From 1bc8d31a4bc2fd92915e6c159d76f2aa50fbeb04 Mon Sep 17 00:00:00 2001 From: "a.rabiei" <7viper23@gmail.com> Date: Wed, 2 Sep 2026 09:21:02 +0330 Subject: [PATCH 1/3] Add Iran Root CA G3 to NSS trust store --- security/nss/lib/ckfw/builtins/certdata.txt | 173 ++++++++++++++++++++ security/nss/lib/ckfw/builtins/nssckbi.h | 4 +- 2 files changed, 175 insertions(+), 2 deletions(-) diff --git a/security/nss/lib/ckfw/builtins/certdata.txt b/security/nss/lib/ckfw/builtins/certdata.txt index 0a451693c675b..ce2d42b7cc8f3 100644 --- a/security/nss/lib/ckfw/builtins/certdata.txt +++ b/security/nss/lib/ckfw/builtins/certdata.txt @@ -25597,3 +25597,176 @@ CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_TRUSTED_DELEGATOR CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_MUST_VERIFY_TRUST CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_MUST_VERIFY_TRUST CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE + +# +# Certificate "Islamic Republic of Iran Root CA-G3" +# +# Issuer: CN=Islamic Republic of Iran Root CA-G3,OU=Root CA,O=I.R.Government,C=IR +# Serial Number:3e:bd:d7:3e:73:6a:8f:a8:46:78:07:99:ce:60:2a:75 +# Subject: CN=Islamic Republic of Iran Root CA-G3,OU=Root CA,O=I.R.Government,C=IR +# Not Valid Before: Tue May 07 07:11:44 2019 +# Not Valid After : Sat May 07 07:19:33 2039 +# Fingerprint (SHA-256): AA:7F:F6:37:D0:61:29:5A:6A:00:3E:9D:66:21:A5:4F:47:80:BA:E7:AE:F9:60:43:A7:1B:7C:2A:F2:76:D5:56 +# Fingerprint (SHA1): 59:35:6E:A4:22:99:D6:A1:0A:F3:24:4E:E0:82:1F:49:ED:AF:5D:CB +CKA_CLASS CK_OBJECT_CLASS CKO_CERTIFICATE +CKA_TOKEN CK_BBOOL CK_TRUE +CKA_PRIVATE CK_BBOOL CK_FALSE +CKA_MODIFIABLE CK_BBOOL CK_FALSE +CKA_LABEL UTF8 "Islamic Republic of Iran Root CA-G3" +CKA_CERTIFICATE_TYPE CK_CERTIFICATE_TYPE CKC_X_509 +CKA_SUBJECT MULTILINE_OCTAL +\060\146\061\013\060\011\006\003\125\004\006\023\002\111\122\061 +\027\060\025\006\003\125\004\012\023\016\111\056\122\056\107\157 +\166\145\162\156\155\145\156\164\061\020\060\016\006\003\125\004 +\013\023\007\122\157\157\164\040\103\101\061\054\060\052\006\003 +\125\004\003\023\043\111\163\154\141\155\151\143\040\122\145\160 +\165\142\154\151\143\040\157\146\040\111\162\141\156\040\122\157 +\157\164\040\103\101\055\107\063 +END +CKA_ID UTF8 "0" +CKA_ISSUER MULTILINE_OCTAL +\060\146\061\013\060\011\006\003\125\004\006\023\002\111\122\061 +\027\060\025\006\003\125\004\012\023\016\111\056\122\056\107\157 +\166\145\162\156\155\145\156\164\061\020\060\016\006\003\125\004 +\013\023\007\122\157\157\164\040\103\101\061\054\060\052\006\003 +\125\004\003\023\043\111\163\154\141\155\151\143\040\122\145\160 +\165\142\154\151\143\040\157\146\040\111\162\141\156\040\122\157 +\157\164\040\103\101\055\107\063 +END +CKA_SERIAL_NUMBER MULTILINE_OCTAL +\002\020\076\275\327\076\163\152\217\250\106\170\007\231\316\140 +\052\165 +END +CKA_VALUE MULTILINE_OCTAL +\060\202\005\230\060\202\003\200\240\003\002\001\002\002\020\076 +\275\327\076\163\152\217\250\106\170\007\231\316\140\052\165\060 +\015\006\011\052\206\110\206\367\015\001\001\013\005\000\060\146 +\061\013\060\011\006\003\125\004\006\023\002\111\122\061\027\060 +\025\006\003\125\004\012\023\016\111\056\122\056\107\157\166\145 +\162\156\155\145\156\164\061\020\060\016\006\003\125\004\013\023 +\007\122\157\157\164\040\103\101\061\054\060\052\006\003\125\004 +\003\023\043\111\163\154\141\155\151\143\040\122\145\160\165\142 +\154\151\143\040\157\146\040\111\162\141\156\040\122\157\157\164 +\040\103\101\055\107\063\060\036\027\015\061\071\060\065\060\067 +\060\067\061\061\064\064\132\027\015\063\071\060\065\060\067\060 +\067\061\071\063\063\132\060\146\061\013\060\011\006\003\125\004 +\006\023\002\111\122\061\027\060\025\006\003\125\004\012\023\016 +\111\056\122\056\107\157\166\145\162\156\155\145\156\164\061\020 +\060\016\006\003\125\004\013\023\007\122\157\157\164\040\103\101 +\061\054\060\052\006\003\125\004\003\023\043\111\163\154\141\155 +\151\143\040\122\145\160\165\142\154\151\143\040\157\146\040\111 +\162\141\156\040\122\157\157\164\040\103\101\055\107\063\060\202 +\002\042\060\015\006\011\052\206\110\206\367\015\001\001\001\005 +\000\003\202\002\017\000\060\202\002\012\002\202\002\001\000\300 +\213\151\232\140\011\331\102\366\272\155\275\270\310\235\156\206 +\354\076\144\243\032\077\164\374\101\126\013\303\116\256\256\021 +\144\135\147\231\071\054\135\332\344\372\142\055\052\014\362\075 +\170\055\314\356\055\307\034\174\211\033\245\027\234\063\304\325 +\001\162\373\144\331\152\045\120\347\241\331\257\054\243\240\150 +\314\155\276\063\156\037\105\227\062\240\345\374\140\111\376\251 +\166\304\252\162\275\001\242\303\314\232\224\220\273\070\102\010 +\164\101\202\063\114\217\066\316\175\337\344\345\120\147\207\162 +\173\222\135\366\241\371\243\102\065\300\140\350\147\145\027\253 +\150\161\306\030\337\273\157\274\177\376\041\267\014\254\250\333 +\341\302\356\377\367\005\176\075\351\205\006\236\000\124\010\176 +\030\030\217\067\201\345\153\260\311\226\263\152\377\070\340\333 +\236\051\030\011\364\253\235\235\115\115\121\005\231\326\117\046 +\233\147\353\217\222\034\141\341\107\061\135\160\242\074\111\243 +\175\020\150\256\106\175\346\052\067\370\367\077\304\005\175\144 +\172\042\313\356\177\275\305\045\066\076\020\267\105\127\043\216 +\064\143\305\031\330\114\113\170\013\206\142\105\051\347\154\307 +\367\277\276\301\261\366\250\071\173\214\166\055\145\360\001\031 +\364\033\300\166\076\353\307\146\101\304\227\210\245\154\136\125 +\213\320\262\136\273\075\200\347\057\200\140\360\221\141\372\173 +\120\061\303\327\112\100\247\062\050\306\314\010\156\372\304\232 +\304\025\326\243\031\040\241\010\237\212\161\276\053\360\142\254 +\377\120\015\135\316\053\344\041\045\011\307\327\356\253\300\224 +\376\175\363\155\371\102\251\150\200\240\174\272\121\326\207\155 +\135\017\124\257\326\052\247\016\230\103\227\021\176\365\022\356 +\225\034\114\204\201\114\072\351\053\200\112\256\362\365\236\025 +\132\336\324\132\044\235\040\113\127\056\052\036\141\263\167\104 +\347\174\125\251\341\134\077\246\333\260\210\052\156\166\041\135 +\312\317\342\056\310\242\345\022\246\020\373\370\061\236\160\073 +\325\242\003\065\042\104\220\170\164\266\161\373\113\376\237\130 +\175\143\351\355\276\022\332\100\334\154\136\032\062\306\356\110 +\052\373\147\345\335\144\121\005\075\174\013\133\155\024\215\002 +\003\001\000\001\243\102\060\100\060\016\006\003\125\035\017\001 +\001\377\004\004\003\002\001\206\060\017\006\003\125\035\023\001 +\001\377\004\005\060\003\001\001\377\060\035\006\003\125\035\016 +\004\026\004\024\167\021\331\227\124\050\274\172\367\172\331\323 +\202\216\300\161\104\104\044\030\060\015\006\011\052\206\110\206 +\367\015\001\001\013\005\000\003\202\002\001\000\021\205\170\336 +\364\033\260\005\317\347\074\056\157\235\224\223\236\004\077\143 +\314\375\124\050\254\176\153\025\157\225\124\130\123\212\037\206 +\004\062\317\231\022\326\006\377\071\040\332\336\251\115\164\006 +\302\077\262\227\355\157\115\024\126\352\214\202\320\012\252\300 +\377\030\361\373\037\125\172\174\352\067\131\011\132\030\143\377 +\157\017\164\033\155\017\340\140\312\012\064\076\222\321\120\135 +\110\346\126\055\344\042\120\032\041\360\073\124\061\025\237\222 +\152\043\314\204\110\162\174\120\322\003\315\041\003\377\332\227 +\216\112\106\370\164\172\236\336\276\136\275\167\247\127\126\203 +\154\243\015\032\021\014\214\045\034\244\060\210\372\033\170\163 +\344\302\133\305\237\046\254\155\043\054\245\135\361\161\261\135 +\131\232\070\341\143\140\233\207\311\277\202\056\331\220\205\264 +\247\002\310\165\300\247\364\377\212\117\244\250\260\252\330\307 +\060\150\333\226\170\131\135\172\137\010\037\366\146\140\155\372 +\273\062\007\165\002\360\124\352\120\305\046\247\264\376\074\354 +\031\051\143\336\136\352\314\324\304\301\230\361\351\072\053\054 +\355\064\355\212\163\311\313\024\251\347\241\145\376\065\306\007 +\150\013\036\245\136\042\066\221\252\137\155\254\225\110\146\106 +\247\203\227\130\231\336\056\347\140\017\352\364\053\233\223\350 +\224\221\263\005\233\135\244\156\253\351\237\307\021\276\040\202 +\017\274\156\041\271\007\123\225\125\030\034\275\050\204\343\160 +\042\030\232\110\014\154\322\372\122\233\311\326\371\145\243\053 +\146\154\200\247\063\164\355\053\303\131\262\120\305\176\114\302 +\111\153\062\312\017\147\315\232\204\223\237\113\274\374\345\333 +\222\106\216\023\110\310\133\174\224\374\170\063\126\144\160\104 +\122\024\312\270\157\345\016\055\132\113\377\376\372\065\170\223 +\003\312\145\103\204\350\253\265\213\377\226\115\065\071\351\140 +\255\126\306\362\356\116\167\360\242\100\305\163\342\000\364\211 +\262\156\035\331\232\306\266\002\316\326\376\177\063\237\262\311 +\001\360\043\173\104\071\314\163\133\375\271\322\054\177\172\026 +\233\304\202\307\161\030\370\220\272\124\303\265\161\201\056\330 +\301\276\125\313\047\324\235\353\056\145\335\123 +END +CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE +CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE +CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE + +# Trust for "Islamic Republic of Iran Root CA-G3" +# Issuer: CN=Islamic Republic of Iran Root CA-G3,OU=Root CA,O=I.R.Government,C=IR +# Serial Number:3e:bd:d7:3e:73:6a:8f:a8:46:78:07:99:ce:60:2a:75 +# Subject: CN=Islamic Republic of Iran Root CA-G3,OU=Root CA,O=I.R.Government,C=IR +# Not Valid Before: Tue May 07 07:11:44 2019 +# Not Valid After : Sat May 07 07:19:33 2039 +# Fingerprint (SHA-256): AA:7F:F6:37:D0:61:29:5A:6A:00:3E:9D:66:21:A5:4F:47:80:BA:E7:AE:F9:60:43:A7:1B:7C:2A:F2:76:D5:56 +# Fingerprint (SHA1): 59:35:6E:A4:22:99:D6:A1:0A:F3:24:4E:E0:82:1F:49:ED:AF:5D:CB +CKA_CLASS CK_OBJECT_CLASS CKO_NSS_TRUST +CKA_TOKEN CK_BBOOL CK_TRUE +CKA_PRIVATE CK_BBOOL CK_FALSE +CKA_MODIFIABLE CK_BBOOL CK_FALSE +CKA_LABEL UTF8 "Islamic Republic of Iran Root CA-G3" +CKA_CERT_SHA1_HASH MULTILINE_OCTAL +\131\065\156\244\042\231\326\241\012\363\044\116\340\202\037\111 +\355\257\135\313 +END +CKA_CERT_MD5_HASH MULTILINE_OCTAL +\022\052\334\304\132\016\353\312\366\310\302\012\374\264\071\036 +END +CKA_ISSUER MULTILINE_OCTAL +\060\146\061\013\060\011\006\003\125\004\006\023\002\111\122\061 +\027\060\025\006\003\125\004\012\023\016\111\056\122\056\107\157 +\166\145\162\156\155\145\156\164\061\020\060\016\006\003\125\004 +\013\023\007\122\157\157\164\040\103\101\061\054\060\052\006\003 +\125\004\003\023\043\111\163\154\141\155\151\143\040\122\145\160 +\165\142\154\151\143\040\157\146\040\111\162\141\156\040\122\157 +\157\164\040\103\101\055\107\063 +END +CKA_SERIAL_NUMBER MULTILINE_OCTAL +\002\020\076\275\327\076\163\152\217\250\106\170\007\231\316\140 +\052\165 +END +CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_TRUSTED_DELEGATOR +CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_MUST_VERIFY_TRUST +CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_MUST_VERIFY_TRUST +CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE diff --git a/security/nss/lib/ckfw/builtins/nssckbi.h b/security/nss/lib/ckfw/builtins/nssckbi.h index d81e7eb4edf20..989d0e50d67bb 100644 --- a/security/nss/lib/ckfw/builtins/nssckbi.h +++ b/security/nss/lib/ckfw/builtins/nssckbi.h @@ -46,8 +46,8 @@ * It's recommend to switch back to 0 after having reached version 98/99. */ #define NSS_BUILTINS_LIBRARY_VERSION_MAJOR 2 -#define NSS_BUILTINS_LIBRARY_VERSION_MINOR 90 -#define NSS_BUILTINS_LIBRARY_VERSION "2.90" +#define NSS_BUILTINS_LIBRARY_VERSION_MINOR 92 +#define NSS_BUILTINS_LIBRARY_VERSION "2.92" /* These version numbers detail the semantic changes to the ckfw engine. */ #define NSS_BUILTINS_HARDWARE_VERSION_MAJOR 1 From 24f003e625167e565c888855a3c6a9a4588acfa7 Mon Sep 17 00:00:00 2001 From: "a.rabiei" <7viper23@gmail.com> Date: Wed, 2 Sep 2026 09:21:25 +0330 Subject: [PATCH 2/3] Configure CT telemetry mode for private PKI testing --- .../org/mozilla/geckoview_example/GeckoViewActivity.java | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/mobile/android/geckoview_example/src/main/java/org/mozilla/geckoview_example/GeckoViewActivity.java b/mobile/android/geckoview_example/src/main/java/org/mozilla/geckoview_example/GeckoViewActivity.java index deb74372bd562..55ef95949c2fb 100644 --- a/mobile/android/geckoview_example/src/main/java/org/mozilla/geckoview_example/GeckoViewActivity.java +++ b/mobile/android/geckoview_example/src/main/java/org/mozilla/geckoview_example/GeckoViewActivity.java @@ -891,7 +891,7 @@ protected void onCreate(Bundle savedInstanceState) { if (sGeckoRuntime == null) { final GeckoRuntimeSettings.Builder runtimeSettingsBuilder = - new GeckoRuntimeSettings.Builder(); + new GeckoRuntimeSettings.Builder(); if (BuildConfig.DEBUG) { // In debug builds, we want to load JavaScript resources fresh with @@ -923,7 +923,11 @@ protected void onCreate(Bundle savedInstanceState) { .globalPrivacyControlEnabled(mGlobalPrivacyControlEnabled.value()) .aboutConfigEnabled(true); - sGeckoRuntime = GeckoRuntime.create(this, runtimeSettingsBuilder.build()); + + + + sGeckoRuntime = GeckoRuntime.create( + this, runtimeSettingsBuilder.build().setCertificateTransparencyMode(1)); sExtensionManager = new WebExtensionManager(sGeckoRuntime, mTabSessionManager); mTabSessionManager.setTabObserver(sExtensionManager); From e9b50ebd5a5653d65bdd9a2438e0dd26b851bbae Mon Sep 17 00:00:00 2001 From: "a.rabiei" <7viper23@gmail.com> Date: Wed, 2 Sep 2026 09:42:47 +0330 Subject: [PATCH 3/3] Document custom GeckoView Android build process --- CUSTOM_ANDROID_BUILD.md | 153 ++++++++++++++++++++++++++++++++++++++++ 1 file changed, 153 insertions(+) create mode 100644 CUSTOM_ANDROID_BUILD.md diff --git a/CUSTOM_ANDROID_BUILD.md b/CUSTOM_ANDROID_BUILD.md new file mode 100644 index 0000000000000..b10446f7345a3 --- /dev/null +++ b/CUSTOM_ANDROID_BUILD.md @@ -0,0 +1,153 @@ +# Firewolf Android Build Guide + +This repository contains a custom GeckoView build with these changes: + +- Islamic Republic of Iran Root CA-G3 added to the NSS built-in trust store. +- NSS built-in certificate library version updated. +- Certificate Transparency configured in telemetry-only mode for the GeckoView Example test application. +- Verified against `https://new.pki.co.ir/`. + +> Security notice: CT telemetry-only mode is currently for testing. Before production release, replace the global CT behavior with a narrowly scoped exemption for the approved private PKI root. + +## Branch + +```text +feature/iran-root-ca-g3 +``` + +## Tested environment + +- macOS on Apple Silicon +- Android NDK r29, revision `29.0.14206865` +- Android SDK at `$HOME/Library/Android/sdk` +- Java 17 installed by Mozilla bootstrap +- ARM64 Android device or emulator + +## Clone + +```bash +git clone --branch feature/iran-root-ca-g3 https://gitlab.pki.co.ir/a.rabiei/firewolf.git +cd firewolf +``` + +## Bootstrap + +```bash +./mach bootstrap +``` + +Select: + +```text +4. GeckoView/Firefox for Android +``` + +Accept all required Android licenses. + +## Environment + +Install Android NDK revision `29.0.14206865`, then set paths according to the local machine: + +```bash +export ANDROID_SDK_ROOT="$HOME/Library/Android/sdk" +export ANDROID_HOME="$ANDROID_SDK_ROOT" +export ANDROID_NDK_HOME="/Applications/AndroidNDK14206865.app/Contents/NDK" +``` + +Verify the NDK: + +```bash +cat "$ANDROID_NDK_HOME/source.properties" +``` + +Expected output includes: + +```text +Pkg.Revision = 29.0.14206865 +``` + +## Build + +```bash +./mach build +``` + +## APK + +The GeckoView Example debug APK is generated at: + +```text +obj-aarch64-unknown-linux-android/gradle/build/mobile/android/geckoview_example/outputs/apk/debug/geckoview_example-debug.apk +``` + +## Install on a device + +Enable Developer Options and USB Debugging, then connect the device: + +```bash +ADB="$HOME/Library/Android/sdk/platform-tools/adb" +APK="obj-aarch64-unknown-linux-android/gradle/build/mobile/android/geckoview_example/outputs/apk/debug/geckoview_example-debug.apk" + +"$ADB" devices +"$ADB" uninstall org.mozilla.geckoview_example || true +"$ADB" install "$APK" +``` + +Launch: + +```bash +"$ADB" shell monkey -p org.mozilla.geckoview_example -c android.intent.category.LAUNCHER 1 +``` + +Open: + +```text +https://new.pki.co.ir/ +``` + +## Modified files + +NSS trust store: + +```text +security/nss/lib/ckfw/builtins/certdata.txt +``` + +NSS built-in certificate library version: + +```text +security/nss/lib/ckfw/builtins/nssckbi.h +``` + +GeckoView Example CT configuration: + +```text +mobile/android/geckoview_example/src/main/java/org/mozilla/geckoview_example/GeckoViewActivity.java +``` + +## Verify the embedded root + +```bash +APK_CHECK_DIR="$(mktemp -d)" + +unzip -p "$APK" lib/arm64-v8a/libxul.so > "$APK_CHECK_DIR/libxul.so" + +/usr/bin/strings "$APK_CHECK_DIR/libxul.so" \ + | grep -F "Islamic Republic of Iran Root CA-G3" +``` + +Root SHA-256 fingerprint: + +```text +AA:7F:F6:37:D0:61:29:5A:6A:00:3E:9D:66:21:A5:4F:47:80:BA:E7:AE:F9:60:43:A7:1B:7C:2A:F2:76:D5:56 +``` + +## Certificate Transparency + +The GeckoView Example currently uses: + +```java +setCertificateTransparencyMode(1) +``` + +Mode `1` keeps CT telemetry enabled but does not reject a certificate because it has no valid SCT. This setting applies to all sites loaded by the test application and must be reviewed before production use.