.com",
 191       "include_subdomains": false, "pins": "mozilla_test",
 192       "test_mode": false },
 193     { "name": "test-mode.pinning.example.com", "include_subdomains": true,
 194       "pins": "mozilla_test", "test_mode": true }
 195   ],
 196   // When pinning to non-root certs, like intermediates,
 197   // place the PEM of the pinned certificate in this array
 198   // so Firefox can find the subject DN and public key
 199   "extra_certificates": [
 200     // Subject: C=US, O=Let's Encrypt, CN=Let's Encrypt Authority X3
 201     // Issuer: C=US, O=Internet Security Research Group, CN=ISRG Root X1
 202     "MIIFjTCCA3WgAwIBAgIRANOxciY0IzLc9AUoUSrsnGowDQYJKoZIhvcNAQELBQAwTzELMAkGA1UEBhMCVVMxKTAnBgNVBAoTIEludGVybmV0IFNlY3VyaXR5IFJlc2VhcmNoIEdyb3VwMRUwEwYDVQQDEwxJU1JHIFJvb3QgWDEwHhcNMTYxMDA2MTU0MzU1WhcNMjExMDA2MTU0MzU1WjBKMQswCQYDVQQGEwJVUzEWMBQGA1UEChMNTGV0J3MgRW5jcnlwdDEjMCEGA1UEAxMaTGV0J3MgRW5jcnlwdCBBdXRob3JpdHkgWDMwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCc0wzwWuUuR7dyXTeDs2hjMOrXNSYZJeG9vjXxcJIvt7hLQQWrqZ41CFjssSrEaIcLo+N15Obzp2JxunmBYB/XkZqf89B4Z3HIaQ6Vkc/+5pnpYDxIzH7KTXcSJJ1HG1rrueweNwAcnKx7pwXqzkrrvUHlNpi5y/1tPJZo3yMqQpAMhnRnyH+lmrhSYRQTP2XpgofL2/oOVvaGifOFP5eGr7DcGu9rDZUWfcQroGWymQQ2dYBrrErzG5BJeC+ilk8qICUpBMZ0wNAxzY8xOJUWuqgzuEPxsR/DMH+ieTETPS02+OP88jNquTkxxa/EjQ0dZBYzqvqEKbbUC8DYfcOTAgMBAAGjggFnMIIBYzAOBgNVHQ8BAf8EBAMCAYYwEgYDVR0TAQH/BAgwBgEB/wIBADBUBgNVHSAETTBLMAgGBmeBDAECATA/BgsrBgEEAYLfEwEBATAwMC4GCCsGAQUFBwIBFiJodHRwOi8vY3BzLnJvb3QteDEubGV0c2VuY3J5cHQub3JnMB0GA1UdDgQWBBSoSmpjBH3duubRObemRWXv86jsoTAzBgNVHR8ELDAqMCigJqAkhiJodHRwOi8vY3JsLnJvb3QteDEubGV0c2VuY3J5cHQub3JnMHIGCCsGAQUFBwEBBGYwZDAwBggrBgEFBQcwAYYkaHR0cDovL29jc3Aucm9vdC14MS5sZXRzZW5jcnlwdC5vcmcvMDAGCCsGAQUFBzAChiRodHRwOi8vY2VydC5yb290LXgxLmxldHNlbmNyeXB0Lm9yZy8wHwYDVR0jBBgwFoAUebRZ5nu25eQBc4AIiMgaWPbpm24wDQYJKoZIhvcNAQELBQADggIBABnPdSA0LTqmRf/Q1eaM2jLonG4bQdEnqOJQ8nCqxOeTRrToEKtwT++36gTSlBGxA/5dut82jJQ2jxN8RI8L9QFXrWi4xXnA2EqA10yjHiR6H9cj6MFiOnb5In1eWsRMUM2v3e9tNsCAgBukPHAg1lQh07rvFKm/Bz9BCjaxorALINUfZ9DD64j2igLIxle2DPxW8dI/F2loHMjXZjqG8RkqZUdoxtID5+90FgsGIfkMpqgRS05f4zPbCEHqCXl1eO5HyELTgcVlLXXQDgAWnRzut1hFJeczY1tjQQno6f6s+nMydLN26WuU4s3UYvOuOsUxRlJu7TSRHqDC3lSE5XggVkzdaPkuKGQbGpny+01/47hfXXNB7HntWNZ6N2Vwp7G6OfY+YQrZwIaQmhrIqJZuigsrbe3W+gdn5ykE9+Ky0VgVUsfxo52mwFYs1JKY2PGDuWx8M6DlS6qQkvHaRUo0FMd8TsSlbF0/v965qGFKhSDeQoMpYnwcmQilRh/0ayLThlHLN81gSkJjVrPI0Y8xCVPB4twb1PFUd2fPM3sA1tJ83sZ5v8vgFv2yofKRPB0t6JzUA81mSqM3kxl5e+IZwhYAyO0OTg3/fs8HqGTNKd9BqoUwSRBzp06JMg5brUCGwbCUDI0mxadJ3Bz4WxR6fyNpBK2yAinWEsikxqEt",
 203     // Subject: C=US, O=Let's Encrypt, CN=Let's Encrypt Authority X4
 204     // Issuer: C=US, O=Internet Security Research Group, CN=ISRG Root X1
 205     "MIIFjTCCA3WgAwIBAgIRAJObmZ6kjhYNW0JZtD0gE9owDQYJKoZIhvcNAQELBQAwTzELMAkGA1UEBhMCVVMxKTAnBgNVBAoTIEludGVybmV0IFNlY3VyaXR5IFJlc2VhcmNoIEdyb3VwMRUwEwYDVQQDEwxJU1JHIFJvb3QgWDEwHhcNMTYxMDA2MTU0NDM0WhcNMjExMDA2MTU0NDM0WjBKMQswCQYDVQQGEwJVUzEWMBQGA1UEChMNTGV0J3MgRW5jcnlwdDEjMCEGA1UEAxMaTGV0J3MgRW5jcnlwdCBBdXRob3JpdHkgWDQwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDhJHRCe7eRMdlz/ziq2M5EXLc5CtxErg29RbmXN2evvVBPX9MQVGv3QdqOY+ZtW8DoQKmMQfzRA4n/YmEJYNYHBXiakL0aZD5P3M93L4lry2evQU3FjQDAa/6NhNy18pUxqOj2kKBDSpN0XLM+Q2lLiSJHdFE+mWTDzSQB+YQvKHcXIqfdw2wITGYvN3TFb5OOsEY3FmHRUJjIsA9PWFN8rPbaLZZhUK1D3AqmT561Urmcju9O30azMdwg/GnCoyB1Puw4GzZOZmbS3/VmpJMve6YOlD5gPUpLHG+6tE0cPJFYbi9NxNpw2+0BOXbASefpNbUUBpDB5ZLiEP1rubSFAgMBAAGjggFnMIIBYzAOBgNVHQ8BAf8EBAMCAYYwEgYDVR0TAQH/BAgwBgEB/wIBADBUBgNVHSAETTBLMAgGBmeBDAECATA/BgsrBgEEAYLfEwEBATAwMC4GCCsGAQUFBwIBFiJodHRwOi8vY3BzLnJvb3QteDEubGV0c2VuY3J5cHQub3JnMB0GA1UdDgQWBBTFsatOTLHNZDCTfsGEmQWr5gPiJTAzBgNVHR8ELDAqMCigJqAkhiJodHRwOi8vY3JsLnJvb3QteDEubGV0c2VuY3J5cHQub3JnMHIGCCsGAQUFBwEBBGYwZDAwBggrBgEFBQcwAYYkaHR0cDovL29jc3Aucm9vdC14MS5sZXRzZW5jcnlwdC5vcmcvMDAGCCsGAQUFBzAChiRodHRwOi8vY2VydC5yb290LXgxLmxldHNlbmNyeXB0Lm9yZy8wHwYDVR0jBBgwFoAUebRZ5nu25eQBc4AIiMgaWPbpm24wDQYJKoZIhvcNAQELBQADggIBAF4tI1yGjZgld9lP01+zftU3aSV0un0d2GKUMO7GxvwTLWAKQz/eT+u3J4+GvpD+BMfopIxkJcDCzMChjjZtZZwJpIY7BatVrO6OkEmaRNITtbZ/hCwNkUnbk3C7EG3OGJZlo9b2wzA8v9WBsPzHpTvLfOr+dS57LLPZBhp3ArHaLbdk33lIONRPt9sseDEkmdHnVmGmBRf4+J0Wy67mddOvz5rHH8uzY94raOayf20gzzcmqmot4hPXtDG4Y49MoFMMT2kcWck3EOTAH6QiGWkGJ7cxMfSL3S0niA6wgFJtfETETOZu8AVDgENgCJ3DS0bz/dhVKvs3WRkaKuuR/W0nnC2VDdaFj4+CRF8LGtn/8ERaH48TktH5BDyDVcF9zfJ75Scxcy23jAL2N6w3n/t3nnqoXt9Im4FprDr+mP1g2Z6Lf2YA0jE3kZalgZ6lNHu4CmvJYoOTSJw9X2qlGl1K+B4U327rG1tRxgjM76pN6lIS02PMECoyKJigpOSBu4V8+LVaUMezCJH9Qf4EKeZTHddQ1t96zvNd2s9ewSKx/DblXbKsBDzIdHJ+qi6+F9DIVM5/ICdtDdulOO+dr/BXB+pBZ3uVxjRANvJKKpdxkePyluITSNZHbanWRN07gMvwBWOL060i4VrL9er1sBQrRjU9iNpZQGTnLVAxQVFu"
 206   ]
 207 }