TLS pins are not working

[fmarier]

Preloaded TLS pins are not working in Brave. For example https://pinning-test.badssl.com/ loads just fine instead of being blocked with a TLS error.

That's due to the fact that non-Chrome builds have pinning disabled: https://source.chromium.org/chromium/chromium/src/+/master:net/http/transport_security_state.cc;l=760-763;drc=735b94b59fae0115fc1b9fa736fea465e18f6bfb

While we don't want to enforce pin the pins that ship with Chromium, we do want to enforce pins on the Brave domains.

[stephendonner]

Verified PASSED using the testplan in brave/brave-core#8750 with build

Brave	1.27.33 Chromium: 91.0.4472.77 (Official Build) nightly (x86_64)
Revision	1cecd5c8a856bc2a5adda436e7b84d8d21b339b6-refs/branch-heads/4472@{#1246}
OS	macOS Version 11.4 (Build 20F71)

Steps:

1. Opened https://pinning-test.badssl.com/ and confirmed that the page was blocked with a non-bypassable TLS error.
2. Opened a new-tab page and scroll down into the Brave Today section.
3. Confirmed that Brave Today images are loading.
4. Opened https://creators.brave.com/ and confirmed that the page loaded.
5. Opened https://ads-serve.brave.com/ and confirmed that the page loaded without a TLS error.

https://pinning-test.badssl.com	Brave Today	https://creators.brave.com	https://ads-serve.brave.com

---

Verification passed on

Brave | 1.27.89 Chromium: 91.0.4472.124 (Official Build) beta (64-bit)
-- | --
Revision | 7345a6d1bfcaff81162a957e9b7d52649fe2ac38-refs/branch-heads/4472_114@{#6}
OS | Windows 10 OS Version 2004 (Build 19041.1052)

• Verified the test plan from Fix TLS pins and update list of pinned roots brave-core#8750

https://pinning-test.badssl.com	Brave Today	https://creators.brave.com	https://ads-serve.brave.com

---

Verification PASSED on PopOS 20.10 x64 using the following build:

Brave | 1.27.92 Chromium: 91.0.4472.124 (Official Build) dev (64-bit)
--- | ---
Revision | 7345a6d1bfcaff81162a957e9b7d52649fe2ac38-refs/branch-heads/4472_114@{#6}
OS | Linux

Verified the STR/Cases outlined via brave/brave-core#8750 (comment).

https://pinning-test.badssl.com	Brave Today	https://creators.brave.com	https://ads-serve.brave.com

[GeetaSarvadnya]

@fmarier https://pinning-test.badssl.com/ fails in Brave beta (1.27.x). It works fine in Chrome. I have reset the IP (using netsh int ip reset and netsh winsock reset) and tried again but no luck.

[fmarier]

I've tested Beta 1.27.87 on Linux and Windows and I get the same error page as on Chrome in both cases. Do you see the same certificate as me on your machine?

[GeetaSarvadnya]

@fmarier Thanks for checking in your machine. I have verified the certificate and found that issued by was showing as AVG, AVG has got installed unknowingly in my machine, which was causing this problem. I just uninstalled and tried again it worked fine. Thanks!

After uninstalling AVG:

[kjozwiak]

Went through several cases on Win to ensure that pinning fails when a MITM certificate is detected as per brave/qa-resources#295 (comment).