transport_security_state_ct_policies.inc 1.9 KB

12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455
  1. // Copyright 2016 The Chromium Authors. All rights reserved.
  2. // Use of this source code is governed by a BSD-style license that can be
  3. // found in the LICENSE file.
  4. // This file contains a set of root CAs which are required to disclose
  5. // all certificates via Certificate Transparency, as well as exceptions
  6. // for independent and disclosed sub-CAs.
  7. //
  8. // It is meant to be directly included in transport_security_state.cc
  9. // within an unnamed namespace.
  10. struct CTRequiredPolicy {
  11. // A certificate MUST be disclosed via Certificate Transparency if it
  12. // chains to or through one of the values contained in |roots|, which
  13. // contains the SHA-256 hash of the issuing CA's SubjectPublicKeyInfo,
  14. // the same format as HTTP Public Key Pinning.
  15. const SHA256HashValue* roots;
  16. // The number of entries in |roots|.
  17. size_t roots_length;
  18. // The date at which enforcement should begin, relative to the Unix
  19. // Epoch. If equivalent to zero (base::TimeDelta()), then it is enforced
  20. // for all certificates.
  21. base::TimeDelta effective_date;
  22. // However, if a certificate ALSO chains to or through one of
  23. // |exceptions|, which also contains the SHA-256 hashes of the
  24. // issuing CA's SubjectPublicKeyInfo, then even though it chained
  25. // through |roots|, it will be exempt from CT requirements.
  26. const SHA256HashValue* exceptions;
  27. // The number of entries in |exceptions|.
  28. size_t exceptions_length;
  29. };
  30. typedef CTRequiredPolicy CTRequiredPolicies[2];
  31. const CTRequiredPolicies& GetCTRequiredPolicies() {
  32. static const CTRequiredPolicy kCTRequiredPolicies[] = {
  33. // See net/data/ssl/symantec/README.md
  34. {
  35. kSymantecRoots, kSymantecRootsLength,
  36. // 1 June 2016, 00:00:00 GMT.
  37. base::Seconds(1464739200),
  38. kSymantecExceptions, kSymantecExceptionsLength,
  39. },
  40. {
  41. kSymantecManagedCAs, kSymantecManagedCAsLength,
  42. base::TimeDelta(), nullptr, 0
  43. },
  44. };
  45. return kCTRequiredPolicies;
  46. }