Single-use certificates when user clicks "For this session only"

[fmarier]

If a user clicks "For this session only" and then closes the browser, the certificate that's in the browser is not deleted and in fact is still valid for up to one hour.

A proposed solution is to create single-use certs when the user requests an ephemeral session:

1. create a cert & get it signed by the IdP
2. use the cert to create an assertion with the IdP
3. delete the cert

This is related to issue #3769.

[shane-tomlinson]

I thought there was a bug open about this already, but I can't find it.

[callahad]

Hi! To help us better focus, I'm "closing" all issues that have been open for more than six months. These have been tagged "cleanup-2014" so that we can go back and review them in the future.

For more information, check out this thread: http://thread.gmane.org/gmane.comp.mozilla.identity.devel/7394

If you believe this bug is still a major issue for you, please comment, submit a pull request, or discuss it on our mailing list: https://lists.mozilla.org/listinfo/dev-identity

Sorry for GitHub notification spam!