<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Cambria;
panose-1:2 4 5 3 5 4 6 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.msonormal0, li.msonormal0, div.msonormal0
{mso-style-name:msonormal;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
span.EmailStyle18
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:#1F497D;}
p.Default, li.Default, div.Default
{mso-style-name:Default;
margin:0in;
margin-bottom:.0001pt;
text-autospace:none;
font-size:12.0pt;
font-family:"Calibri",sans-serif;
color:black;}
.MsoChpDefault
{mso-style-type:export-only;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">The Center for Internet Security publishes a number of security baselines. Firefox’s baseline is very old and does not appear to be updated so I took the older
ESR version and looked at Policies and settings to come with my own newer version.
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="Default"><span style="font-size:11.0pt;color:#1F497D">“</span><i><span style="font-size:16.0pt">4.6 (L2) Set OCSP Response Policy (Scored)
</span></i><span style="font-size:16.0pt"><o:p></o:p></span></p>
<p class="Default"><b><span style="font-size:11.5pt;font-family:"Cambria",serif">Profile Applicability:
</span></b><span style="font-size:11.5pt;font-family:"Cambria",serif"><o:p></o:p></span></p>
<p class="Default"><span style="font-size:11.5pt;font-family:"Cambria",serif"> Level 2
<o:p></o:p></span></p>
<p class="Default"><b><span style="font-size:11.5pt;font-family:"Cambria",serif">Description:
</span></b><span style="font-size:11.5pt;font-family:"Cambria",serif"><o:p></o:p></span></p>
<p class="Default"><span style="font-size:11.5pt;font-family:"Cambria",serif">This setting dictates whether Firefox will consider a given certificate to be invalid if Firefox is unable to obtain an Online Certificate Status Protocol (OCSP) response for it.
<o:p></o:p></span></p>
<p class="Default"><b><span style="font-size:11.5pt;font-family:"Cambria",serif">Rationale:
</span></b><span style="font-size:11.5pt;font-family:"Cambria",serif"><o:p></o:p></span></p>
<p class="Default"><span style="font-size:11.5pt;font-family:"Cambria",serif">Requiring an OCSP response will reduce an adversary's ability to successfully leverage a compromised and revoked certificate.
<o:p></o:p></span></p>
<p class="Default"><b><span style="font-size:11.5pt;font-family:"Cambria",serif">Audit:
</span></b><span style="font-size:11.5pt;font-family:"Cambria",serif"><o:p></o:p></span></p>
<p class="Default"><span style="font-size:11.5pt;font-family:"Cambria",serif">Perform the following procedure:
<o:p></o:p></span></p>
<p class="Default" style="margin-bottom:.85pt"><span style="font-size:11.5pt;font-family:"Cambria",serif">1. Type
</span><span style="font-size:10.0pt;font-family:"Courier New"">about:config </span>
<span style="font-size:11.5pt;font-family:"Cambria",serif">in the address bar <o:p>
</o:p></span></p>
<p class="Default" style="margin-bottom:.85pt"><span style="font-size:11.5pt;font-family:"Cambria",serif">2. Type
</span><span style="font-size:10.0pt;font-family:"Courier New"">security.ocsp.require
</span><span style="font-size:11.5pt;font-family:"Cambria",serif">in the filter <o:p>
</o:p></span></p>
<p class="Default"><span style="font-size:11.5pt;font-family:"Cambria",serif">3. Ensure the preferences listed are set to the values specified below:
<o:p></o:p></span></p>
<p class="Default"><span style="font-size:11.5pt;font-family:"Cambria",serif"><o:p> </o:p></span></p>
<p class="Default"><span style="font-size:9.0pt;font-family:"Courier New"">security.ocsp.require=true
<o:p></o:p></span></p>
<p class="Default"><b><span style="font-size:11.5pt;font-family:"Cambria",serif">Remediation:
</span></b><span style="font-size:11.5pt;font-family:"Cambria",serif"><o:p></o:p></span></p>
<p class="Default"><span style="font-size:11.5pt;font-family:"Cambria",serif">Perform the following procedure:
<o:p></o:p></span></p>
<p class="Default" style="margin-bottom:.9pt"><span style="font-size:11.5pt;font-family:"Cambria",serif">1. Open the
</span><span style="font-size:10.0pt;font-family:"Courier New"">mozilla.cfg </span>
<span style="font-size:11.5pt;font-family:"Cambria",serif">file in the installation directory with a text editor
<o:p></o:p></span></p>
<p class="Default"><span style="font-size:11.5pt;font-family:"Cambria",serif">2. Add the following lines to
</span><span style="font-size:10.0pt;font-family:"Courier New"">mozilla.cfg</span><span style="font-size:11.5pt;font-family:"Cambria",serif">:
<o:p></o:p></span></p>
<p class="Default"><span style="font-size:11.5pt;font-family:"Cambria",serif"><o:p> </o:p></span></p>
<p class="Default"><span style="font-size:9.0pt;font-family:"Courier New"">lockPref("security.ocsp.require", true);
<o:p></o:p></span></p>
<p class="Default"><b><span style="font-size:11.5pt;font-family:"Cambria",serif">Impact:
</span></b><span style="font-size:11.5pt;font-family:"Cambria",serif"><o:p></o:p></span></p>
<p class="Default"><span style="font-size:11.5pt;font-family:"Cambria",serif">Enabling OCSP carries potential privacy implications. For each HTTPS site Firefox visits, a request is sent to an OCSP server to determine if the site's certificate has been revoked.
This provides the OCSP server with the IP address of the requester (Firefox or NAT) and, among other properties, the domain name of the site Firefox is accessing.
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.5pt;font-family:"Cambria",serif">Additionally, requiring an OCSP response increases opportunity for valid certificates to be deemed invalid. This may occur if OCSP server becomes unavailable or is not accessible.</span><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-size:11.5pt;font-family:"Cambria",serif;color:black">Firefox 26+ support OCSP Stapling which mitigates the aforementioned privacy implications.
<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><b><span style="font-size:11.5pt;font-family:"Cambria",serif;color:black">Default Value:
</span></b><span style="font-size:11.5pt;font-family:"Cambria",serif;color:black"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.5pt;font-family:"Cambria",serif;color:black">false</span><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><a href="https://www.cisecurity.org/benchmark/mozilla_firefox/">https://www.cisecurity.org/benchmark/mozilla_firefox/</a><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">From:</span></b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"> Mike Kaply <mkaply@mozilla.com>
<br>
<b>Sent:</b> Tuesday, February 25, 2020 2:04 PM<br>
<b>To:</b> Eddie Rowe <eddie.rowe@tdhca.state.tx.us><br>
<b>Cc:</b> enterprise@mozilla.org<br>
<b>Subject:</b> Re: [Mozilla Enterprise] security.OCSP.require - Breaks Many Sites<o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<p class="MsoNormal">Where did you get this recommendation?<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Mike<o:p></o:p></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<p class="MsoNormal">On Tue, Feb 18, 2020 at 3:18 PM Eddie Rowe <<a href="mailto:eddie.rowe@tdhca.state.tx.us">eddie.rowe@tdhca.state.tx.us</a>> wrote:<o:p></o:p></p>
</div>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in">
<div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">// 4.6 (L2) Set OCSP Response Policy<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">defaultPref("security.OCSP.require", true);<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">I have enabled this setting in ESR 68.4 x64 and many sites such as Google and even Mozilla just do not work. I don’t see how this could be adopted at a company level without created
chaos. Are there persons still using this setting? Have you adjusted other settings to help out Firefox?<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><b>Example site that does not work with this setting set to true:
</b><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><a href="https://urldefense.proofpoint.com/v2/url?u=https-3A__support.mozilla.org_en-2DUS_questions_1169855&d=DwMFaQ&c=2WwxlqHD_9GeHFEUsOHZXg&r=a0pF-r4VjZCyzB4zxbRDcONPyw-KRRoDiBPd4lDRky8&m=x4xnAy81ZJ6ezld36K8XvRnmYgyXP4N1mgDsgXjxNvw&s=1gfyof2BDbKdaMtS3X1yoavdemIu5fMDFWHFXT93r2s&e=" target="_blank">https://support.mozilla.org/en-US/questions/1169855</a><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><b>Error:</b><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">“Secure Connection Failed<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">An error occurred during a connection to
<a href="https://urldefense.proofpoint.com/v2/url?u=http-3A__support.mozilla.org&d=DwMFaQ&c=2WwxlqHD_9GeHFEUsOHZXg&r=a0pF-r4VjZCyzB4zxbRDcONPyw-KRRoDiBPd4lDRky8&m=x4xnAy81ZJ6ezld36K8XvRnmYgyXP4N1mgDsgXjxNvw&s=k-oJjLpgKiazaRkgpbJD84MDnC50VXZxOlLxZdUFpus&e=" target="_blank">
support.mozilla.org</a>. The OCSP server experienced an internal error. Error code: SEC_ERROR_OCSP_SERVER_ERROR<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> The page you are trying to view cannot be shown because the authenticity of the received data could not be verified.<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> Please contact the website owners to inform them of this problem.”<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
</div>
</div>
<p class="MsoNormal">_______________________________________________<br>
Enterprise mailing list<br>
<a href="mailto:Enterprise@mozilla.org" target="_blank">Enterprise@mozilla.org</a><br>
<a href="https://urldefense.proofpoint.com/v2/url?u=https-3A__mail.mozilla.org_listinfo_enterprise&d=DwMFaQ&c=2WwxlqHD_9GeHFEUsOHZXg&r=a0pF-r4VjZCyzB4zxbRDcONPyw-KRRoDiBPd4lDRky8&m=x4xnAy81ZJ6ezld36K8XvRnmYgyXP4N1mgDsgXjxNvw&s=N37LXZPziqVHUwJMZrqHk6XLMbxeFwJsTtyDhrVK2yY&e=" target="_blank">https://mail.mozilla.org/listinfo/enterprise</a><br>
<br>
To unsubscribe from this list, please visit <a href="https://urldefense.proofpoint.com/v2/url?u=https-3A__mail.mozilla.org_listinfo_enterprise&d=DwMFaQ&c=2WwxlqHD_9GeHFEUsOHZXg&r=a0pF-r4VjZCyzB4zxbRDcONPyw-KRRoDiBPd4lDRky8&m=x4xnAy81ZJ6ezld36K8XvRnmYgyXP4N1mgDsgXjxNvw&s=N37LXZPziqVHUwJMZrqHk6XLMbxeFwJsTtyDhrVK2yY&e=" target="_blank">
https://mail.mozilla.org/listinfo/enterprise</a> or send an email to <a href="mailto:enterprise-request@mozilla.org" target="_blank">
enterprise-request@mozilla.org</a> with a subject of "unsubscribe"<o:p></o:p></p>
</blockquote>
</div>
</div>
</body>
</html>