# This Source Code Form is subject to the terms of the Mozilla Public
# License, v. 2.0. If a copy of the MPL was not distributed with this
# file, You can obtain one at http://mozilla.org/MPL/2.0/.
# Adding a new metric? We have docs for that!
# https://firefox-source-docs.mozilla.org/toolkit/components/glean/user/new_definitions_file.html

---
$schema: moz://mozilla.org/schemas/glean/metrics/2-0-0
$tags:
  - 'Core :: Security: PSM'

cert_verifier:
  crlite_not_covered_cert_age:
    type: timing_distribution
    time_unit: millisecond
    description: >
      The age of a certificate (in milliseconds) when it is not covered by
      CRLite, measured as the time between the most recent SCT timestamp and
      the validation time.
    data_sensitivity:
      - technical
    bugs:
      - https://bugzilla.mozilla.org/show_bug.cgi?id=2022068
    data_reviews:
      - https://bugzilla.mozilla.org/show_bug.cgi?id=2022068
    notification_emails:
      - jschanck@mozilla.com
    expires: never

  crlite_status:
    type: labeled_counter
    description: >
      Counts the number of times different CRLite statuses were returned.
    data_sensitivity:
      - technical
    bugs:
      - https://bugzilla.mozilla.org/show_bug.cgi?id=1886042
    data_reviews:
      - https://bugzilla.mozilla.org/show_bug.cgi?id=1886042
    notification_emails:
      - jschanck@mozilla.com
    expires: never
    labels:
      - no_filter
      - not_covered
      - not_enrolled
      - not_revoked
      - revoked_in_filter
      - revoked_in_stash

  cert_revocation_mechanisms:
    type: labeled_counter
    description: >
      Which revocation checking mechanisms were used in a TLS handshake?
    data_sensitivity:
      - technical
    bugs:
      - https://bugzilla.mozilla.org/show_bug.cgi?id=1794450
      - https://bugzilla.mozilla.org/show_bug.cgi?id=1908549
    data_reviews:
      - https://bugzilla.mozilla.org/show_bug.cgi?id=1794450
      - https://bugzilla.mozilla.org/show_bug.cgi?id=1817101
      - https://bugzilla.mozilla.org/show_bug.cgi?id=1846897
      - https://bugzilla.mozilla.org/show_bug.cgi?id=1876442
      - https://bugzilla.mozilla.org/show_bug.cgi?id=1908549
    notification_emails:
      - jschanck@mozilla.com
    expires: never
    labels:
      - CRLite
      - StapledOCSP
      - CachedOCSP
      - OCSP
      - OneCRL
      - ShortValidity

cert_signature_cache:
  hits:
    type: rate
    description: >
      How often a certificate signature to be verified is in the cache already.
    bugs:
      - https://bugzilla.mozilla.org/show_bug.cgi?id=1918279
    data_reviews:
      - https://bugzilla.mozilla.org/show_bug.cgi?id=1918279
    notification_emails:
      - dkeeler@mozilla.com
    expires: never
    denominator_metric: cert_signature_cache.total
  total:
    type: counter
    description: >
      How many certificate signature verifications are performed.
    bugs:
      - https://bugzilla.mozilla.org/show_bug.cgi?id=1918279
    data_reviews:
      - https://bugzilla.mozilla.org/show_bug.cgi?id=1918279
    notification_emails:
      - dkeeler@mozilla.com
    expires: never

cert_trust_cache:
  hits:
    type: rate
    description: >
      How often a certificate's trust is in the cache already.
    bugs:
      - https://bugzilla.mozilla.org/show_bug.cgi?id=1922074
    data_reviews:
      - https://bugzilla.mozilla.org/show_bug.cgi?id=1922074
    notification_emails:
      - dkeeler@mozilla.com
    expires: never
    denominator_metric: cert_trust_cache.total
  total:
    type: counter
    description: >
      How many certificate trust lookups are performed.
    bugs:
      - https://bugzilla.mozilla.org/show_bug.cgi?id=1922074
    data_reviews:
      - https://bugzilla.mozilla.org/show_bug.cgi?id=1922074
    notification_emails:
      - dkeeler@mozilla.com
    expires: never