Merge pull request #1500 from MoonchildProductions/1280

Remove HPKP

45 files changed, 32 insertions, 3697 deletions

diff --git a/netwerk/base/security-prefs.js b/netwerk/base/security-prefs.js
index 702315d43..973c73123 100644
--- a/netwerk/base/security-prefs.js
+++ b/netwerk/base/security-prefs.js
@@ -120,27 +120,6 @@ pref("security.webauth.u2f_enable_usbtoken", false);
 // OCSP must-staple
 pref("security.ssl.enable_ocsp_must_staple", true);
 
-// HPKP settings
-
-// Enable pinning checks by default.
-pref("security.cert_pinning.enforcement_level", 2);
-// Do not process hpkp headers rooted by not built in roots by default.
-// This is to prevent accidental pinning from MITM devices and is used
-// for tests.
-pref("security.cert_pinning.process_headers_from_non_builtin_roots", false);
-// Impose a maximum age on HPKP headers, to avoid sites getting permanently
-// blacking themselves out by setting a bad pin.  (60 days by default)
-// https://tools.ietf.org/html/rfc7469#section-4.1
-pref("security.cert_pinning.max_max_age_seconds", 5184000);
-// Controls whether or not HPKP (the HTTP Public Key Pinning header) is enabled.
-// If true, the header is processed and collected HPKP information is consulted
-// when looking for pinning information.
-// If false, the header is not processed and collected HPKP information is not
-// consulted when looking for pinning information. Preloaded pins are not
-// affected by this preference.
-// Default: false
-pref("security.cert_pinning.hpkp.enabled", false);
-
 // If a request is mixed-content, send an HSTS priming request to attempt to
 // see if it is available over HTTPS.
 pref("security.mixed_content.send_hsts_priming", true);
diff --git a/security/certverifier/NSSCertDBTrustDomain.cpp b/security/certverifier/NSSCertDBTrustDomain.cpp
index cf48f6392..fff75ee88 100644
--- a/security/certverifier/NSSCertDBTrustDomain.cpp
+++ b/security/certverifier/NSSCertDBTrustDomain.cpp
@@ -12,7 +12,6 @@
 #include "NSSErrorsService.h"
 #include "OCSPRequestor.h"
 #include "OCSPVerificationTrustDomain.h"
-#include "PublicKeyPinningService.h"
 #include "cert.h"
 #include "certdb.h"
 #include "mozilla/Assertions.h"
@@ -862,24 +861,6 @@ NSSCertDBTrustDomain::IsChainValid(const DERArray& certArray, Time time)
   if (rv != Success) {
     return rv;
   }
-  bool skipPinningChecksBecauseOfMITMMode =
-    (!isBuiltInRoot && mPinningMode == CertVerifier::pinningAllowUserCAMITM);
-  // If mHostname isn't set, we're not verifying in the context of a TLS
-  // handshake, so don't verify HPKP in those cases.
-  if (mHostname && (mPinningMode != CertVerifier::pinningDisabled) &&
-      !skipPinningChecksBecauseOfMITMMode) {
-    bool enforceTestMode =
-      (mPinningMode == CertVerifier::pinningEnforceTestMode);
-    bool chainHasValidPins;
-    nsresult nsrv = PublicKeyPinningService::ChainHasValidPins(
-      certList, mHostname, time, enforceTestMode, chainHasValidPins);
-    if (NS_FAILED(nsrv)) {
-      return Result::FATAL_ERROR_LIBRARY_FAILURE;
-    }
-    if (!chainHasValidPins) {
-      return Result::ERROR_KEY_PINNING_FAILURE;
-    }
-  }
 
   mBuiltChain = Move(certList);
 
diff --git a/security/manager/ssl/PublicKeyPinningService.cpp b/security/manager/ssl/PublicKeyPinningService.cpp
deleted file mode 100644
index ffee8ba48..000000000
--- a/security/manager/ssl/PublicKeyPinningService.cpp
+++ /dev/null
@@ -1,333 +0,0 @@
-/* This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-#include "PublicKeyPinningService.h"
-
-#include "mozilla/Base64.h"
-#include "mozilla/Casting.h"
-#include "mozilla/Logging.h"
-#include "nsISiteSecurityService.h"
-#include "nsServiceManagerUtils.h"
-#include "nsSiteSecurityService.h"
-#include "nssb64.h"
-#include "pkix/pkixtypes.h"
-#include "seccomon.h"
-#include "sechash.h"
-
-#include "StaticHPKPins.h" // autogenerated by genHPKPStaticpins.js
-
-using namespace mozilla;
-using namespace mozilla::pkix;
-using namespace mozilla::psm;
-
-LazyLogModule gPublicKeyPinningLog("PublicKeyPinningService");
-
-/**
- Computes in the location specified by base64Out the SHA256 digest
- of the DER Encoded subject Public Key Info for the given cert
-*/
-static nsresult
-GetBase64HashSPKI(const CERTCertificate* cert, nsACString& hashSPKIDigest)
-{
-  hashSPKIDigest.Truncate();
-  Digest digest;
-  nsresult rv = digest.DigestBuf(SEC_OID_SHA256, cert->derPublicKey.data,
-                                 cert->derPublicKey.len);
-  if (NS_FAILED(rv)) {
-    return rv;
-  }
-  return Base64Encode(nsDependentCSubstring(
-                        BitwiseCast<char*, unsigned char*>(digest.get().data),
-                        digest.get().len),
-                      hashSPKIDigest);
-}
-
-/*
- * Sets certMatchesPinset to true if a given cert matches any fingerprints from
- * the given pinset or the dynamicFingerprints array, or to false otherwise.
- */
-static nsresult
-EvalCert(const CERTCertificate* cert, const StaticFingerprints* fingerprints,
-         const nsTArray<nsCString>* dynamicFingerprints,
- /*out*/ bool& certMatchesPinset)
-{
-  certMatchesPinset = false;
-  if (!fingerprints && !dynamicFingerprints) {
-    MOZ_LOG(gPublicKeyPinningLog, LogLevel::Debug,
-           ("pkpin: No hashes found\n"));
-    return NS_ERROR_INVALID_ARG;
-  }
-
-  nsAutoCString base64Out;
-  nsresult rv = GetBase64HashSPKI(cert, base64Out);
-  if (NS_FAILED(rv)) {
-    MOZ_LOG(gPublicKeyPinningLog, LogLevel::Debug,
-           ("pkpin: GetBase64HashSPKI failed!\n"));
-    return rv;
-  }
-
-  if (fingerprints) {
-    for (size_t i = 0; i < fingerprints->size; i++) {
-      if (base64Out.Equals(fingerprints->data[i])) {
-        MOZ_LOG(gPublicKeyPinningLog, LogLevel::Debug,
-               ("pkpin: found pin base_64 ='%s'\n", base64Out.get()));
-        certMatchesPinset = true;
-        return NS_OK;
-      }
-    }
-  }
-  if (dynamicFingerprints) {
-    for (size_t i = 0; i < dynamicFingerprints->Length(); i++) {
-      if (base64Out.Equals((*dynamicFingerprints)[i])) {
-        MOZ_LOG(gPublicKeyPinningLog, LogLevel::Debug,
-               ("pkpin: found pin base_64 ='%s'\n", base64Out.get()));
-        certMatchesPinset = true;
-        return NS_OK;
-      }
-    }
-  }
-  return NS_OK;
-}
-
-/*
- * Sets certListIntersectsPinset to true if a given chain matches any
- * fingerprints from the given static fingerprints or the
- * dynamicFingerprints array, or to false otherwise.
- */
-static nsresult
-EvalChain(const UniqueCERTCertList& certList,
-          const StaticFingerprints* fingerprints,
-          const nsTArray<nsCString>* dynamicFingerprints,
-  /*out*/ bool& certListIntersectsPinset)
-{
-  certListIntersectsPinset = false;
-  CERTCertificate* currentCert;
-
-  if (!fingerprints && !dynamicFingerprints) {
-    MOZ_ASSERT(false, "Must pass in at least one type of pinset");
-    return NS_ERROR_FAILURE;
-  }
-
-  CERTCertListNode* node;
-  for (node = CERT_LIST_HEAD(certList); !CERT_LIST_END(node, certList);
-       node = CERT_LIST_NEXT(node)) {
-    currentCert = node->cert;
-    MOZ_LOG(gPublicKeyPinningLog, LogLevel::Debug,
-           ("pkpin: certArray subject: '%s'\n", currentCert->subjectName));
-    MOZ_LOG(gPublicKeyPinningLog, LogLevel::Debug,
-           ("pkpin: certArray issuer: '%s'\n", currentCert->issuerName));
-    nsresult rv = EvalCert(currentCert, fingerprints, dynamicFingerprints,
-                           certListIntersectsPinset);
-    if (NS_FAILED(rv)) {
-      return rv;
-    }
-    if (certListIntersectsPinset) {
-      return NS_OK;
-    }
-  }
-  MOZ_LOG(gPublicKeyPinningLog, LogLevel::Debug, ("pkpin: no matches found\n"));
-  return NS_OK;
-}
-
-/**
-  Comparator for the is public key pinned host.
-*/
-static int
-TransportSecurityPreloadCompare(const void* key, const void* entry) {
-  auto keyStr = static_cast<const char*>(key);
-  auto preloadEntry = static_cast<const TransportSecurityPreload*>(entry);
-
-  return strcmp(keyStr, preloadEntry->mHost);
-}
-
-nsresult
-PublicKeyPinningService::ChainMatchesPinset(const UniqueCERTCertList& certList,
-                                            const nsTArray<nsCString>& aSHA256keys,
-                                    /*out*/ bool& chainMatchesPinset)
-{
-  return EvalChain(certList, nullptr, &aSHA256keys, chainMatchesPinset);
-}
-
-// Returns via one of the output parameters the most relevant pinning
-// information that is valid for the given host at the given time.
-// Dynamic pins are prioritized over static pins.
-static nsresult
-FindPinningInformation(const char* hostname, mozilla::pkix::Time time,
-               /*out*/ nsTArray<nsCString>& dynamicFingerprints,
-               /*out*/ TransportSecurityPreload*& staticFingerprints)
-{
-  if (!hostname || hostname[0] == 0) {
-    return NS_ERROR_INVALID_ARG;
-  }
-  staticFingerprints = nullptr;
-  dynamicFingerprints.Clear();
-  nsCOMPtr<nsISiteSecurityService> sssService =
-    do_GetService(NS_SSSERVICE_CONTRACTID);
-  if (!sssService) {
-    return NS_ERROR_FAILURE;
-  }
-  TransportSecurityPreload* foundEntry = nullptr;
-  char* evalHost = const_cast<char*>(hostname);
-  char* evalPart;
-  // Notice how the (xx = strchr) prevents pins for unqualified domain names.
-  while (!foundEntry && (evalPart = strchr(evalHost, '.'))) {
-    MOZ_LOG(gPublicKeyPinningLog, LogLevel::Debug,
-           ("pkpin: Querying pinsets for host: '%s'\n", evalHost));
-    // Attempt dynamic pins first
-    nsresult rv;
-    bool found;
-    bool includeSubdomains;
-    nsTArray<nsCString> pinArray;
-    rv = sssService->GetKeyPinsForHostname(evalHost, time, pinArray,
-                                           &includeSubdomains, &found);
-    if (NS_FAILED(rv)) {
-      return rv;
-    }
-    if (found && (evalHost == hostname || includeSubdomains)) {
-      MOZ_LOG(gPublicKeyPinningLog, LogLevel::Debug,
-             ("pkpin: Found dyn match for host: '%s'\n", evalHost));
-      dynamicFingerprints = pinArray;
-      return NS_OK;
-    }
-
-    foundEntry = (TransportSecurityPreload *)bsearch(evalHost,
-      kPublicKeyPinningPreloadList,
-      sizeof(kPublicKeyPinningPreloadList) / sizeof(TransportSecurityPreload),
-      sizeof(TransportSecurityPreload),
-      TransportSecurityPreloadCompare);
-    if (foundEntry) {
-      MOZ_LOG(gPublicKeyPinningLog, LogLevel::Debug,
-             ("pkpin: Found pinset for host: '%s'\n", evalHost));
-      if (evalHost != hostname) {
-        if (!foundEntry->mIncludeSubdomains) {
-          // Does not apply to this host, continue iterating
-          foundEntry = nullptr;
-        }
-      }
-    } else {
-      MOZ_LOG(gPublicKeyPinningLog, LogLevel::Debug,
-             ("pkpin: Didn't find pinset for host: '%s'\n", evalHost));
-    }
-    // Add one for '.'
-    evalHost = evalPart + 1;
-  }
-
-  if (foundEntry && foundEntry->pinset) {
-    if (time > TimeFromEpochInSeconds(kPreloadPKPinsExpirationTime /
-                                      PR_USEC_PER_SEC)) {
-      return NS_OK;
-    }
-    staticFingerprints = foundEntry;
-  }
-  return NS_OK;
-}
-
-// Returns true via the output parameter if the given certificate list meets
-// pinning requirements for the given host at the given time. It must be the
-// case that either there is an intersection between the set of hashes of
-// subject public key info data in the list and the most relevant non-expired
-// pinset for the host or there is no pinning information for the host.
-static nsresult
-CheckPinsForHostname(const UniqueCERTCertList& certList, const char* hostname,
-                     bool enforceTestMode, mozilla::pkix::Time time,
-             /*out*/ bool& chainHasValidPins)
-{
-  chainHasValidPins = false;
-  if (!certList) {
-    return NS_ERROR_INVALID_ARG;
-  }
-  if (!hostname || hostname[0] == 0) {
-    return NS_ERROR_INVALID_ARG;
-  }
-
-  nsTArray<nsCString> dynamicFingerprints;
-  TransportSecurityPreload* staticFingerprints = nullptr;
-  nsresult rv = FindPinningInformation(hostname, time, dynamicFingerprints,
-                                       staticFingerprints);
-  // If we have no pinning information, the certificate chain trivially
-  // validates with respect to pinning.
-  if (dynamicFingerprints.Length() == 0 && !staticFingerprints) {
-    chainHasValidPins = true;
-    return NS_OK;
-  }
-  if (dynamicFingerprints.Length() > 0) {
-    return EvalChain(certList, nullptr, &dynamicFingerprints, chainHasValidPins);
-  }
-  if (staticFingerprints) {
-    bool enforceTestModeResult;
-    rv = EvalChain(certList, staticFingerprints->pinset, nullptr,
-                   enforceTestModeResult);
-    if (NS_FAILED(rv)) {
-      return rv;
-    }
-    chainHasValidPins = enforceTestModeResult;
-    if (staticFingerprints->mTestMode) {
-      if (!enforceTestMode) {
-        chainHasValidPins = true;
-      }
-    }
-
-    MOZ_LOG(gPublicKeyPinningLog, LogLevel::Debug,
-           ("pkpin: Pin check %s for %s host '%s' (mode=%s)\n",
-            enforceTestModeResult ? "passed" : "failed",
-            staticFingerprints->mIsMoz ? "mozilla" : "non-mozilla",
-            hostname, staticFingerprints->mTestMode ? "test" : "production"));
-  }
-
-  return NS_OK;
-}
-
-nsresult
-PublicKeyPinningService::ChainHasValidPins(const UniqueCERTCertList& certList,
-                                           const char* hostname,
-                                           mozilla::pkix::Time time,
-                                           bool enforceTestMode,
-                                   /*out*/ bool& chainHasValidPins)
-{
-  chainHasValidPins = false;
-  if (!certList) {
-    return NS_ERROR_INVALID_ARG;
-  }
-  if (!hostname || hostname[0] == 0) {
-    return NS_ERROR_INVALID_ARG;
-  }
-  nsAutoCString canonicalizedHostname(CanonicalizeHostname(hostname));
-  return CheckPinsForHostname(certList, canonicalizedHostname.get(),
-                              enforceTestMode, time, chainHasValidPins);
-}
-
-nsresult
-PublicKeyPinningService::HostHasPins(const char* hostname,
-                                     mozilla::pkix::Time time,
-                                     bool enforceTestMode,
-                                     /*out*/ bool& hostHasPins)
-{
-  hostHasPins = false;
-  nsAutoCString canonicalizedHostname(CanonicalizeHostname(hostname));
-  nsTArray<nsCString> dynamicFingerprints;
-  TransportSecurityPreload* staticFingerprints = nullptr;
-  nsresult rv = FindPinningInformation(canonicalizedHostname.get(), time,
-                                       dynamicFingerprints, staticFingerprints);
-  if (NS_FAILED(rv)) {
-    return rv;
-  }
-  if (dynamicFingerprints.Length() > 0) {
-    hostHasPins = true;
-  } else if (staticFingerprints) {
-    hostHasPins = !staticFingerprints->mTestMode || enforceTestMode;
-  }
-  return NS_OK;
-}
-
-nsAutoCString
-PublicKeyPinningService::CanonicalizeHostname(const char* hostname)
-{
-  nsAutoCString canonicalizedHostname(hostname);
-  ToLowerCase(canonicalizedHostname);
-  while (canonicalizedHostname.Length() > 0 &&
-         canonicalizedHostname.Last() == '.') {
-    canonicalizedHostname.Truncate(canonicalizedHostname.Length() - 1);
-  }
-  return canonicalizedHostname;
-}
diff --git a/security/manager/ssl/PublicKeyPinningService.h b/security/manager/ssl/PublicKeyPinningService.h
deleted file mode 100644
index 09fdd8474..000000000
--- a/security/manager/ssl/PublicKeyPinningService.h
+++ /dev/null
@@ -1,64 +0,0 @@
-/* This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-#ifndef PublicKeyPinningService_h
-#define PublicKeyPinningService_h
-
-#include "CertVerifier.h"
-#include "ScopedNSSTypes.h"
-#include "cert.h"
-#include "nsString.h"
-#include "nsTArray.h"
-#include "pkix/Time.h"
-
-namespace mozilla {
-namespace psm {
-
-class PublicKeyPinningService
-{
-public:
-  /**
-   * Sets chainHasValidPins to true if the given (host, certList) passes pinning
-   * checks, or to false otherwise. If the host is pinned, returns true via
-   * chainHasValidPins if one of the keys in the given certificate chain matches
-   * the pin set specified by the hostname. The certList's head is the EE cert
-   * and the tail is the trust anchor.
-   * Note: if an alt name is a wildcard, it won't necessarily find a pinset
-   * that would otherwise be valid for it
-   */
-  static nsresult ChainHasValidPins(const UniqueCERTCertList& certList,
-                                    const char* hostname,
-                                    mozilla::pkix::Time time,
-                                    bool enforceTestMode,
-                            /*out*/ bool& chainHasValidPins);
-  /**
-   * Sets chainMatchesPinset to true if there is any intersection between the
-   * certificate list and the pins specified in the aSHA256keys array.
-   * Values passed in are assumed to be in base64 encoded form.
-   */
-  static nsresult ChainMatchesPinset(const UniqueCERTCertList& certList,
-                                     const nsTArray<nsCString>& aSHA256keys,
-                             /*out*/ bool& chainMatchesPinset);
-
-  /**
-   * Returns true via the output parameter hostHasPins if there is pinning
-   * information for the given host that is valid at the given time, and false
-   * otherwise.
-   */
-  static nsresult HostHasPins(const char* hostname,
-                              mozilla::pkix::Time time,
-                              bool enforceTestMode,
-                      /*out*/ bool& hostHasPins);
-
-  /**
-   * Given a hostname of potentially mixed case with potentially multiple
-   * trailing '.' (see bug 1118522), canonicalizes it to lowercase with no
-   * trailing '.'.
-   */
-  static nsAutoCString CanonicalizeHostname(const char* hostname);
-};
-
-}} // namespace mozilla::psm
-
-#endif // PublicKeyPinningService_h
diff --git a/security/manager/ssl/StaticHPKPins.h b/security/manager/ssl/StaticHPKPins.h
deleted file mode 100644
index a2313ea72..000000000
--- a/security/manager/ssl/StaticHPKPins.h
+++ /dev/null
@@ -1,712 +0,0 @@
-/* This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-/*****************************************************************************/
-/* This is an automatically generated file. If you're not                    */
-/* PublicKeyPinningService.cpp, you shouldn't be #including it.              */
-/*****************************************************************************/
-#include <stdint.h>
-/* AddTrust External Root */
-static const char kAddTrust_External_RootFingerprint[] =
-  "lCppFqbkrlJ3EcVFAkeip0+44VaoJUymbnOaEUk7tEU=";
-
-/* AddTrust Low-Value Services Root */
-static const char kAddTrust_Low_Value_Services_RootFingerprint[] =
-  "BStocQfshOhzA4JFLsKidFF0XXSFpX1vRk4Np6G2ryo=";
-
-/* AddTrust Public Services Root */
-static const char kAddTrust_Public_Services_RootFingerprint[] =
-  "OGHXtpYfzbISBFb/b8LrdwSxp0G0vZM6g3b14ZFcppg=";
-
-/* AddTrust Qualified Certificates Root */
-static const char kAddTrust_Qualified_Certificates_RootFingerprint[] =
-  "xzr8Lrp3DQy8HuQfJStS6Kk9ErctzOwDHY2DnL+Bink=";
-
-/* AffirmTrust Commercial */
-static const char kAffirmTrust_CommercialFingerprint[] =
-  "bEZLmlsjOl6HTadlwm8EUBDS3c/0V5TwtMfkqvpQFJU=";
-
-/* AffirmTrust Networking */
-static const char kAffirmTrust_NetworkingFingerprint[] =
-  "lAcq0/WPcPkwmOWl9sBMlscQvYSdgxhJGa6Q64kK5AA=";
-
-/* AffirmTrust Premium */
-static const char kAffirmTrust_PremiumFingerprint[] =
-  "x/Q7TPW3FWgpT4IrU3YmBfbd0Vyt7Oc56eLDy6YenWc=";
-
-/* AffirmTrust Premium ECC */
-static const char kAffirmTrust_Premium_ECCFingerprint[] =
-  "MhmwkRT/SVo+tusAwu/qs0ACrl8KVsdnnqCHo/oDfk8=";
-
-/* Baltimore CyberTrust Root */
-static const char kBaltimore_CyberTrust_RootFingerprint[] =
-  "Y9mvm0exBk1JoQ57f9Vm28jKo5lFm/woKcVxrYxu80o=";
-
-/* COMODO Certification Authority */
-static const char kCOMODO_Certification_AuthorityFingerprint[] =
-  "AG1751Vd2CAmRCxPGieoDomhmJy4ezREjtIZTBgZbV4=";
-
-/* COMODO ECC Certification Authority */
-static const char kCOMODO_ECC_Certification_AuthorityFingerprint[] =
-  "58qRu/uxh4gFezqAcERupSkRYBlBAvfcw7mEjGPLnNU=";
-
-/* COMODO RSA Certification Authority */
-static const char kCOMODO_RSA_Certification_AuthorityFingerprint[] =
-  "grX4Ta9HpZx6tSHkmCrvpApTQGo67CYDnvprLg5yRME=";
-
-/* Comodo AAA Services root */
-static const char kComodo_AAA_Services_rootFingerprint[] =
-  "vRU+17BDT2iGsXvOi76E7TQMcTLXAqj0+jGPdW7L1vM=";
-
-/* Comodo Secure Services root */
-static const char kComodo_Secure_Services_rootFingerprint[] =
-  "RpHL/ehKa2BS3b4VK7DCFq4lqG5XR4E9vA8UfzOFcL4=";
-
-/* Comodo Trusted Services root */
-static const char kComodo_Trusted_Services_rootFingerprint[] =
-  "4tiR77c4ZpEF1TDeXtcuKyrD9KZweLU0mz/ayklvXrg=";
-
-/* Cybertrust Global Root */
-static const char kCybertrust_Global_RootFingerprint[] =
-  "foeCwVDOOVL4AuY2AjpdPpW7XWjjPoWtsroXgSXOvxU=";
-
-/* DST Root CA X3 */
-static const char kDST_Root_CA_X3Fingerprint[] =
-  "Vjs8r4z+80wjNcr1YKepWQboSIRi63WsWXhIMN+eWys=";
-
-/* DigiCert Assured ID Root CA */
-static const char kDigiCert_Assured_ID_Root_CAFingerprint[] =
-  "I/Lt/z7ekCWanjD0Cvj5EqXls2lOaThEA0H2Bg4BT/o=";
-
-/* DigiCert Assured ID Root G2 */
-static const char kDigiCert_Assured_ID_Root_G2Fingerprint[] =
-  "8ca6Zwz8iOTfUpc8rkIPCgid1HQUT+WAbEIAZOFZEik=";
-
-/* DigiCert Assured ID Root G3 */
-static const char kDigiCert_Assured_ID_Root_G3Fingerprint[] =
-  "Fe7TOVlLME+M+Ee0dzcdjW/sYfTbKwGvWJ58U7Ncrkw=";
-
-/* DigiCert Global Root CA */
-static const char kDigiCert_Global_Root_CAFingerprint[] =
-  "r/mIkG3eEpVdm+u/ko/cwxzOMo1bk4TyHIlByibiA5E=";
-
-/* DigiCert Global Root G2 */
-static const char kDigiCert_Global_Root_G2Fingerprint[] =
-  "i7WTqTvh0OioIruIfFR4kMPnBqrS2rdiVPl/s2uC/CY=";
-
-/* DigiCert Global Root G3 */
-static const char kDigiCert_Global_Root_G3Fingerprint[] =
-  "uUwZgwDOxcBXrQcntwu+kYFpkiVkOaezL0WYEZ3anJc=";
-
-/* DigiCert High Assurance EV Root CA */
-static const char kDigiCert_High_Assurance_EV_Root_CAFingerprint[] =
-  "WoiWRyIOVNa9ihaBciRSC7XHjliYS9VwUGOIud4PB18=";
-
-/* DigiCert Trusted Root G4 */
-static const char kDigiCert_Trusted_Root_G4Fingerprint[] =
-  "Wd8xe/qfTwq3ylFNd3IpaqLHZbh2ZNCLluVzmeNkcpw=";
-
-/* End Entity Test Cert */
-static const char kEnd_Entity_Test_CertFingerprint[] =
-  "VCIlmPM9NkgFQtrs4Oa5TeFcDu6MWRTKSNdePEhOgD8=";
-
-/* Entrust Root Certification Authority */
-static const char kEntrust_Root_Certification_AuthorityFingerprint[] =
-  "bb+uANN7nNc/j7R95lkXrwDg3d9C286sIMF8AnXuIJU=";
-
-/* Entrust Root Certification Authority - EC1 */
-static const char kEntrust_Root_Certification_Authority___EC1Fingerprint[] =
-  "/qK31kX7pz11PB7Jp4cMQOH3sMVh6Se5hb9xGGbjbyI=";
-
-/* Entrust Root Certification Authority - G2 */
-static const char kEntrust_Root_Certification_Authority___G2Fingerprint[] =
-  "du6FkDdMcVQ3u8prumAo6t3i3G27uMP2EOhR8R0at/U=";
-
-/* Entrust.net Premium 2048 Secure Server CA */
-static const char kEntrust_net_Premium_2048_Secure_Server_CAFingerprint[] =
-  "HqPF5D7WbC2imDpCpKebHpBnhs6fG1hiFBmgBGOofTg=";
-
-/* FacebookBackup */
-static const char kFacebookBackupFingerprint[] =
-  "q4PO2G2cbkZhZ82+JgmRUyGMoAeozA+BSXVXQWB8XWQ=";
-
-/* GOOGLE_PIN_COMODORSADomainValidationSecureServerCA */
-static const char kGOOGLE_PIN_COMODORSADomainValidationSecureServerCAFingerprint[] =
-  "klO23nT2ehFDXCfx3eHTDRESMz3asj1muO+4aIdjiuY=";
-
-/* GOOGLE_PIN_DigiCertECCSecureServerCA */
-static const char kGOOGLE_PIN_DigiCertECCSecureServerCAFingerprint[] =
-  "PZXN3lRAy+8tBKk2Ox6F7jIlnzr2Yzmwqc3JnyfXoCw=";
-
-/* GOOGLE_PIN_DigiCertSHA2HighAssuranceServerCA */
-static const char kGOOGLE_PIN_DigiCertSHA2HighAssuranceServerCAFingerprint[] =
-  "k2v657xBsOVe1PQRwOsHsw3bsGT2VzIqz5K+59sNQws=";
-
-/* GOOGLE_PIN_Entrust_SSL */
-static const char kGOOGLE_PIN_Entrust_SSLFingerprint[] =
-  "nsxRNo6G40YPZsKV5JQt1TCA8nseQQr/LRqp1Oa8fnw=";
-
-/* GOOGLE_PIN_GTECyberTrustGlobalRoot */
-static const char kGOOGLE_PIN_GTECyberTrustGlobalRootFingerprint[] =
-  "EGn6R6CqT4z3ERscrqNl7q7RC//zJmDe9uBhS/rnCHU=";
-
-/* GOOGLE_PIN_GoDaddySecure */
-static const char kGOOGLE_PIN_GoDaddySecureFingerprint[] =
-  "MrZLZnJ6IGPkBm87lYywqu5Xal7O/ZUzmbuIdHMdlYc=";
-
-/* GOOGLE_PIN_GoogleG2 */
-static const char kGOOGLE_PIN_GoogleG2Fingerprint[] =
-  "7HIpactkIAq2Y49orFOOQKurWxmmSFZhBCoQYcRhJ3Y=";
-
-/* GOOGLE_PIN_LetsEncryptAuthorityBackup_X2_X4 */
-static const char kGOOGLE_PIN_LetsEncryptAuthorityBackup_X2_X4Fingerprint[] =
-  "sRHdihwgkaib1P1gxX8HFszlD+7/gTfNvuAybgLPNis=";
-
-/* GOOGLE_PIN_LetsEncryptAuthorityPrimary_X1_X3 */
-static const char kGOOGLE_PIN_LetsEncryptAuthorityPrimary_X1_X3Fingerprint[] =
-  "YLh1dUR9y6Kja30RrAn7JKnbQG/uEtLMkBgFF2Fuihg=";
-
-/* GOOGLE_PIN_RapidSSL */
-static const char kGOOGLE_PIN_RapidSSLFingerprint[] =
-  "lT09gPUeQfbYrlxRtpsHrjDblj9Rpz+u7ajfCrg4qDM=";
-
-/* GOOGLE_PIN_SymantecClass3EVG3 */
-static const char kGOOGLE_PIN_SymantecClass3EVG3Fingerprint[] =
-  "gMxWOrX4PMQesK9qFNbYBxjBfjUvlkn/vN1n+L9lE5E=";
-
-/* GOOGLE_PIN_UTNDATACorpSGC */
-static const char kGOOGLE_PIN_UTNDATACorpSGCFingerprint[] =
-  "QAL80xHQczFWfnG82XHkYEjI3OjRZZcRdTs9qiommvo=";
-
-/* GOOGLE_PIN_VeriSignClass1 */
-static const char kGOOGLE_PIN_VeriSignClass1Fingerprint[] =
-  "LclHC+Y+9KzxvYKGCUArt7h72ZY4pkOTTohoLRvowwg=";
-
-/* GOOGLE_PIN_VeriSignClass2_G2 */
-static const char kGOOGLE_PIN_VeriSignClass2_G2Fingerprint[] =
-  "2oALgLKofTmeZvoZ1y/fSZg7R9jPMix8eVA6DH4o/q8=";
-
-/* GOOGLE_PIN_VeriSignClass3_G2 */
-static const char kGOOGLE_PIN_VeriSignClass3_G2Fingerprint[] =
-  "AjyBzOjnxk+pQtPBUEhwfTXZu1uH9PVExb8bxWQ68vo=";
-
-/* GOOGLE_PIN_VeriSignClass4_G3 */
-static const char kGOOGLE_PIN_VeriSignClass4_G3Fingerprint[] =
-  "VnuCEf0g09KD7gzXzgZyy52ZvFtIeljJ1U7Gf3fUqPU=";
-
-/* GeoTrust Global CA */
-static const char kGeoTrust_Global_CAFingerprint[] =
-  "h6801m+z8v3zbgkRHpq6L29Esgfzhj89C1SyUCOQmqU=";
-
-/* GeoTrust Global CA 2 */
-static const char kGeoTrust_Global_CA_2Fingerprint[] =
-  "F3VaXClfPS1y5vAxofB/QAxYi55YKyLxfq4xoVkNEYU=";
-
-/* GeoTrust Primary Certification Authority */
-static const char kGeoTrust_Primary_Certification_AuthorityFingerprint[] =
-  "SQVGZiOrQXi+kqxcvWWE96HhfydlLVqFr4lQTqI5qqo=";
-
-/* GeoTrust Primary Certification Authority - G2 */
-static const char kGeoTrust_Primary_Certification_Authority___G2Fingerprint[] =
-  "vPtEqrmtAhAVcGtBIep2HIHJ6IlnWQ9vlK50TciLePs=";
-
-/* GeoTrust Primary Certification Authority - G3 */
-static const char kGeoTrust_Primary_Certification_Authority___G3Fingerprint[] =
-  "q5hJUnat8eyv8o81xTBIeB5cFxjaucjmelBPT2pRMo8=";
-
-/* GeoTrust Universal CA */
-static const char kGeoTrust_Universal_CAFingerprint[] =
-  "lpkiXF3lLlbN0y3y6W0c/qWqPKC7Us2JM8I7XCdEOCA=";
-
-/* GeoTrust Universal CA 2 */
-static const char kGeoTrust_Universal_CA_2Fingerprint[] =
-  "fKoDRlEkWQxgHlZ+UhSOlSwM/+iQAFMP4NlbbVDqrkE=";
-
-/* GlobalSign ECC Root CA - R4 */
-static const char kGlobalSign_ECC_Root_CA___R4Fingerprint[] =
-  "CLOmM1/OXvSPjw5UOYbAf9GKOxImEp9hhku9W90fHMk=";
-
-/* GlobalSign ECC Root CA - R5 */
-static const char kGlobalSign_ECC_Root_CA___R5Fingerprint[] =
-  "fg6tdrtoGdwvVFEahDVPboswe53YIFjqbABPAdndpd8=";
-
-/* GlobalSign Root CA */
-static const char kGlobalSign_Root_CAFingerprint[] =
-  "K87oWBWM9UZfyddvDfoxL+8lpNyoUB2ptGtn0fv6G2Q=";
-
-/* GlobalSign Root CA - R2 */
-static const char kGlobalSign_Root_CA___R2Fingerprint[] =
-  "iie1VXtL7HzAMF+/PVPR9xzT80kQxdZeJ+zduCB3uj0=";
-
-/* GlobalSign Root CA - R3 */
-static const char kGlobalSign_Root_CA___R3Fingerprint[] =
-  "cGuxAXyFXFkWm61cF4HPWX8S0srS9j0aSqN0k4AP+4A=";
-
-/* Go Daddy Class 2 CA */
-static const char kGo_Daddy_Class_2_CAFingerprint[] =
-  "VjLZe/p3W/PJnd6lL8JVNBCGQBZynFLdZSTIqcO0SJ8=";
-
-/* Go Daddy Root Certificate Authority - G2 */
-static const char kGo_Daddy_Root_Certificate_Authority___G2Fingerprint[] =
-  "Ko8tivDrEjiY90yGasP6ZpBU4jwXvHqVvQI0GS3GNdA=";
-
-/* GoogleBackup2048 */
-static const char kGoogleBackup2048Fingerprint[] =
-  "IPMbDAjLVSGntGO3WP53X/zilCVndez5YJ2+vJvhJsA=";
-
-/* SpiderOak2 */
-static const char kSpiderOak2Fingerprint[] =
-  "7Y3UnxbffL8aFPXsOJBpGasgpDmngpIhAxGKdQRklQQ=";
-
-/* SpiderOak3 */
-static const char kSpiderOak3Fingerprint[] =
-  "LkER54vOdlygpTsbYvlpMq1CE/lDAG1AP9xmdtwvV2A=";
-
-/* Starfield Class 2 CA */
-static const char kStarfield_Class_2_CAFingerprint[] =
-  "FfFKxFycfaIz00eRZOgTf+Ne4POK6FgYPwhBDqgqxLQ=";
-
-/* Starfield Root Certificate Authority - G2 */
-static const char kStarfield_Root_Certificate_Authority___G2Fingerprint[] =
-  "gI1os/q0iEpflxrOfRBVDXqVoWN3Tz7Dav/7IT++THQ=";
-
-/* Swehack */
-static const char kSwehackFingerprint[] =
-  "FdaffE799rVb3oyAuhJ2mBW/XJwD07Uajb2G6YwSAEw=";
-
-/* SwehackBackup */
-static const char kSwehackBackupFingerprint[] =
-  "z6cuswA6E1vgFkCjUsbEYo0Lf3aP8M8YOvwkoiGzDCo=";
-
-/* TestSPKI */
-static const char kTestSPKIFingerprint[] =
-  "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=";
-
-/* Tor1 */
-static const char kTor1Fingerprint[] =
-  "bYz9JTDk89X3qu3fgswG+lBQso5vI0N1f0Rx4go4nLo=";
-
-/* Tor2 */
-static const char kTor2Fingerprint[] =
-  "xXCxhTdn7uxXneJSbQCqoAvuW3ZtQl2pDVTf2sewS8w=";
-
-/* Tor3 */
-static const char kTor3Fingerprint[] =
-  "CleC1qwUR8JPgH1nXvSe2VHxDe5/KfNs96EusbfSOfo=";
-
-/* TumblrBackup */
-static const char kTumblrBackupFingerprint[] =
-  "avlD96PLERV78IN1fD+ab5cupkUDD9wTZWJjHX6VC9w=";
-
-/* Twitter1 */
-static const char kTwitter1Fingerprint[] =
-  "vU9M48LzD/CF34wE5PPf4nBwRyosy06X21J0ap8yS5s=";
-
-/* USERTrust ECC Certification Authority */
-static const char kUSERTrust_ECC_Certification_AuthorityFingerprint[] =
-  "ICGRfpgmOUXIWcQ/HXPLQTkFPEFPoDyjvH7ohhQpjzs=";
-
-/* USERTrust RSA Certification Authority */
-static const char kUSERTrust_RSA_Certification_AuthorityFingerprint[] =
-  "x4QzPSC810K5/cMjb05Qm4k3Bw5zBn4lTdO/nEW/Td4=";
-
-/* UTN USERFirst Email Root CA */
-static const char kUTN_USERFirst_Email_Root_CAFingerprint[] =
-  "Laj56jRU0hFGRko/nQKNxMf7tXscUsc8KwVyovWZotM=";
-
-/* UTN USERFirst Hardware Root CA */
-static const char kUTN_USERFirst_Hardware_Root_CAFingerprint[] =
-  "TUDnr0MEoJ3of7+YliBMBVFB4/gJsv5zO7IxD9+YoWI=";
-
-/* UTN USERFirst Object Root CA */
-static const char kUTN_USERFirst_Object_Root_CAFingerprint[] =
-  "D+FMJksXu28NZT56cOs2Pb9UvhWAOe3a5cJXEd9IwQM=";
-
-/* VeriSign Class 3 Public Primary Certification Authority - G4 */
-static const char kVeriSign_Class_3_Public_Primary_Certification_Authority___G4Fingerprint[] =
-  "UZJDjsNp1+4M5x9cbbdflB779y5YRBcV6Z6rBMLIrO4=";
-
-/* VeriSign Class 3 Public Primary Certification Authority - G5 */
-static const char kVeriSign_Class_3_Public_Primary_Certification_Authority___G5Fingerprint[] =
-  "JbQbUG5JMJUoI6brnx0x3vZF6jilxsapbXGVfjhN8Fg=";
-
-/* VeriSign Universal Root Certification Authority */
-static const char kVeriSign_Universal_Root_Certification_AuthorityFingerprint[] =
-  "lnsM2T/O9/J84sJFdnrpsFp3awZJ+ZZbYpCWhGloaHI=";
-
-/* Verisign Class 1 Public Primary Certification Authority - G3 */
-static const char kVerisign_Class_1_Public_Primary_Certification_Authority___G3Fingerprint[] =
-  "IgduWu9Eu5pBaii30cRDItcFn2D+/6XK9sW+hEeJEwM=";
-
-/* Verisign Class 2 Public Primary Certification Authority - G3 */
-static const char kVerisign_Class_2_Public_Primary_Certification_Authority___G3Fingerprint[] =
-  "cAajgxHlj7GTSEIzIYIQxmEloOSoJq7VOaxWHfv72QM=";
-
-/* Verisign Class 3 Public Primary Certification Authority - G3 */
-static const char kVerisign_Class_3_Public_Primary_Certification_Authority___G3Fingerprint[] =
-  "SVqWumuteCQHvVIaALrOZXuzVVVeS7f4FGxxu6V+es4=";
-
-/* YahooBackup1 */
-static const char kYahooBackup1Fingerprint[] =
-  "2fRAUXyxl4A1/XHrKNBmc8bTkzA7y4FB/GLJuNAzCqY=";
-
-/* YahooBackup2 */
-static const char kYahooBackup2Fingerprint[] =
-  "dolnbtzEBnELx/9lOEQ22e6OZO/QNb6VSSX2XHA3E7A=";
-
-/* thawte Primary Root CA */
-static const char kthawte_Primary_Root_CAFingerprint[] =
-  "HXXQgxueCIU5TTLHob/bPbwcKOKw6DkfsTWYHbxbqTY=";
-
-/* thawte Primary Root CA - G2 */
-static const char kthawte_Primary_Root_CA___G2Fingerprint[] =
-  "Z9xPMvoQ59AaeaBzqgyeAhLsL/w9d54Kp/nA8OHCyJM=";
-
-/* thawte Primary Root CA - G3 */
-static const char kthawte_Primary_Root_CA___G3Fingerprint[] =
-  "GQbGEk27Q4V40A4GbVBUxsN/D6YCjAVUXgmU7drshik=";
-
-/* Pinsets are each an ordered list by the actual value of the fingerprint */
-struct StaticFingerprints {
-  const size_t size;
-  const char* const* data;
-};
-
-/* PreloadedHPKPins.json pinsets */
-static const char* const kPinset_google_root_pems_Data[] = {
-  kEntrust_Root_Certification_Authority___EC1Fingerprint,
-  kComodo_Trusted_Services_rootFingerprint,
-  kCOMODO_ECC_Certification_AuthorityFingerprint,
-  kDigiCert_Assured_ID_Root_G2Fingerprint,
-  kCOMODO_Certification_AuthorityFingerprint,
-  kAddTrust_Low_Value_Services_RootFingerprint,
-  kGlobalSign_ECC_Root_CA___R4Fingerprint,
-  kGeoTrust_Global_CA_2Fingerprint,
-  kDigiCert_Assured_ID_Root_G3Fingerprint,
-  kStarfield_Class_2_CAFingerprint,
-  kthawte_Primary_Root_CA___G3Fingerprint,
-  kthawte_Primary_Root_CAFingerprint,
-  kEntrust_net_Premium_2048_Secure_Server_CAFingerprint,
-  kDigiCert_Assured_ID_Root_CAFingerprint,
-  kUSERTrust_ECC_Certification_AuthorityFingerprint,
-  kVeriSign_Class_3_Public_Primary_Certification_Authority___G5Fingerprint,
-  kGlobalSign_Root_CAFingerprint,
-  kGo_Daddy_Root_Certificate_Authority___G2Fingerprint,
-  kAffirmTrust_Premium_ECCFingerprint,
-  kAddTrust_Public_Services_RootFingerprint,
-  kComodo_Secure_Services_rootFingerprint,
-  kGeoTrust_Primary_Certification_AuthorityFingerprint,
-  kVerisign_Class_3_Public_Primary_Certification_Authority___G3Fingerprint,
-  kUTN_USERFirst_Hardware_Root_CAFingerprint,
-  kVeriSign_Class_3_Public_Primary_Certification_Authority___G4Fingerprint,
-  kGo_Daddy_Class_2_CAFingerprint,
-  kDigiCert_Trusted_Root_G4Fingerprint,
-  kDigiCert_High_Assurance_EV_Root_CAFingerprint,
-  kBaltimore_CyberTrust_RootFingerprint,
-  kthawte_Primary_Root_CA___G2Fingerprint,
-  kAffirmTrust_CommercialFingerprint,
-  kEntrust_Root_Certification_AuthorityFingerprint,
-  kGlobalSign_Root_CA___R3Fingerprint,
-  kEntrust_Root_Certification_Authority___G2Fingerprint,
-  kGeoTrust_Universal_CA_2Fingerprint,
-  kGlobalSign_ECC_Root_CA___R5Fingerprint,
-  kCybertrust_Global_RootFingerprint,
-  kStarfield_Root_Certificate_Authority___G2Fingerprint,
-  kCOMODO_RSA_Certification_AuthorityFingerprint,
-  kGeoTrust_Global_CAFingerprint,
-  kDigiCert_Global_Root_G2Fingerprint,
-  kGlobalSign_Root_CA___R2Fingerprint,
-  kAffirmTrust_NetworkingFingerprint,
-  kAddTrust_External_RootFingerprint,
-  kVeriSign_Universal_Root_Certification_AuthorityFingerprint,
-  kGeoTrust_Universal_CAFingerprint,
-  kGeoTrust_Primary_Certification_Authority___G3Fingerprint,
-  kDigiCert_Global_Root_CAFingerprint,
-  kDigiCert_Global_Root_G3Fingerprint,
-  kGeoTrust_Primary_Certification_Authority___G2Fingerprint,
-  kComodo_AAA_Services_rootFingerprint,
-  kAffirmTrust_PremiumFingerprint,
-  kUSERTrust_RSA_Certification_AuthorityFingerprint,
-  kAddTrust_Qualified_Certificates_RootFingerprint,
-};
-static const StaticFingerprints kPinset_google_root_pems = {
-  sizeof(kPinset_google_root_pems_Data) / sizeof(const char*),
-  kPinset_google_root_pems_Data
-};
-
-static const char* const kPinset_mozilla_Data[] = {
-  kGeoTrust_Global_CA_2Fingerprint,
-  kthawte_Primary_Root_CA___G3Fingerprint,
-  kthawte_Primary_Root_CAFingerprint,
-  kDigiCert_Assured_ID_Root_CAFingerprint,
-  kVerisign_Class_1_Public_Primary_Certification_Authority___G3Fingerprint,
-  kVeriSign_Class_3_Public_Primary_Certification_Authority___G5Fingerprint,
-  kGeoTrust_Primary_Certification_AuthorityFingerprint,
-  kVerisign_Class_3_Public_Primary_Certification_Authority___G3Fingerprint,
-  kVeriSign_Class_3_Public_Primary_Certification_Authority___G4Fingerprint,
-  kDigiCert_High_Assurance_EV_Root_CAFingerprint,
-  kBaltimore_CyberTrust_RootFingerprint,
-  kthawte_Primary_Root_CA___G2Fingerprint,
-  kVerisign_Class_2_Public_Primary_Certification_Authority___G3Fingerprint,
-  kGeoTrust_Universal_CA_2Fingerprint,
-  kGeoTrust_Global_CAFingerprint,
-  kVeriSign_Universal_Root_Certification_AuthorityFingerprint,
-  kGeoTrust_Universal_CAFingerprint,
-  kGeoTrust_Primary_Certification_Authority___G3Fingerprint,
-  kDigiCert_Global_Root_CAFingerprint,
-  kGeoTrust_Primary_Certification_Authority___G2Fingerprint,
-};
-static const StaticFingerprints kPinset_mozilla = {
-  sizeof(kPinset_mozilla_Data) / sizeof(const char*),
-  kPinset_mozilla_Data
-};
-
-static const char* const kPinset_mozilla_services_Data[] = {
-  kDigiCert_Global_Root_CAFingerprint,
-};
-static const StaticFingerprints kPinset_mozilla_services = {
-  sizeof(kPinset_mozilla_services_Data) / sizeof(const char*),
-  kPinset_mozilla_services_Data
-};
-
-static const char* const kPinset_mozilla_test_Data[] = {
-  kEnd_Entity_Test_CertFingerprint,
-};
-static const StaticFingerprints kPinset_mozilla_test = {
-  sizeof(kPinset_mozilla_test_Data) / sizeof(const char*),
-  kPinset_mozilla_test_Data
-};
-
-/* Chrome static pinsets */
-static const char* const kPinset_test_Data[] = {
-  kTestSPKIFingerprint,
-};
-static const StaticFingerprints kPinset_test = {
-  sizeof(kPinset_test_Data) / sizeof(const char*),
-  kPinset_test_Data
-};
-
-static const char* const kPinset_google_Data[] = {
-  kGOOGLE_PIN_GoogleG2Fingerprint,
-  kGoogleBackup2048Fingerprint,
-  kGeoTrust_Global_CAFingerprint,
-  kGlobalSign_Root_CA___R2Fingerprint,
-};
-static const StaticFingerprints kPinset_google = {
-  sizeof(kPinset_google_Data) / sizeof(const char*),
-  kPinset_google_Data
-};
-
-static const char* const kPinset_tor_Data[] = {
-  kTor3Fingerprint,
-  kDigiCert_High_Assurance_EV_Root_CAFingerprint,
-  kGOOGLE_PIN_LetsEncryptAuthorityPrimary_X1_X3Fingerprint,
-  kTor1Fingerprint,
-  kGOOGLE_PIN_RapidSSLFingerprint,
-  kGOOGLE_PIN_LetsEncryptAuthorityBackup_X2_X4Fingerprint,
-  kTor2Fingerprint,
-};
-static const StaticFingerprints kPinset_tor = {
-  sizeof(kPinset_tor_Data) / sizeof(const char*),
-  kPinset_tor_Data
-};
-
-static const char* const kPinset_twitterCom_Data[] = {
-  kGOOGLE_PIN_VeriSignClass2_G2Fingerprint,
-  kGOOGLE_PIN_VeriSignClass3_G2Fingerprint,
-  kGeoTrust_Global_CA_2Fingerprint,
-  kDigiCert_Assured_ID_Root_CAFingerprint,
-  kVerisign_Class_1_Public_Primary_Certification_Authority___G3Fingerprint,
-  kVeriSign_Class_3_Public_Primary_Certification_Authority___G5Fingerprint,
-  kGOOGLE_PIN_VeriSignClass1Fingerprint,
-  kGeoTrust_Primary_Certification_AuthorityFingerprint,
-  kVerisign_Class_3_Public_Primary_Certification_Authority___G3Fingerprint,
-  kVeriSign_Class_3_Public_Primary_Certification_Authority___G4Fingerprint,
-  kGOOGLE_PIN_VeriSignClass4_G3Fingerprint,
-  kDigiCert_High_Assurance_EV_Root_CAFingerprint,
-  kVerisign_Class_2_Public_Primary_Certification_Authority___G3Fingerprint,
-  kGeoTrust_Universal_CA_2Fingerprint,
-  kGeoTrust_Global_CAFingerprint,
-  kVeriSign_Universal_Root_Certification_AuthorityFingerprint,
-  kGeoTrust_Universal_CAFingerprint,
-  kGeoTrust_Primary_Certification_Authority___G3Fingerprint,
-  kDigiCert_Global_Root_CAFingerprint,
-  kGeoTrust_Primary_Certification_Authority___G2Fingerprint,
-  kTwitter1Fingerprint,
-};
-static const StaticFingerprints kPinset_twitterCom = {
-  sizeof(kPinset_twitterCom_Data) / sizeof(const char*),
-  kPinset_twitterCom_Data
-};
-
-static const char* const kPinset_twitterCDN_Data[] = {
-  kGOOGLE_PIN_VeriSignClass2_G2Fingerprint,
-  kComodo_Trusted_Services_rootFingerprint,
-  kCOMODO_Certification_AuthorityFingerprint,
-  kGOOGLE_PIN_VeriSignClass3_G2Fingerprint,
-  kAddTrust_Low_Value_Services_RootFingerprint,
-  kUTN_USERFirst_Object_Root_CAFingerprint,
-  kGOOGLE_PIN_GTECyberTrustGlobalRootFingerprint,
-  kGeoTrust_Global_CA_2Fingerprint,
-  kEntrust_net_Premium_2048_Secure_Server_CAFingerprint,
-  kDigiCert_Assured_ID_Root_CAFingerprint,
-  kVerisign_Class_1_Public_Primary_Certification_Authority___G3Fingerprint,
-  kVeriSign_Class_3_Public_Primary_Certification_Authority___G5Fingerprint,
-  kGlobalSign_Root_CAFingerprint,
-  kUTN_USERFirst_Email_Root_CAFingerprint,
-  kGOOGLE_PIN_VeriSignClass1Fingerprint,
-  kAddTrust_Public_Services_RootFingerprint,
-  kGOOGLE_PIN_UTNDATACorpSGCFingerprint,
-  kComodo_Secure_Services_rootFingerprint,
-  kGeoTrust_Primary_Certification_AuthorityFingerprint,
-  kVerisign_Class_3_Public_Primary_Certification_Authority___G3Fingerprint,
-  kUTN_USERFirst_Hardware_Root_CAFingerprint,
-  kVeriSign_Class_3_Public_Primary_Certification_Authority___G4Fingerprint,
-  kGOOGLE_PIN_VeriSignClass4_G3Fingerprint,
-  kDigiCert_High_Assurance_EV_Root_CAFingerprint,
-  kBaltimore_CyberTrust_RootFingerprint,
-  kEntrust_Root_Certification_AuthorityFingerprint,
-  kVerisign_Class_2_Public_Primary_Certification_Authority___G3Fingerprint,
-  kGlobalSign_Root_CA___R3Fingerprint,
-  kEntrust_Root_Certification_Authority___G2Fingerprint,
-  kGeoTrust_Universal_CA_2Fingerprint,
-  kGeoTrust_Global_CAFingerprint,
-  kGlobalSign_Root_CA___R2Fingerprint,
-  kAddTrust_External_RootFingerprint,
-  kVeriSign_Universal_Root_Certification_AuthorityFingerprint,
-  kGeoTrust_Universal_CAFingerprint,
-  kGOOGLE_PIN_Entrust_SSLFingerprint,
-  kGeoTrust_Primary_Certification_Authority___G3Fingerprint,
-  kDigiCert_Global_Root_CAFingerprint,
-  kGeoTrust_Primary_Certification_Authority___G2Fingerprint,
-  kComodo_AAA_Services_rootFingerprint,
-  kTwitter1Fingerprint,
-  kAddTrust_Qualified_Certificates_RootFingerprint,
-};
-static const StaticFingerprints kPinset_twitterCDN = {
-  sizeof(kPinset_twitterCDN_Data) / sizeof(const char*),
-  kPinset_twitterCDN_Data
-};
-
-static const char* const kPinset_dropbox_Data[] = {
-  kEntrust_Root_Certification_Authority___EC1Fingerprint,
-  kEntrust_net_Premium_2048_Secure_Server_CAFingerprint,
-  kDigiCert_Assured_ID_Root_CAFingerprint,
-  kGo_Daddy_Root_Certificate_Authority___G2Fingerprint,
-  kGOOGLE_PIN_GoDaddySecureFingerprint,
-  kGo_Daddy_Class_2_CAFingerprint,
-  kDigiCert_High_Assurance_EV_Root_CAFingerprint,
-  kEntrust_Root_Certification_AuthorityFingerprint,
-  kEntrust_Root_Certification_Authority___G2Fingerprint,
-  kDigiCert_Global_Root_CAFingerprint,
-};
-static const StaticFingerprints kPinset_dropbox = {
-  sizeof(kPinset_dropbox_Data) / sizeof(const char*),
-  kPinset_dropbox_Data
-};
-
-static const char* const kPinset_facebook_Data[] = {
-  kGOOGLE_PIN_DigiCertECCSecureServerCAFingerprint,
-  kDigiCert_High_Assurance_EV_Root_CAFingerprint,
-  kGOOGLE_PIN_SymantecClass3EVG3Fingerprint,
-  kFacebookBackupFingerprint,
-};
-static const StaticFingerprints kPinset_facebook = {
-  sizeof(kPinset_facebook_Data) / sizeof(const char*),
-  kPinset_facebook_Data
-};
-
-static const char* const kPinset_spideroak_Data[] = {
-  kSpiderOak2Fingerprint,
-  kSpiderOak3Fingerprint,
-  kDigiCert_High_Assurance_EV_Root_CAFingerprint,
-  kGeoTrust_Global_CAFingerprint,
-};
-static const StaticFingerprints kPinset_spideroak = {
-  sizeof(kPinset_spideroak_Data) / sizeof(const char*),
-  kPinset_spideroak_Data
-};
-
-static const char* const kPinset_yahoo_Data[] = {
-  kYahooBackup1Fingerprint,
-  kGOOGLE_PIN_VeriSignClass2_G2Fingerprint,
-  kDigiCert_Assured_ID_Root_CAFingerprint,
-  kVeriSign_Class_3_Public_Primary_Certification_Authority___G5Fingerprint,
-  kVerisign_Class_3_Public_Primary_Certification_Authority___G3Fingerprint,
-  kVeriSign_Class_3_Public_Primary_Certification_Authority___G4Fingerprint,
-  kDigiCert_Trusted_Root_G4Fingerprint,
-  kDigiCert_High_Assurance_EV_Root_CAFingerprint,
-  kVerisign_Class_2_Public_Primary_Certification_Authority___G3Fingerprint,
-  kYahooBackup2Fingerprint,
-  kDigiCert_Global_Root_G2Fingerprint,
-  kVeriSign_Universal_Root_Certification_AuthorityFingerprint,
-  kDigiCert_Global_Root_CAFingerprint,
-  kDigiCert_Global_Root_G3Fingerprint,
-};
-static const StaticFingerprints kPinset_yahoo = {
-  sizeof(kPinset_yahoo_Data) / sizeof(const char*),
-  kPinset_yahoo_Data
-};
-
-static const char* const kPinset_swehackCom_Data[] = {
-  kSwehackFingerprint,
-  kDST_Root_CA_X3Fingerprint,
-  kGOOGLE_PIN_LetsEncryptAuthorityPrimary_X1_X3Fingerprint,
-  kGOOGLE_PIN_COMODORSADomainValidationSecureServerCAFingerprint,
-  kGOOGLE_PIN_LetsEncryptAuthorityBackup_X2_X4Fingerprint,
-  kSwehackBackupFingerprint,
-};
-static const StaticFingerprints kPinset_swehackCom = {
-  sizeof(kPinset_swehackCom_Data) / sizeof(const char*),
-  kPinset_swehackCom_Data
-};
-
-static const char* const kPinset_ncsccs_Data[] = {
-  kCOMODO_ECC_Certification_AuthorityFingerprint,
-  kDigiCert_Assured_ID_Root_CAFingerprint,
-  kDigiCert_High_Assurance_EV_Root_CAFingerprint,
-  kBaltimore_CyberTrust_RootFingerprint,
-  kGOOGLE_PIN_LetsEncryptAuthorityPrimary_X1_X3Fingerprint,
-  kCOMODO_RSA_Certification_AuthorityFingerprint,
-  kAddTrust_External_RootFingerprint,
-  kDigiCert_Global_Root_CAFingerprint,
-  kGOOGLE_PIN_LetsEncryptAuthorityBackup_X2_X4Fingerprint,
-};
-static const StaticFingerprints kPinset_ncsccs = {
-  sizeof(kPinset_ncsccs_Data) / sizeof(const char*),
-  kPinset_ncsccs_Data
-};
-
-static const char* const kPinset_tumblr_Data[] = {
-  kDigiCert_High_Assurance_EV_Root_CAFingerprint,
-  kTumblrBackupFingerprint,
-  kGOOGLE_PIN_DigiCertSHA2HighAssuranceServerCAFingerprint,
-};
-static const StaticFingerprints kPinset_tumblr = {
-  sizeof(kPinset_tumblr_Data) / sizeof(const char*),
-  kPinset_tumblr_Data
-};
-
-/* Domainlist */
-struct TransportSecurityPreload {
-  const char* mHost;
-  const bool mIncludeSubdomains;
-  const bool mTestMode;
-  const bool mIsMoz;
-  const int32_t mId;
-  const StaticFingerprints* pinset;
-};
-
-/* Sort hostnames for binary search. */
-static const TransportSecurityPreload kPublicKeyPinningPreloadList[] = {
-  { "exclude-subdomains.pinning.example.com", false, false, false, 0, &kPinset_mozilla_test },
-  { "include-subdomains.pinning.example.com", true, false, false, -1, &kPinset_mozilla_test },
-  { "test-mode.pinning.example.com", true, true, false, -1, &kPinset_mozilla_test },
-};
-
-// Pinning Preload List Length = 3;
-
-static const int32_t kUnknownId = -1;
-
-static const PRTime kPreloadPKPinsExpirationTime = INT64_C(1609459199000000);
diff --git a/security/manager/ssl/moz.build b/security/manager/ssl/moz.build
index 8f4c6e9da..151c5b88a 100644
--- a/security/manager/ssl/moz.build
+++ b/security/manager/ssl/moz.build
@@ -132,7 +132,6 @@ UNIFIED_SOURCES += [
     'nsTLSSocketProvider.cpp',
     'PSMContentListener.cpp',
     'PSMRunnable.cpp',
-    'PublicKeyPinningService.cpp',
     'SecretDecoderRing.cpp',
     'SharedSSLState.cpp',
     'SSLServerCertVerification.cpp',
diff --git a/security/manager/ssl/nsISiteSecurityService.idl b/security/manager/ssl/nsISiteSecurityService.idl
index 4286848a9..d0e5f61ed 100644
--- a/security/manager/ssl/nsISiteSecurityService.idl
+++ b/security/manager/ssl/nsISiteSecurityService.idl
@@ -27,7 +27,7 @@ namespace mozilla
 interface nsISiteSecurityService : nsISupports
 {
     const uint32_t HEADER_HSTS = 0;
-    const uint32_t HEADER_HPKP = 1;
+    const uint32_t HEADER_HPKP = 1; /* no longer used */
     const uint32_t HEADER_OMS = 2;
 
     const uint32_t Success = 0;
@@ -39,10 +39,10 @@ interface nsISiteSecurityService : nsISupports
     const uint32_t ERROR_INVALID_MAX_AGE = 6;
     const uint32_t ERROR_MULTIPLE_INCLUDE_SUBDOMAINS = 7;
     const uint32_t ERROR_INVALID_INCLUDE_SUBDOMAINS = 8;
-    const uint32_t ERROR_INVALID_PIN = 9;
-    const uint32_t ERROR_MULTIPLE_REPORT_URIS = 10;
-    const uint32_t ERROR_PINSET_DOES_NOT_MATCH_CHAIN = 11;
-    const uint32_t ERROR_NO_BACKUP_PIN = 12;
+    const uint32_t ERROR_INVALID_PIN = 9; /* no longer used */
+    const uint32_t ERROR_MULTIPLE_REPORT_URIS = 10; /* no longer used */
+    const uint32_t ERROR_PINSET_DOES_NOT_MATCH_CHAIN = 11; /* no longer used */
+    const uint32_t ERROR_NO_BACKUP_PIN = 12; /* no longer used */
     const uint32_t ERROR_COULD_NOT_SAVE_STATE = 13;
     const uint32_t ERROR_ROOT_NOT_BUILT_IN = 14;
 
@@ -150,42 +150,6 @@ interface nsISiteSecurityService : nsISupports
      * settings.
      */
     void clearAll();
-
-    /**
-     * Returns an array of sha256-hashed key pins for the given domain, if any.
-     * If these pins also apply to subdomains of the given domain,
-     * aIncludeSubdomains will be true. Pins returned are only for non-built-in
-     * pin entries.
-     *
-     * @param aHostname the hosname (punycode) to be queried about
-     * @param the time at which the pins should be valid. This is in
-              mozilla::pkix::Time which uses internally seconds since 0 AD.
-     * @param aPinArray the set of sha256-hashed key pins for the given domain
-     * @param aIncludeSubdomains true if the pins apply to subdomains of the
-     *        given domain
-     */
-    [noscript] boolean getKeyPinsForHostname(in string aHostname,
-                                             in mozillaPkixTime evalTime,
-                                             out nsCStringTArrayRef aPinArray,
-                                             out boolean aIncludeSubdomains);
-
-    /**
-     * Set public-key pins for a host. The resulting pins will be permanent
-     * and visible from private and non-private contexts. These pins replace
-     * any already set by this mechanism or those built-in to Gecko.
-     *
-     * @param aHost the hostname (punycode) that pins will apply to
-     * @param aIncludeSubdomains whether these pins also apply to subdomains
-     * @param aExpires the time this pin should expire (millis since epoch)
-     * @param aPinCount number of keys being pinnned
-     * @param aSha256Pins array of hashed key fingerprints (SHA-256, base64)
-     * @param aIsPreload are these key pins for a preload entry? (false by
-     *        default)
-     */
-     boolean setKeyPins(in string aHost, in boolean aIncludeSubdomains,
-                        in int64_t aExpires, in unsigned long aPinCount,
-                        [array, size_is(aPinCount)] in string aSha256Pins,
-                        [optional] in boolean aIsPreload);
 };
 
 %{C++
diff --git a/security/manager/ssl/nsSiteSecurityService.cpp b/security/manager/ssl/nsSiteSecurityService.cpp
index f78be1bad..fa2619414 100644
--- a/security/manager/ssl/nsSiteSecurityService.cpp
+++ b/security/manager/ssl/nsSiteSecurityService.cpp
@@ -25,7 +25,6 @@
 #include "mozilla/Logging.h"
 #include "prnetdb.h"
 #include "prprf.h"
-#include "PublicKeyPinningService.h"
 #include "ScopedNSSTypes.h"
 #include "SharedCertVerifier.h"
 
@@ -87,122 +86,30 @@ SiteHSTSState::ToString(nsCString& aString)
 }
 
 ////////////////////////////////////////////////////////////////////////////////
-static bool
-stringIsBase64EncodingOf256bitValue(nsCString& encodedString) {
-  nsAutoCString binaryValue;
-  nsresult rv = mozilla::Base64Decode(encodedString, binaryValue);
-  if (NS_FAILED(rv)) {
-    return false;
-  }
-  if (binaryValue.Length() != SHA256_LENGTH) {
-    return false;
-  }
-  return true;
-}
-
-SiteHPKPState::SiteHPKPState()
-  : mExpireTime(0)
-  , mState(SecurityPropertyUnset)
-  , mIncludeSubdomains(false)
-{
-}
 
-SiteHPKPState::SiteHPKPState(nsCString& aStateString)
-  : mExpireTime(0)
-  , mState(SecurityPropertyUnset)
-  , mIncludeSubdomains(false)
-{
-  uint32_t hpkpState = 0;
-  uint32_t hpkpIncludeSubdomains = 0; // PR_sscanf doesn't handle bools.
-  const uint32_t MaxMergedHPKPPinSize = 1024;
-  char mergedHPKPins[MaxMergedHPKPPinSize];
-  memset(mergedHPKPins, 0, MaxMergedHPKPPinSize);
-
-  if (aStateString.Length() >= MaxMergedHPKPPinSize) {
-    SSSLOG(("SSS: Cannot parse PKPState string, too large\n"));
-    return;
-  }
-
-  int32_t matches = PR_sscanf(aStateString.get(), "%lld,%lu,%lu,%s",
-                              &mExpireTime, &hpkpState,
-                              &hpkpIncludeSubdomains, mergedHPKPins);
-  bool valid = (matches == 4 &&
-                (hpkpIncludeSubdomains == 0 || hpkpIncludeSubdomains == 1) &&
-                ((SecurityPropertyState)hpkpState == SecurityPropertyUnset ||
-                 (SecurityPropertyState)hpkpState == SecurityPropertySet ||
-                 (SecurityPropertyState)hpkpState == SecurityPropertyKnockout));
-
-  SSSLOG(("SSS: loading SiteHPKPState matches=%d\n", matches));
-  const uint32_t SHA256Base64Len = 44;
-
-  if (valid && (SecurityPropertyState)hpkpState == SecurityPropertySet) {
-    // try to expand the merged PKPins
-    const char* cur = mergedHPKPins;
-    nsAutoCString pin;
-    uint32_t collectedLen = 0;
-    mergedHPKPins[MaxMergedHPKPPinSize - 1] = 0;
-    size_t totalLen = strlen(mergedHPKPins);
-    while (collectedLen + SHA256Base64Len <= totalLen) {
-      pin.Assign(cur, SHA256Base64Len);
-      if (stringIsBase64EncodingOf256bitValue(pin)) {
-        mSHA256keys.AppendElement(pin);
-      }
-      cur += SHA256Base64Len;
-      collectedLen += SHA256Base64Len;
-    }
-    if (mSHA256keys.IsEmpty()) {
-      valid = false;
-    }
-  }
-  if (valid) {
-    mState = (SecurityPropertyState)hpkpState;
-    mIncludeSubdomains = (hpkpIncludeSubdomains == 1);
-  } else {
-    SSSLOG(("%s is not a valid SiteHPKPState", aStateString.get()));
-    mExpireTime = 0;
-    mState = SecurityPropertyUnset;
-    mIncludeSubdomains = false;
-    if (!mSHA256keys.IsEmpty()) {
-      mSHA256keys.Clear();
-    }
-  }
-}
+const uint64_t kSixtyDaysInSeconds = 60 * 24 * 60 * 60;
 
-SiteHPKPState::SiteHPKPState(PRTime aExpireTime,
-                             SecurityPropertyState aState,
-                             bool aIncludeSubdomains,
-                             nsTArray<nsCString>& aSHA256keys)
-  : mExpireTime(aExpireTime)
-  , mState(aState)
-  , mIncludeSubdomains(aIncludeSubdomains)
-  , mSHA256keys(aSHA256keys)
+static bool
+HostIsIPAddress(const char *hostname)
 {
+  PRNetAddr hostAddr;
+  return (PR_StringToNetAddr(hostname, &hostAddr) == PR_SUCCESS);
 }
 
-void
-SiteHPKPState::ToString(nsCString& aString)
+nsAutoCString CanonicalizeHostname(const char* hostname)
 {
-  aString.Truncate();
-  aString.AppendInt(mExpireTime);
-  aString.Append(',');
-  aString.AppendInt(mState);
-  aString.Append(',');
-  aString.AppendInt(static_cast<uint32_t>(mIncludeSubdomains));
-  aString.Append(',');
-  for (unsigned int i = 0; i < mSHA256keys.Length(); i++) {
-    aString.Append(mSHA256keys[i]);
+  nsAutoCString canonicalizedHostname(hostname);
+  ToLowerCase(canonicalizedHostname);
+  while (canonicalizedHostname.Length() > 0 &&
+         canonicalizedHostname.Last() == '.') {
+    canonicalizedHostname.Truncate(canonicalizedHostname.Length() - 1);
   }
+  return canonicalizedHostname;
 }
 
-////////////////////////////////////////////////////////////////////////////////
-
-const uint64_t kSixtyDaysInSeconds = 60 * 24 * 60 * 60;
-
 nsSiteSecurityService::nsSiteSecurityService()
-  : mMaxMaxAge(kSixtyDaysInSeconds)
-  , mUseStsService(true)
+  : mUseStsService(true)
   , mPreloadListTimeOffset(0)
-  , mHPKPEnabled(false)
 {
 }
 
@@ -223,30 +130,16 @@ nsSiteSecurityService::Init()
     return NS_ERROR_NOT_SAME_THREAD;
   }
 
-  mMaxMaxAge = mozilla::Preferences::GetInt(
-    "security.cert_pinning.max_max_age_seconds", kSixtyDaysInSeconds);
-  mozilla::Preferences::AddStrongObserver(this,
-    "security.cert_pinning.max_max_age_seconds");
-  mHPKPEnabled = mozilla::Preferences::GetBool(
-     "security.cert_pinning.hpkp.enabled", false);
-  mozilla::Preferences::AddStrongObserver(this,
-     "security.cert_pinning.hpkp.enabled");
   mUseStsService = mozilla::Preferences::GetBool(
     "network.stricttransportsecurity.enabled", true);
   mozilla::Preferences::AddStrongObserver(this,
     "network.stricttransportsecurity.enabled");
-  mProcessPKPHeadersFromNonBuiltInRoots = mozilla::Preferences::GetBool(
-    "security.cert_pinning.process_headers_from_non_builtin_roots", false);
-  mozilla::Preferences::AddStrongObserver(this,
-    "security.cert_pinning.process_headers_from_non_builtin_roots");
   mPreloadListTimeOffset = mozilla::Preferences::GetInt(
     "test.currentTimeOffsetSeconds", 0);
   mozilla::Preferences::AddStrongObserver(this,
     "test.currentTimeOffsetSeconds");
   mSiteStateStorage =
     mozilla::DataStorage::Get(NS_LITERAL_STRING("SiteSecurityServiceState.txt"));
-  mPreloadStateStorage =
-    mozilla::DataStorage::Get(NS_LITERAL_STRING("SecurityPreloadState.txt"));
   bool storageWillPersist = false;
   nsresult rv = mSiteStateStorage->Init(storageWillPersist);
   if (NS_WARN_IF(NS_FAILED(rv))) {
@@ -276,7 +169,7 @@ nsSiteSecurityService::GetHost(nsIURI* aURI, nsACString& aResult)
     return rv;
   }
 
-  aResult.Assign(PublicKeyPinningService::CanonicalizeHostname(host.get()));
+  aResult.Assign(CanonicalizeHostname(host.get()));
   if (aResult.IsEmpty()) {
     return NS_ERROR_UNEXPECTED;
   }
@@ -292,9 +185,6 @@ SetStorageKey(nsAutoCString& storageKey, nsCString& hostname, uint32_t aType)
     case nsISiteSecurityService::HEADER_HSTS:
       storageKey.AppendLiteral(":HSTS");
       break;
-    case nsISiteSecurityService::HEADER_HPKP:
-      storageKey.AppendLiteral(":HPKP");
-      break;
     default:
       NS_ASSERTION(false, "SSS:SetStorageKey got invalid type");
   }
@@ -359,8 +249,7 @@ nsSiteSecurityService::RemoveState(uint32_t aType, nsIURI* aURI, uint32_t aFlags
    }
 
   // Only HSTS is supported at the moment.
-  NS_ENSURE_TRUE(aType == nsISiteSecurityService::HEADER_HSTS ||
-                 aType == nsISiteSecurityService::HEADER_HPKP,
+  NS_ENSURE_TRUE(aType == nsISiteSecurityService::HEADER_HSTS,
                  NS_ERROR_NOT_IMPLEMENTED);
 
   nsAutoCString hostname;
@@ -379,13 +268,6 @@ nsSiteSecurityService::RemoveState(uint32_t aType, nsIURI* aURI, uint32_t aFlags
   return NS_OK;
 }
 
-static bool
-HostIsIPAddress(const char *hostname)
-{
-  PRNetAddr hostAddr;
-  return (PR_StringToNetAddr(hostname, &hostAddr) == PR_SUCCESS);
-}
-
 NS_IMETHODIMP
 nsSiteSecurityService::ProcessHeader(uint32_t aType,
                                      nsIURI* aSourceURI,
@@ -396,11 +278,6 @@ nsSiteSecurityService::ProcessHeader(uint32_t aType,
                                      bool* aIncludeSubdomains,
                                      uint32_t* aFailureResult)
 {
-   // Child processes are not allowed direct access to this.
-   if (!XRE_IsParentProcess()) {
-     MOZ_CRASH("Child process: no direct access to nsISiteSecurityService::ProcessHeader");
-   }
-
   if (aFailureResult) {
     *aFailureResult = nsISiteSecurityService::ERROR_UNKNOWN;
   }
@@ -422,11 +299,6 @@ nsSiteSecurityService::UnsafeProcessHeader(uint32_t aType,
                                            bool* aIncludeSubdomains,
                                            uint32_t* aFailureResult)
 {
-   // Child processes are not allowed direct access to this.
-   if (!XRE_IsParentProcess()) {
-     MOZ_CRASH("Child process: no direct access to nsISiteSecurityService::UnsafeProcessHeader");
-   }
-
   return ProcessHeaderInternal(aType, aSourceURI, aHeader, nullptr, aFlags,
                                aMaxAge, aIncludeSubdomains, aFailureResult);
 }
@@ -444,9 +316,8 @@ nsSiteSecurityService::ProcessHeaderInternal(uint32_t aType,
   if (aFailureResult) {
     *aFailureResult = nsISiteSecurityService::ERROR_UNKNOWN;
   }
-  // Only HSTS and HPKP are supported at the moment.
-  NS_ENSURE_TRUE(aType == nsISiteSecurityService::HEADER_HSTS ||
-                 aType == nsISiteSecurityService::HEADER_HPKP,
+  // Only HSTS is supported at the moment.
+  NS_ENSURE_TRUE(aType == nsISiteSecurityService::HEADER_HSTS,
                  NS_ERROR_NOT_IMPLEMENTED);
 
   if (aMaxAge != nullptr) {
@@ -494,10 +365,6 @@ nsSiteSecurityService::ProcessHeaderInternal(uint32_t aType,
       rv = ProcessSTSHeader(aSourceURI, aHeader, aFlags, aMaxAge,
                             aIncludeSubdomains, aFailureResult);
       break;
-    case nsISiteSecurityService::HEADER_HPKP:
-      rv = ProcessPKPHeader(aSourceURI, aHeader, aSSLStatus, aFlags, aMaxAge,
-                            aIncludeSubdomains, aFailureResult);
-      break;
     default:
       MOZ_CRASH("unexpected header type");
   }
@@ -513,9 +380,6 @@ ParseSSSHeaders(uint32_t aType,
                 uint64_t& maxAge,
                 nsTArray<nsCString>& sha256keys)
 {
-  // Strict transport security and Public Key Pinning have very similar
-  // Header formats.
-
   // "Strict-Transport-Security" ":" OWS
   //      STS-d  *( OWS ";" OWS STS-d  OWS)
   //
@@ -527,26 +391,6 @@ ParseSSSHeaders(uint32_t aType,
   //  includeSubDomains = [ "includeSubDomains" ]
   //
 
-  // "Public-Key-Pins ":" OWS
-  //      PKP-d  *( OWS ";" OWS PKP-d  OWS)
-  //
-  //  ; PKP directive
-  //  PKP-d      = maxAge / includeSubDomains / reportUri / pin-directive
-  //
-  //  maxAge     = "max-age" "=" delta-seconds v-ext
-  //
-  //  includeSubDomains = [ "includeSubDomains" ]
-  //
-  //  reportURi  = "report-uri" "=" quoted-string
-  //
-  //  pin-directive = "pin-" token "=" quoted-string
-  //
-  //  the only valid token currently specified is sha256
-  //  the quoted string for a pin directive is the base64 encoding
-  //  of the hash of the public key of the fingerprint
-  //
-
-  //  The order of the directives is not significant.
   //  All directives must appear only once.
   //  Directive names are case-insensitive.
   //  The entire header is invalid if a directive not conforming to the
@@ -558,8 +402,6 @@ ParseSSSHeaders(uint32_t aType,
 
   NS_NAMED_LITERAL_CSTRING(max_age_var, "max-age");
   NS_NAMED_LITERAL_CSTRING(include_subd_var, "includesubdomains");
-  NS_NAMED_LITERAL_CSTRING(pin_sha256_var, "pin-sha256");
-  NS_NAMED_LITERAL_CSTRING(report_uri_var, "report-uri");
 
   nsSecurityHeaderParser parser(aHeader);
   nsresult rv = parser.Parse();
@@ -614,29 +456,7 @@ ParseSSSHeaders(uint32_t aType,
                 directive->mValue.get()));
         return nsISiteSecurityService::ERROR_INVALID_INCLUDE_SUBDOMAINS;
       }
-    } else if (aType == nsISiteSecurityService::HEADER_HPKP &&
-               directive->mName.Length() == pin_sha256_var.Length() &&
-               directive->mName.EqualsIgnoreCase(pin_sha256_var.get(),
-                                                 pin_sha256_var.Length())) {
-       SSSLOG(("SSS: found pinning entry '%s' length=%d",
-               directive->mValue.get(), directive->mValue.Length()));
-       if (!stringIsBase64EncodingOf256bitValue(directive->mValue)) {
-         return nsISiteSecurityService::ERROR_INVALID_PIN;
-       }
-       sha256keys.AppendElement(directive->mValue);
-   } else if (aType == nsISiteSecurityService::HEADER_HPKP &&
-              directive->mName.Length() == report_uri_var.Length() &&
-              directive->mName.EqualsIgnoreCase(report_uri_var.get(),
-                                                report_uri_var.Length())) {
-       // We don't support the report-uri yet, but to avoid unrecognized
-       // directive warnings, we still have to handle its presence
-      if (foundReportURI) {
-        SSSLOG(("SSS: found two report-uri directives"));
-        return nsISiteSecurityService::ERROR_MULTIPLE_REPORT_URIS;
-      }
-      SSSLOG(("SSS: found report-uri directive"));
-      foundReportURI = true;
-   } else {
+    } else {
       SSSLOG(("SSS: ignoring unrecognized directive '%s'",
               directive->mName.get()));
       foundUnrecognizedDirective = true;
@@ -646,194 +466,6 @@ ParseSSSHeaders(uint32_t aType,
 }
 
 nsresult
-nsSiteSecurityService::ProcessPKPHeader(nsIURI* aSourceURI,
-                                        const char* aHeader,
-                                        nsISSLStatus* aSSLStatus,
-                                        uint32_t aFlags,
-                                        uint64_t* aMaxAge,
-                                        bool* aIncludeSubdomains,
-                                        uint32_t* aFailureResult)
-{
-  if (aFailureResult) {
-    *aFailureResult = nsISiteSecurityService::ERROR_UNKNOWN;
-  }
-  if (!mHPKPEnabled) {
-    SSSLOG(("SSS: HPKP disabled: not processing header '%s'", aHeader));
-    if (aMaxAge) {
-      *aMaxAge = 0;
-    }
-    if (aIncludeSubdomains) {
-      *aIncludeSubdomains = false;
-    }
-    return NS_OK;
-  }
-
-  SSSLOG(("SSS: processing HPKP header '%s'", aHeader));
-  NS_ENSURE_ARG(aSSLStatus);
-
-  const uint32_t aType = nsISiteSecurityService::HEADER_HPKP;
-  bool foundMaxAge = false;
-  bool foundIncludeSubdomains = false;
-  bool foundUnrecognizedDirective = false;
-  uint64_t maxAge = 0;
-  nsTArray<nsCString> sha256keys;
-  uint32_t sssrv = ParseSSSHeaders(aType, aHeader, foundIncludeSubdomains,
-                                   foundMaxAge, foundUnrecognizedDirective,
-                                   maxAge, sha256keys);
-  if (sssrv != nsISiteSecurityService::Success) {
-    if (aFailureResult) {
-      *aFailureResult = sssrv;
-    }
-    return NS_ERROR_FAILURE;
-  }
-
-  // after processing all the directives, make sure we came across max-age
-  // somewhere.
-  if (!foundMaxAge) {
-    SSSLOG(("SSS: did not encounter required max-age directive"));
-    if (aFailureResult) {
-      *aFailureResult = nsISiteSecurityService::ERROR_NO_MAX_AGE;
-    }
-    return NS_ERROR_FAILURE;
-  }
-
-  // before we add the pin we need to ensure it will not break the site as
-  // currently visited so:
-  // 1. recompute a valid chain (no external ocsp)
-  // 2. use this chain to check if things would have broken!
-  nsAutoCString host;
-  nsresult rv = GetHost(aSourceURI, host);
-  NS_ENSURE_SUCCESS(rv, rv);
-  nsCOMPtr<nsIX509Cert> cert;
-  rv = aSSLStatus->GetServerCert(getter_AddRefs(cert));
-  NS_ENSURE_SUCCESS(rv, rv);
-  NS_ENSURE_TRUE(cert, NS_ERROR_FAILURE);
-  UniqueCERTCertificate nssCert(cert->GetCert());
-  NS_ENSURE_TRUE(nssCert, NS_ERROR_FAILURE);
-
-  mozilla::pkix::Time now(mozilla::pkix::Now());
-  UniqueCERTCertList certList;
-  RefPtr<SharedCertVerifier> certVerifier(GetDefaultCertVerifier());
-  NS_ENSURE_TRUE(certVerifier, NS_ERROR_UNEXPECTED);
-  // We don't want this verification to cause any network traffic that would
-  // block execution. Also, since we don't have access to the original stapled
-  // OCSP response, we can't enforce this aspect of the TLS Feature extension.
-  // This is ok, because it will have been enforced when we originally connected
-  // to the site (or it's disabled, in which case we wouldn't want to enforce it
-  // anyway).
-  CertVerifier::Flags flags = CertVerifier::FLAG_LOCAL_ONLY |
-                              CertVerifier::FLAG_TLS_IGNORE_STATUS_REQUEST;
-  if (certVerifier->VerifySSLServerCert(nssCert,
-                                        nullptr, // stapledOCSPResponse
-                                        nullptr, // sctsFromTLSExtension
-                                        now, nullptr, // pinarg
-                                        host.get(), // hostname
-                                        certList,
-                                        false, // don't store intermediates
-                                        flags)
-        != mozilla::pkix::Success) {
-    return NS_ERROR_FAILURE;
-  }
-
-  CERTCertListNode* rootNode = CERT_LIST_TAIL(certList);
-  if (CERT_LIST_END(rootNode, certList)) {
-    return NS_ERROR_FAILURE;
-  }
-  bool isBuiltIn = false;
-  mozilla::pkix::Result result = IsCertBuiltInRoot(rootNode->cert, isBuiltIn);
-  if (result != mozilla::pkix::Success) {
-    return NS_ERROR_FAILURE;
-  }
-
-  if (!isBuiltIn && !mProcessPKPHeadersFromNonBuiltInRoots) {
-    if (aFailureResult) {
-      *aFailureResult = nsISiteSecurityService::ERROR_ROOT_NOT_BUILT_IN;
-    }
-    return NS_ERROR_FAILURE;
-  }
-
-  // If maxAge == 0, we remove dynamic HPKP state for this host. Due to
-  // architectural constraints, if this host was preloaded, any future lookups
-  // will use the preloaded state (i.e. we can't store a "this host is not HPKP"
-  // entry like we can for HSTS).
-  if (maxAge == 0) {
-    return RemoveState(aType, aSourceURI, aFlags);
-  }
-
-  // clamp maxAge to the maximum set by pref
-  if (maxAge > mMaxMaxAge) {
-    maxAge = mMaxMaxAge;
-  }
-
-  bool chainMatchesPinset;
-  rv = PublicKeyPinningService::ChainMatchesPinset(certList, sha256keys,
-                                                   chainMatchesPinset);
-  if (NS_FAILED(rv)) {
-    return rv;
-  }
-  if (!chainMatchesPinset) {
-    // is invalid
-    SSSLOG(("SSS: Pins provided by %s are invalid no match with certList\n", host.get()));
-    if (aFailureResult) {
-      *aFailureResult = nsISiteSecurityService::ERROR_PINSET_DOES_NOT_MATCH_CHAIN;
-    }
-    return NS_ERROR_FAILURE;
-  }
-
-  // finally we need to ensure that there is a "backup pin" ie. There must be
-  // at least one fingerprint hash that does NOT validate against the verified
-  // chain (Section 2.5 of the spec)
-  bool hasBackupPin = false;
-  for (uint32_t i = 0; i < sha256keys.Length(); i++) {
-    nsTArray<nsCString> singlePin;
-    singlePin.AppendElement(sha256keys[i]);
-    rv = PublicKeyPinningService::ChainMatchesPinset(certList, singlePin,
-                                                     chainMatchesPinset);
-    if (NS_FAILED(rv)) {
-      return rv;
-    }
-    if (!chainMatchesPinset) {
-      hasBackupPin = true;
-    }
-  }
-  if (!hasBackupPin) {
-     // is invalid
-    SSSLOG(("SSS: Pins provided by %s are invalid no backupPin\n", host.get()));
-    if (aFailureResult) {
-      *aFailureResult = nsISiteSecurityService::ERROR_NO_BACKUP_PIN;
-    }
-    return NS_ERROR_FAILURE;
-  }
-
-  int64_t expireTime = ExpireTimeFromMaxAge(maxAge);
-  SiteHPKPState dynamicEntry(expireTime, SecurityPropertySet,
-                             foundIncludeSubdomains, sha256keys);
-  SSSLOG(("SSS: about to set pins for  %s, expires=%ld now=%ld maxAge=%lu\n",
-           host.get(), expireTime, PR_Now() / PR_USEC_PER_MSEC, maxAge));
-
-  rv = SetHPKPState(host.get(), dynamicEntry, aFlags, false);
-  if (NS_FAILED(rv)) {
-    SSSLOG(("SSS: failed to set pins for %s\n", host.get()));
-    if (aFailureResult) {
-      *aFailureResult = nsISiteSecurityService::ERROR_COULD_NOT_SAVE_STATE;
-    }
-    return rv;
-  }
-
-  if (aMaxAge != nullptr) {
-    *aMaxAge = maxAge;
-  }
-
-  if (aIncludeSubdomains != nullptr) {
-    *aIncludeSubdomains = foundIncludeSubdomains;
-  }
-
-  return foundUnrecognizedDirective
-           ? NS_SUCCESS_LOSS_OF_INSIGNIFICANT_DATA
-           : NS_OK;
-}
-
-nsresult
 nsSiteSecurityService::ProcessSTSHeader(nsIURI* aSourceURI,
                                         const char* aHeader,
                                         uint32_t aFlags,
@@ -902,17 +534,11 @@ nsSiteSecurityService::IsSecureURI(uint32_t aType, nsIURI* aURI,
                                    uint32_t aFlags, bool* aCached,
                                    bool* aResult)
 {
-   // Child processes are not allowed direct access to this.
-   if (!XRE_IsParentProcess() && aType != nsISiteSecurityService::HEADER_HSTS) {
-     MOZ_CRASH("Child process: no direct access to nsISiteSecurityService::IsSecureURI for non-HSTS entries");
-   }
-
   NS_ENSURE_ARG(aURI);
   NS_ENSURE_ARG(aResult);
 
-  // Only HSTS and HPKP are supported at the moment.
-  NS_ENSURE_TRUE(aType == nsISiteSecurityService::HEADER_HSTS ||
-                 aType == nsISiteSecurityService::HEADER_HPKP,
+  // Only HSTS is supported at the moment.
+  NS_ENSURE_TRUE(aType == nsISiteSecurityService::HEADER_HSTS,
                  NS_ERROR_NOT_IMPLEMENTED);
 
   nsAutoCString hostname;
@@ -939,17 +565,11 @@ nsSiteSecurityService::IsSecureHost(uint32_t aType, const char* aHost,
                                     uint32_t aFlags, bool* aCached,
                                     bool* aResult)
 {
-   // Child processes are not allowed direct access to this.
-   if (!XRE_IsParentProcess() && aType != nsISiteSecurityService::HEADER_HSTS) {
-     MOZ_CRASH("Child process: no direct access to nsISiteSecurityService::IsSecureHost for non-HSTS entries");
-   }
-
   NS_ENSURE_ARG(aHost);
   NS_ENSURE_ARG(aResult);
 
-  // Only HSTS and HPKP are supported at the moment.
-  NS_ENSURE_TRUE(aType == nsISiteSecurityService::HEADER_HSTS ||
-                 aType == nsISiteSecurityService::HEADER_HPKP,
+  // Only HSTS is supported at the moment.
+  NS_ENSURE_TRUE(aType == nsISiteSecurityService::HEADER_HSTS,
                  NS_ERROR_NOT_IMPLEMENTED);
 
   // set default in case if we can't find any STS information
@@ -963,36 +583,14 @@ nsSiteSecurityService::IsSecureHost(uint32_t aType, const char* aHost,
     return NS_OK;
   }
 
-  /* An IP address never qualifies as a secure URI. */
+  // An IP address never qualifies as a secure URI.
   if (HostIsIPAddress(aHost)) {
     return NS_OK;
   }
 
-  if (aType == nsISiteSecurityService::HEADER_HPKP) {
-    RefPtr<SharedCertVerifier> certVerifier(GetDefaultCertVerifier());
-    if (!certVerifier) {
-      return NS_ERROR_FAILURE;
-    }
-    if (certVerifier->mPinningMode ==
-        CertVerifier::PinningMode::pinningDisabled) {
-      return NS_OK;
-    }
-    bool enforceTestMode = certVerifier->mPinningMode ==
-                           CertVerifier::PinningMode::pinningEnforceTestMode;
-    return PublicKeyPinningService::HostHasPins(aHost, mozilla::pkix::Now(),
-                                                enforceTestMode, *aResult);
-  }
-
-  // Holepunch chart.apis.google.com and subdomains.
-  nsAutoCString host(PublicKeyPinningService::CanonicalizeHostname(aHost));
-  if (host.EqualsLiteral("chart.apis.google.com") ||
-      StringEndsWith(host, NS_LITERAL_CSTRING(".chart.apis.google.com"))) {
-    if (aCached) {
-      *aCached = true;
-    }
-    return NS_OK;
-  }
-
+  // Canonicalize the passed host name
+  nsAutoCString host(CanonicalizeHostname(aHost));
+  
   // First check the exact host. This involves first checking for an entry in
   // site security storage. If that entry exists, we don't want to check
   // in the preload list. We only want to use the stored value if it is not a
@@ -1088,144 +686,9 @@ nsSiteSecurityService::IsSecureHost(uint32_t aType, const char* aHost,
 NS_IMETHODIMP
 nsSiteSecurityService::ClearAll()
 {
-   // Child processes are not allowed direct access to this.
-   if (!XRE_IsParentProcess()) {
-     MOZ_CRASH("Child process: no direct access to nsISiteSecurityService::ClearAll");
-   }
-
   return mSiteStateStorage->Clear();
 }
 
-bool entryStateNotOK(SiteHPKPState& state, mozilla::pkix::Time& aEvalTime) {
-  return state.mState != SecurityPropertySet || state.IsExpired(aEvalTime) ||
-         state.mSHA256keys.Length() < 1;
-}
-
-NS_IMETHODIMP
-nsSiteSecurityService::GetKeyPinsForHostname(const char* aHostname,
-                                             mozilla::pkix::Time& aEvalTime,
-                                             /*out*/ nsTArray<nsCString>& pinArray,
-                                             /*out*/ bool* aIncludeSubdomains,
-                                             /*out*/ bool* aFound) {
-   // Child processes are not allowed direct access to this.
-   if (!XRE_IsParentProcess()) {
-     MOZ_CRASH("Child process: no direct access to nsISiteSecurityService::GetKeyPinsForHostname");
-   }
-
-  NS_ENSURE_ARG(aFound);
-  NS_ENSURE_ARG(aHostname);
-
-  if (!mHPKPEnabled) {
-    SSSLOG(("HPKP disabled - returning 'pins not found' for %s",
-            aHostname));
-    *aFound = false;
-    return NS_OK;
-  }
-
-  SSSLOG(("Top of GetKeyPinsForHostname for %s", aHostname));
-  *aFound = false;
-  *aIncludeSubdomains = false;
-  pinArray.Clear();
-
-  nsAutoCString host(PublicKeyPinningService::CanonicalizeHostname(aHostname));
-  nsAutoCString storageKey;
-  SetStorageKey(storageKey, host, nsISiteSecurityService::HEADER_HPKP);
-
-  SSSLOG(("storagekey '%s'\n", storageKey.get()));
-  mozilla::DataStorageType storageType = mozilla::DataStorage_Persistent;
-  nsCString value = mSiteStateStorage->Get(storageKey, storageType);
-
-  // decode now
-  SiteHPKPState foundEntry(value);
-  if (entryStateNotOK(foundEntry, aEvalTime)) {
-    // not in permanent storage, try now private
-    value = mSiteStateStorage->Get(storageKey, mozilla::DataStorage_Private);
-    SiteHPKPState privateEntry(value);
-    if (entryStateNotOK(privateEntry, aEvalTime)) {
-      // not in private storage, try dynamic preload
-      value = mPreloadStateStorage->Get(storageKey,
-                                        mozilla::DataStorage_Persistent);
-      SiteHPKPState preloadEntry(value);
-      if (entryStateNotOK(preloadEntry, aEvalTime)) {
-        return NS_OK;
-      }
-      foundEntry = preloadEntry;
-    } else {
-      foundEntry = privateEntry;
-    }
-  }
-  pinArray = foundEntry.mSHA256keys;
-  *aIncludeSubdomains = foundEntry.mIncludeSubdomains;
-  *aFound = true;
-  return NS_OK;
-}
-
-NS_IMETHODIMP
-nsSiteSecurityService::SetKeyPins(const char* aHost, bool aIncludeSubdomains,
-                                  int64_t aExpires, uint32_t aPinCount,
-                                  const char** aSha256Pins,
-                                  bool aIsPreload,
-                                  /*out*/ bool* aResult)
-{
-   // Child processes are not allowed direct access to this.
-   if (!XRE_IsParentProcess()) {
-     MOZ_CRASH("Child process: no direct access to nsISiteSecurityService::SetKeyPins");
-   }
-
-  NS_ENSURE_ARG_POINTER(aHost);
-  NS_ENSURE_ARG_POINTER(aResult);
-  NS_ENSURE_ARG_POINTER(aSha256Pins);
-
-
-  if (!mHPKPEnabled) {
-    SSSLOG(("SSS: HPKP disabled: not setting pins"));
-    *aResult = false;
-    return NS_OK;
-  }
-
-  SSSLOG(("Top of SetPins"));
-
-  nsTArray<nsCString> sha256keys;
-  for (unsigned int i = 0; i < aPinCount; i++) {
-    nsAutoCString pin(aSha256Pins[i]);
-    SSSLOG(("SetPins pin=%s\n", pin.get()));
-    if (!stringIsBase64EncodingOf256bitValue(pin)) {
-      return NS_ERROR_INVALID_ARG;
-    }
-    sha256keys.AppendElement(pin);
-  }
-  SiteHPKPState dynamicEntry(aExpires, SecurityPropertySet,
-                             aIncludeSubdomains, sha256keys);
-  // we always store data in permanent storage (ie no flags)
-  nsAutoCString host(PublicKeyPinningService::CanonicalizeHostname(aHost));
-  return SetHPKPState(host.get(), dynamicEntry, 0, aIsPreload);
-}
-
-nsresult
-nsSiteSecurityService::SetHPKPState(const char* aHost, SiteHPKPState& entry,
-                                    uint32_t aFlags, bool aIsPreload)
-{
-  SSSLOG(("Top of SetPKPState"));
-  nsAutoCString host(aHost);
-  nsAutoCString storageKey;
-  SetStorageKey(storageKey, host, nsISiteSecurityService::HEADER_HPKP);
-  bool isPrivate = aFlags & nsISocketProvider::NO_PERMANENT_STORAGE;
-  mozilla::DataStorageType storageType = isPrivate
-                                         ? mozilla::DataStorage_Private
-                                         : mozilla::DataStorage_Persistent;
-  nsAutoCString stateString;
-  entry.ToString(stateString);
-
-  nsresult rv;
-  if (aIsPreload) {
-    rv = mPreloadStateStorage->Put(storageKey, stateString, storageType);
-  } else {
-    rv = mSiteStateStorage->Put(storageKey, stateString, storageType);
-  }
-  NS_ENSURE_SUCCESS(rv, rv);
-  return NS_OK;
-}
-
 //------------------------------------------------------------
 // nsSiteSecurityService::nsIObserver
 //------------------------------------------------------------
@@ -1246,12 +709,6 @@ nsSiteSecurityService::Observe(nsISupports *subject,
       "network.stricttransportsecurity.enabled", true);
     mPreloadListTimeOffset =
       mozilla::Preferences::GetInt("test.currentTimeOffsetSeconds", 0);
-    mHPKPEnabled = mozilla::Preferences::GetBool(
-      "security.cert_pinning.hpkp.enabled", false);
-    mProcessPKPHeadersFromNonBuiltInRoots = mozilla::Preferences::GetBool(
-      "security.cert_pinning.process_headers_from_non_builtin_roots", false);
-    mMaxMaxAge = mozilla::Preferences::GetInt(
-      "security.cert_pinning.max_max_age_seconds", kSixtyDaysInSeconds);
   }
 
   return NS_OK;
diff --git a/security/manager/ssl/nsSiteSecurityService.h b/security/manager/ssl/nsSiteSecurityService.h
index 3cc428e2e..9395cd092 100644
--- a/security/manager/ssl/nsSiteSecurityService.h
+++ b/security/manager/ssl/nsSiteSecurityService.h
@@ -39,40 +39,6 @@ enum SecurityPropertyState {
 };
 
 /**
- * SiteHPKPState: A utility class that encodes/decodes a string describing
- * the public key pins of a site.
- * HPKP state consists of:
- *  - Expiry time (PRTime (aka int64_t) in milliseconds)
- *  - A state flag (SecurityPropertyState, default SecurityPropertyUnset)
- *  - An include subdomains flag (bool, default false)
- *  - An array of sha-256 hashed base 64 encoded fingerprints of required keys
- */
-class SiteHPKPState
-{
-public:
-  SiteHPKPState();
-  explicit SiteHPKPState(nsCString& aStateString);
-  SiteHPKPState(PRTime aExpireTime, SecurityPropertyState aState,
-                bool aIncludeSubdomains, nsTArray<nsCString>& SHA256keys);
-
-  PRTime mExpireTime;
-  SecurityPropertyState mState;
-  bool mIncludeSubdomains;
-  nsTArray<nsCString> mSHA256keys;
-
-  bool IsExpired(mozilla::pkix::Time aTime)
-  {
-    if (aTime > mozilla::pkix::TimeFromEpochInSeconds(mExpireTime /
-                                                      PR_MSEC_PER_SEC)) {
-      return true;
-    }
-    return false;
-  }
-
-  void ToString(nsCString& aString);
-};
-
-/**
  * SiteHSTSState: A utility class that encodes/decodes a string describing
  * the security state of a site. Currently only handles HSTS.
  * HSTS state consists of:
@@ -137,20 +103,10 @@ private:
   nsresult ProcessSTSHeader(nsIURI* aSourceURI, const char* aHeader,
                             uint32_t flags, uint64_t* aMaxAge,
                             bool* aIncludeSubdomains, uint32_t* aFailureResult);
-  nsresult ProcessPKPHeader(nsIURI* aSourceURI, const char* aHeader,
-                            nsISSLStatus* aSSLStatus, uint32_t flags,
-                            uint64_t* aMaxAge, bool* aIncludeSubdomains,
-                            uint32_t* aFailureResult);
-  nsresult SetHPKPState(const char* aHost, SiteHPKPState& entry, uint32_t flags,
-                        bool aIsPreload);
-
-  uint64_t mMaxMaxAge;
+
   bool mUseStsService;
   int64_t mPreloadListTimeOffset;
-  bool mHPKPEnabled;
-  bool mProcessPKPHeadersFromNonBuiltInRoots;
   RefPtr<mozilla::DataStorage> mSiteStateStorage;
-  RefPtr<mozilla::DataStorage> mPreloadStateStorage;
 };
 
 #endif // __nsSiteSecurityService_h__
diff --git a/security/manager/ssl/tests/unit/test_pinning.js b/security/manager/ssl/tests/unit/test_pinning.js
deleted file mode 100644
index f18182002..000000000
--- a/security/manager/ssl/tests/unit/test_pinning.js
+++ /dev/null
@@ -1,266 +0,0 @@
-// -*- indent-tabs-mode: nil; js-indent-level: 2 -*-
-// This Source Code Form is subject to the terms of the Mozilla Public
-// License, v. 2.0. If a copy of the MPL was not distributed with this
-// file, You can obtain one at http://mozilla.org/MPL/2.0/.
-//
-// For all cases, the acceptable pinset includes only certificates pinned to
-// Test End Entity Cert (signed by issuer testCA). Other certificates
-// are issued by otherCA, which is never in the pinset but is a user-specified
-// trust anchor. This test covers multiple cases:
-//
-// Pinned domain include-subdomains.pinning.example.com includes subdomains
-// - PASS: include-subdomains.pinning.example.com serves a correct cert
-// - PASS: good.include-subdomains.pinning.example.com serves a correct cert
-// - FAIL (strict): bad.include-subdomains.pinning.example.com serves a cert
-// not in the pinset
-// - PASS (mitm): bad.include-subdomains.pinning.example.com serves a cert not
-// in the pinset, but issued by a user-specified trust domain
-//
-// Pinned domain exclude-subdomains.pinning.example.com excludes subdomains
-// - PASS: exclude-subdomains.pinning.example.com serves a correct cert
-// - FAIL: exclude-subdomains.pinning.example.com serves an incorrect cert
-// (TODO: test using verifyCertNow)
-// - PASS: sub.exclude-subdomains.pinning.example.com serves an incorrect cert
-
-"use strict";
-
-do_get_profile(); // must be called before getting nsIX509CertDB
-const certdb = Cc["@mozilla.org/security/x509certdb;1"]
-                  .getService(Ci.nsIX509CertDB);
-
-function add_clear_override(host) {
-  add_test(function() {
-    let certOverrideService = Cc["@mozilla.org/security/certoverride;1"]
-                                .getService(Ci.nsICertOverrideService);
-    certOverrideService.clearValidityOverride(host, 8443);
-    run_next_test();
-  });
-}
-
-function test_strict() {
-  // In strict mode, we always evaluate pinning data, regardless of whether the
-  // issuer is a built-in trust anchor. We only enforce pins that are not in
-  // test mode.
-  add_test(function() {
-    Services.prefs.setIntPref("security.cert_pinning.enforcement_level", 2);
-    run_next_test();
-  });
-
-  // Normally this is overridable. But, since we have pinning information for
-  // this host, we don't allow overrides.
-  add_prevented_cert_override_test(
-    "unknownissuer.include-subdomains.pinning.example.com",
-    Ci.nsICertOverrideService.ERROR_UNTRUSTED,
-    SEC_ERROR_UNKNOWN_ISSUER);
-  add_clear_override("unknownissuer.include-subdomains.pinning.example.com");
-
-  // Issued by otherCA, which is not in the pinset for pinning.example.com.
-  add_connection_test("bad.include-subdomains.pinning.example.com",
-                      MOZILLA_PKIX_ERROR_KEY_PINNING_FAILURE);
-
-  // Check that using a FQDN doesn't bypass pinning.
-  add_connection_test("bad.include-subdomains.pinning.example.com.",
-                      MOZILLA_PKIX_ERROR_KEY_PINNING_FAILURE);
-  // For some reason this is also navigable (see bug 1118522).
-  add_connection_test("bad.include-subdomains.pinning.example.com..",
-                      MOZILLA_PKIX_ERROR_KEY_PINNING_FAILURE);
-
-  // These domains serve certs that match the pinset.
-  add_connection_test("include-subdomains.pinning.example.com",
-                      PRErrorCodeSuccess);
-  add_connection_test("good.include-subdomains.pinning.example.com",
-                      PRErrorCodeSuccess);
-  add_connection_test("exclude-subdomains.pinning.example.com",
-                      PRErrorCodeSuccess);
-
-  // This domain serves a cert that doesn't match the pinset, but subdomains
-  // are excluded.
-  add_connection_test("sub.exclude-subdomains.pinning.example.com",
-                      PRErrorCodeSuccess);
-
-  // This domain's pinset is exactly the same as
-  // include-subdomains.pinning.example.com, serves the same cert as
-  // bad.include-subdomains.pinning.example.com, but it should pass because
-  // it's in test_mode.
-  add_connection_test("test-mode.pinning.example.com",
-                      PRErrorCodeSuccess);
-  // Similarly, this pin is in test-mode, so it should be overridable.
-  add_cert_override_test("unknownissuer.test-mode.pinning.example.com",
-                         Ci.nsICertOverrideService.ERROR_UNTRUSTED,
-                         SEC_ERROR_UNKNOWN_ISSUER);
-  add_clear_override("unknownissuer.test-mode.pinning.example.com");
-}
-
-function test_mitm() {
-  // In MITM mode, we allow pinning to pass if the chain resolves to any
-  // user-specified trust anchor, even if it is not in the pinset.
-  add_test(function() {
-    Services.prefs.setIntPref("security.cert_pinning.enforcement_level", 1);
-    run_next_test();
-  });
-
-  add_connection_test("include-subdomains.pinning.example.com",
-                      PRErrorCodeSuccess);
-  add_connection_test("good.include-subdomains.pinning.example.com",
-                      PRErrorCodeSuccess);
-
-  // Normally this is overridable. But, since we have pinning information for
-  // this host, we don't allow overrides (since building a trusted chain fails,
-  // we have no reason to believe this was issued by a user-added trust
-  // anchor, so we can't allow overrides for it).
-  add_prevented_cert_override_test(
-    "unknownissuer.include-subdomains.pinning.example.com",
-    Ci.nsICertOverrideService.ERROR_UNTRUSTED,
-    SEC_ERROR_UNKNOWN_ISSUER);
-  add_clear_override("unknownissuer.include-subdomains.pinning.example.com");
-
-  // In this case, even though otherCA is not in the pinset, it is a
-  // user-specified trust anchor and the pinning check succeeds.
-  add_connection_test("bad.include-subdomains.pinning.example.com",
-                      PRErrorCodeSuccess);
-
-  add_connection_test("exclude-subdomains.pinning.example.com",
-                      PRErrorCodeSuccess);
-  add_connection_test("sub.exclude-subdomains.pinning.example.com",
-                      PRErrorCodeSuccess);
-  add_connection_test("test-mode.pinning.example.com", PRErrorCodeSuccess);
-  add_cert_override_test("unknownissuer.test-mode.pinning.example.com",
-                         Ci.nsICertOverrideService.ERROR_UNTRUSTED,
-                         SEC_ERROR_UNKNOWN_ISSUER);
-  add_clear_override("unknownissuer.test-mode.pinning.example.com");
-}
-
-function test_disabled() {
-  // Disable pinning.
-  add_test(function() {
-    Services.prefs.setIntPref("security.cert_pinning.enforcement_level", 0);
-    run_next_test();
-  });
-
-  add_connection_test("include-subdomains.pinning.example.com",
-                      PRErrorCodeSuccess);
-  add_connection_test("good.include-subdomains.pinning.example.com",
-                      PRErrorCodeSuccess);
-  add_connection_test("bad.include-subdomains.pinning.example.com",
-                      PRErrorCodeSuccess);
-  add_connection_test("exclude-subdomains.pinning.example.com",
-                      PRErrorCodeSuccess);
-  add_connection_test("sub.exclude-subdomains.pinning.example.com",
-                      PRErrorCodeSuccess);
-  add_connection_test("test-mode.pinning.example.com", PRErrorCodeSuccess);
-
-  add_cert_override_test("unknownissuer.include-subdomains.pinning.example.com",
-                         Ci.nsICertOverrideService.ERROR_UNTRUSTED,
-                         SEC_ERROR_UNKNOWN_ISSUER);
-  add_clear_override("unknownissuer.include-subdomains.pinning.example.com");
-  add_cert_override_test("unknownissuer.test-mode.pinning.example.com",
-                         Ci.nsICertOverrideService.ERROR_UNTRUSTED,
-                         SEC_ERROR_UNKNOWN_ISSUER);
-  add_clear_override("unknownissuer.test-mode.pinning.example.com");
-}
-
-function test_enforce_test_mode() {
-  // In enforce test mode, we always enforce all pins, even test pins.
-  add_test(function() {
-    Services.prefs.setIntPref("security.cert_pinning.enforcement_level", 3);
-    run_next_test();
-  });
-
-  // Normally this is overridable. But, since we have pinning information for
-  // this host, we don't allow overrides.
-  add_prevented_cert_override_test(
-    "unknownissuer.include-subdomains.pinning.example.com",
-    Ci.nsICertOverrideService.ERROR_UNTRUSTED,
-    SEC_ERROR_UNKNOWN_ISSUER);
-  add_clear_override("unknownissuer.include-subdomains.pinning.example.com");
-
-  // Issued by otherCA, which is not in the pinset for pinning.example.com.
-  add_connection_test("bad.include-subdomains.pinning.example.com",
-                      MOZILLA_PKIX_ERROR_KEY_PINNING_FAILURE);
-
-  // These domains serve certs that match the pinset.
-  add_connection_test("include-subdomains.pinning.example.com",
-                      PRErrorCodeSuccess);
-  add_connection_test("good.include-subdomains.pinning.example.com",
-                      PRErrorCodeSuccess);
-  add_connection_test("exclude-subdomains.pinning.example.com",
-                      PRErrorCodeSuccess);
-
-  // This domain serves a cert that doesn't match the pinset, but subdomains
-  // are excluded.
-  add_connection_test("sub.exclude-subdomains.pinning.example.com",
-                      PRErrorCodeSuccess);
-
-  // This domain's pinset is exactly the same as
-  // include-subdomains.pinning.example.com, serves the same cert as
-  // bad.include-subdomains.pinning.example.com, is in test-mode, but we are
-  // enforcing test mode pins.
-  add_connection_test("test-mode.pinning.example.com",
-                      MOZILLA_PKIX_ERROR_KEY_PINNING_FAILURE);
-  // Normally this is overridable. But, since we have pinning information for
-  // this host (and since we're enforcing test mode), we don't allow overrides.
-  add_prevented_cert_override_test(
-    "unknownissuer.test-mode.pinning.example.com",
-    Ci.nsICertOverrideService.ERROR_UNTRUSTED,
-    SEC_ERROR_UNKNOWN_ISSUER);
-  add_clear_override("unknownissuer.test-mode.pinning.example.com");
-}
-
-function check_pinning_telemetry() {
-  let service = Cc["@mozilla.org/base/telemetry;1"].getService(Ci.nsITelemetry);
-  let prod_histogram = service.getHistogramById("CERT_PINNING_RESULTS")
-                         .snapshot();
-  let test_histogram = service.getHistogramById("CERT_PINNING_TEST_RESULTS")
-                         .snapshot();
-  // Because all of our test domains are pinned to user-specified trust
-  // anchors, effectively only strict mode and enforce test-mode get evaluated
-  equal(prod_histogram.counts[0], 4,
-        "Actual and expected prod (non-Mozilla) failure count should match");
-  equal(prod_histogram.counts[1], 4,
-        "Actual and expected prod (non-Mozilla) success count should match");
-  equal(test_histogram.counts[0], 2,
-        "Actual and expected test (non-Mozilla) failure count should match");
-  equal(test_histogram.counts[1], 0,
-        "Actual and expected test (non-Mozilla) success count should match");
-
-  let moz_prod_histogram = service.getHistogramById("CERT_PINNING_MOZ_RESULTS")
-                             .snapshot();
-  let moz_test_histogram =
-    service.getHistogramById("CERT_PINNING_MOZ_TEST_RESULTS").snapshot();
-  equal(moz_prod_histogram.counts[0], 0,
-        "Actual and expected prod (Mozilla) failure count should match");
-  equal(moz_prod_histogram.counts[1], 0,
-        "Actual and expected prod (Mozilla) success count should match");
-  equal(moz_test_histogram.counts[0], 0,
-        "Actual and expected test (Mozilla) failure count should match");
-  equal(moz_test_histogram.counts[1], 0,
-        "Actual and expected test (Mozilla) success count should match");
-
-  let per_host_histogram =
-    service.getHistogramById("CERT_PINNING_MOZ_RESULTS_BY_HOST").snapshot();
-  equal(per_host_histogram.counts[0], 0,
-        "Actual and expected per host (Mozilla) failure count should match");
-  equal(per_host_histogram.counts[1], 2,
-        "Actual and expected per host (Mozilla) success count should match");
-  run_next_test();
-}
-
-function run_test() {
-  // Ensure that static pinning works when HPKP is disabled.
-  Services.prefs.setBoolPref("security.cert_pinning.hpkp.enabled", false);
-
-  add_tls_server_setup("BadCertServer", "bad_certs");
-
-  // Add a user-specified trust anchor.
-  addCertFromFile(certdb, "bad_certs/other-test-ca.pem", "CTu,u,u");
-
-  test_strict();
-  test_mitm();
-  test_disabled();
-  test_enforce_test_mode();
-
-  add_test(function () {
-    check_pinning_telemetry();
-  });
-  run_next_test();
-}
diff --git a/security/manager/ssl/tests/unit/test_pinning_dynamic.js b/security/manager/ssl/tests/unit/test_pinning_dynamic.js
deleted file mode 100644
index 60e85e041..000000000
--- a/security/manager/ssl/tests/unit/test_pinning_dynamic.js
+++ /dev/null
@@ -1,243 +0,0 @@
-/* This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-"use strict";
-
-// The purpose of this test is to create a site security service state file
-// and see that the site security service reads it properly.
-
-function writeLine(aLine, aOutputStream) {
-  aOutputStream.write(aLine, aLine.length);
-}
-
-var gSSService = null;
-var gSSSStateSeen = false;
-var gPreloadStateSeen = false;
-
-var profileDir = do_get_profile();
-var certdb;
-
-function certFromFile(cert_name) {
-  return constructCertFromFile("test_pinning_dynamic/" + cert_name + ".pem");
-}
-
-function loadCert(cert_name, trust_string) {
-  let cert_filename = "test_pinning_dynamic/" + cert_name + ".pem";
-  addCertFromFile(certdb, cert_filename, trust_string);
-  return constructCertFromFile(cert_filename);
-}
-
-function checkOK(cert, hostname) {
-  return checkCertErrorGeneric(certdb, cert, PRErrorCodeSuccess,
-                               certificateUsageSSLServer, {}, hostname);
-}
-
-function checkFail(cert, hostname) {
-  return checkCertErrorGeneric(certdb, cert, MOZILLA_PKIX_ERROR_KEY_PINNING_FAILURE,
-                               certificateUsageSSLServer, {}, hostname);
-}
-
-const NON_ISSUED_KEY_HASH = "KHAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAN=";
-const PINNING_ROOT_KEY_HASH = "VCIlmPM9NkgFQtrs4Oa5TeFcDu6MWRTKSNdePEhOgD8=";
-
-function run_test() {
-  Services.prefs.setBoolPref("security.cert_pinning.hpkp.enabled", true);
-  Services.prefs.setIntPref("security.cert_pinning.enforcement_level", 2);
-
-  let stateFile = profileDir.clone();
-  stateFile.append(SSS_STATE_FILE_NAME);
-  // Assuming we're working with a clean slate, the SSS_STATE file shouldn't
-  // exist until we create it.
-  ok(!stateFile.exists(),
-     "State file should not exist when working with a clean slate");
-  let outputStream = FileUtils.openFileOutputStream(stateFile);
-  let now = (new Date()).getTime();
-  writeLine(`a.pinning2.example.com:HPKP\t0\t0\t${now + 100000},1,0,${PINNING_ROOT_KEY_HASH}\n`, outputStream);
-  writeLine(`b.pinning2.example.com:HPKP\t0\t0\t${now + 100000},1,1,${PINNING_ROOT_KEY_HASH}\n`, outputStream);
-
-  outputStream.close();
-
-  let preloadFile = profileDir.clone();
-  preloadFile.append(PRELOAD_STATE_FILE_NAME);
-  ok(!preloadFile.exists(),
-     "Preload file should not exist when working with a clean slate");
-
-  outputStream = FileUtils.openFileOutputStream(preloadFile);
-  writeLine(`a.preload.example.com:HPKP\t0\t0\t${now + 100000},1,1,${PINNING_ROOT_KEY_HASH}\n`, outputStream);
-  outputStream.close();
-
-  Services.obs.addObserver(checkStateRead, "data-storage-ready", false);
-  do_test_pending();
-  gSSService = Cc["@mozilla.org/ssservice;1"]
-                 .getService(Ci.nsISiteSecurityService);
-  notEqual(gSSService, null,
-           "SiteSecurityService should have initialized successfully using" +
-           " the generated state file");
-}
-
-function checkDefaultSiteHPKPStatus() {
-  ok(gSSService.isSecureHost(Ci.nsISiteSecurityService.HEADER_HPKP,
-                             "a.pinning2.example.com", 0),
-     "a.pinning2.example.com should have HPKP status");
-  ok(!gSSService.isSecureHost(Ci.nsISiteSecurityService.HEADER_HPKP,
-                              "x.a.pinning2.example.com", 0),
-     "x.a.pinning2.example.com should not have HPKP status");
-  ok(gSSService.isSecureHost(Ci.nsISiteSecurityService.HEADER_HPKP,
-                             "b.pinning2.example.com", 0),
-     "b.pinning2.example.com should have HPKP status");
-  ok(gSSService.isSecureHost(Ci.nsISiteSecurityService.HEADER_HPKP,
-                             "x.b.pinning2.example.com", 0),
-     "x.b.pinning2.example.com should have HPKP status");
-}
-
-function checkStateRead(aSubject, aTopic, aData) {
-  if (aData == SSS_STATE_FILE_NAME) {
-    gSSSStateSeen = true;
-  } else if (aData == PRELOAD_STATE_FILE_NAME) {
-    gPreloadStateSeen = true;
-  } else {
-    throw new Error("Observed data should either be the Site Security " +
-                    "Service state file name or the preload file name");
-  }
-
-  if (!gSSSStateSeen || !gPreloadStateSeen) {
-    return;
-  }
-
-  notEqual(gSSService, null, "SiteSecurityService should be initialized");
-
-  // Initializing the certificate DB will cause NSS-initialization, which in
-  // turn initializes the site security service. Since we're in part testing
-  // that the site security service correctly reads its state file, we have to
-  // make sure it doesn't start up before we've populated the file
-  certdb = Cc["@mozilla.org/security/x509certdb;1"]
-             .getService(Ci.nsIX509CertDB);
-
-  loadCert("pinningroot", "CTu,CTu,CTu");
-  loadCert("badca", "CTu,CTu,CTu");
-
-  // the written entry is for a.pinning2.example.com without subdomains
-  // and b.pinning2.example.com with subdomains
-  checkFail(certFromFile('a.pinning2.example.com-badca'), "a.pinning2.example.com");
-  checkOK(certFromFile('a.pinning2.example.com-pinningroot'), "a.pinning2.example.com");
-  checkOK(certFromFile('x.a.pinning2.example.com-badca'), "x.a.pinning2.example.com");
-  checkOK(certFromFile('x.a.pinning2.example.com-pinningroot'), "x.a.pinning2.example.com");
-
-  checkFail(certFromFile('b.pinning2.example.com-badca'), "b.pinning2.example.com");
-  checkOK(certFromFile('b.pinning2.example.com-pinningroot'), "b.pinning2.example.com");
-  checkFail(certFromFile('x.b.pinning2.example.com-badca'), "x.b.pinning2.example.com");
-  checkOK(certFromFile('x.b.pinning2.example.com-pinningroot'), "x.b.pinning2.example.com");
-
-  checkDefaultSiteHPKPStatus();
-
-
-  // add includeSubdomains to a.pinning2.example.com
-  gSSService.setKeyPins("a.pinning2.example.com", true,
-                        new Date().getTime() + 1000000, 2,
-                        [NON_ISSUED_KEY_HASH, PINNING_ROOT_KEY_HASH]);
-  checkFail(certFromFile('a.pinning2.example.com-badca'), "a.pinning2.example.com");
-  checkOK(certFromFile('a.pinning2.example.com-pinningroot'), "a.pinning2.example.com");
-  checkFail(certFromFile('x.a.pinning2.example.com-badca'), "x.a.pinning2.example.com");
-  checkOK(certFromFile('x.a.pinning2.example.com-pinningroot'), "x.a.pinning2.example.com");
-  checkFail(certFromFile('b.pinning2.example.com-badca'), "b.pinning2.example.com");
-  checkOK(certFromFile('b.pinning2.example.com-pinningroot'), "b.pinning2.example.com");
-  checkFail(certFromFile('x.b.pinning2.example.com-badca'), "x.b.pinning2.example.com");
-  checkOK(certFromFile('x.b.pinning2.example.com-pinningroot'), "x.b.pinning2.example.com");
-
-  ok(gSSService.isSecureHost(Ci.nsISiteSecurityService.HEADER_HPKP,
-                             "a.pinning2.example.com", 0),
-     "a.pinning2.example.com should still have HPKP status after adding" +
-     " includeSubdomains to a.pinning2.example.com");
-  ok(gSSService.isSecureHost(Ci.nsISiteSecurityService.HEADER_HPKP,
-                             "x.a.pinning2.example.com", 0),
-     "x.a.pinning2.example.com should now have HPKP status after adding" +
-     " includeSubdomains to a.pinning2.example.com");
-
-  // Now setpins without subdomains
-  gSSService.setKeyPins("a.pinning2.example.com", false,
-                        new Date().getTime() + 1000000, 2,
-                        [NON_ISSUED_KEY_HASH, PINNING_ROOT_KEY_HASH]);
-  checkFail(certFromFile('a.pinning2.example.com-badca'), "a.pinning2.example.com");
-  checkOK(certFromFile('a.pinning2.example.com-pinningroot'), "a.pinning2.example.com");
-  checkOK(certFromFile('x.a.pinning2.example.com-badca'), "x.a.pinning2.example.com");
-  checkOK(certFromFile('x.a.pinning2.example.com-pinningroot'), "x.a.pinning2.example.com");
-
-  checkFail(certFromFile('b.pinning2.example.com-badca'), "b.pinning2.example.com");
-  checkOK(certFromFile('b.pinning2.example.com-pinningroot'), "b.pinning2.example.com");
-  checkFail(certFromFile('x.b.pinning2.example.com-badca'), "x.b.pinning2.example.com");
-  checkOK(certFromFile('x.b.pinning2.example.com-pinningroot'), "x.b.pinning2.example.com");
-
-  checkDefaultSiteHPKPStatus();
-
-  // failure to insert new pin entry leaves previous pin behavior
-  throws(() => {
-    gSSService.setKeyPins("a.pinning2.example.com", true,
-                          new Date().getTime() + 1000000, 1, ["not a hash"]);
-  }, /NS_ERROR_ILLEGAL_VALUE/, "Attempting to set an invalid pin should fail");
-  checkFail(certFromFile('a.pinning2.example.com-badca'), "a.pinning2.example.com");
-  checkOK(certFromFile('a.pinning2.example.com-pinningroot'), "a.pinning2.example.com");
-  checkOK(certFromFile('x.a.pinning2.example.com-badca'), "x.a.pinning2.example.com");
-  checkOK(certFromFile('x.a.pinning2.example.com-pinningroot'), "x.a.pinning2.example.com");
-
-  checkFail(certFromFile('b.pinning2.example.com-badca'), "b.pinning2.example.com");
-  checkOK(certFromFile('b.pinning2.example.com-pinningroot'), "b.pinning2.example.com");
-  checkFail(certFromFile('x.b.pinning2.example.com-badca'), "x.b.pinning2.example.com");
-  checkOK(certFromFile('x.b.pinning2.example.com-pinningroot'), "x.b.pinning2.example.com");
-
-  checkDefaultSiteHPKPStatus();
-
-  // Incorrect size results in failure
-  throws(() => {
-    gSSService.setKeyPins("a.pinning2.example.com", true,
-                          new Date().getTime() + 1000000, 2, ["not a hash"]);
-  }, /NS_ERROR_XPC_NOT_ENOUGH_ELEMENTS_IN_ARRAY/,
-     "Attempting to set a pin with an incorrect size should fail");
-
-  // Ensure built-in pins work as expected
-  ok(!gSSService.isSecureHost(Ci.nsISiteSecurityService.HEADER_HPKP,
-                              "nonexistent.example.com", 0),
-     "Not built-in nonexistent.example.com should not have HPKP status");
-  ok(gSSService.isSecureHost(Ci.nsISiteSecurityService.HEADER_HPKP,
-                             "include-subdomains.pinning.example.com", 0),
-     "Built-in include-subdomains.pinning.example.com should have HPKP status");
-
-  gSSService.setKeyPins("a.pinning2.example.com", false, new Date().getTime(),
-                        1, [NON_ISSUED_KEY_HASH]);
-
-  // Check that a preload pin loaded from file works as expected
-  checkFail(certFromFile("a.preload.example.com-badca"), "a.preload.example.com");
-  checkOK(certFromFile("a.preload.example.com-pinningroot"), "a.preload.example.com");
-
-  // Check a dynamic addition works as expected
-  // first, it should succeed with the badCA - because there's no pin
-  checkOK(certFromFile('b.preload.example.com-badca'), "b.preload.example.com");
-  // then we add a pin, and we should get a failure (ensuring the expiry is
-  // after the test timeout)
-  gSSService.setKeyPins("b.preload.example.com", false,
-                        new Date().getTime() + 1000000, 2,
-                        [NON_ISSUED_KEY_HASH, PINNING_ROOT_KEY_HASH], true);
-  checkFail(certFromFile('b.preload.example.com-badca'), "b.preload.example.com");
-
-  do_timeout(1250, checkExpiredState);
-}
-
-function checkExpiredState() {
-  checkOK(certFromFile('a.pinning2.example.com-badca'), "a.pinning2.example.com");
-  checkOK(certFromFile('a.pinning2.example.com-pinningroot'), "a.pinning2.example.com");
-  checkOK(certFromFile('x.a.pinning2.example.com-badca'), "x.a.pinning2.example.com");
-  checkOK(certFromFile('x.a.pinning2.example.com-pinningroot'), "x.a.pinning2.example.com");
-
-  checkFail(certFromFile('b.pinning2.example.com-badca'), "b.pinning2.example.com");
-  checkOK(certFromFile('b.pinning2.example.com-pinningroot'), "b.pinning2.example.com");
-  checkFail(certFromFile('x.b.pinning2.example.com-badca'), "x.b.pinning2.example.com");
-  checkOK(certFromFile('x.b.pinning2.example.com-pinningroot'), "x.b.pinning2.example.com");
-  checkPreloadClear();
-}
-
-function checkPreloadClear() {
-  // Check that the preloaded pins still work after private data is cleared
-  gSSService.clearAll();
-  checkFail(certFromFile('b.preload.example.com-badca'), "b.preload.example.com");
-
-  do_test_finished();
-}
diff --git a/security/manager/ssl/tests/unit/test_pinning_dynamic/a.pinning2.example.com-badca.pem b/security/manager/ssl/tests/unit/test_pinning_dynamic/a.pinning2.example.com-badca.pem
deleted file mode 100644
index 102a3bbda..000000000
--- a/security/manager/ssl/tests/unit/test_pinning_dynamic/a.pinning2.example.com-badca.pem
+++ /dev/null
@@ -1,18 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIC3TCCAcegAwIBAgIUXdB7LgBGZoRV1UmEFcsOhMigpB0wCwYJKoZIhvcNAQEL
-MBAxDjAMBgNVBAMMBWJhZGNhMCIYDzIwMTUxMTI4MDAwMDAwWhgPMjAxODAyMDUw
-MDAwMDBaMBoxGDAWBgNVBAMMD3Rlc3QgZW5kLWVudGl0eTCCASIwDQYJKoZIhvcN
-AQEBBQADggEPADCCAQoCggEBAMF1xlJmCZ93CCpnkfG4dsN/XOU4sGxKzSKxy9Rv
-plraKt1ByMJJisSjs8H2FIf0G2mJQb2ApRw8EgJExYSkxEgzBeUTjAEGzwi+moYn
-YLrmoujzbyPF2YMTud+vN4NF2s5R1Nbc0qbLPMcG680wcOyYzOQKpZHXKVp/ccW+
-ZmkdKy3+yElEWQvFo+pJ/ZOx11NAXxdzdpmVhmYlR5ftQmkIiAgRQiBpmIpD/uSM
-5oeB3SK2ppzSg3UTH5MrEozihvp9JRwGKtJ+8Bbxh83VToMrNbiTD3S6kKqLx2Fn
-JCqx/W1iFA0YxMC4xo/DdIRXMkrX3obmVS8dHhkdcSFo07sCAwEAAaMlMCMwIQYD
-VR0RBBowGIIWYS5waW5uaW5nMi5leGFtcGxlLmNvbTALBgkqhkiG9w0BAQsDggEB
-AAKhpX2t/Bz9//u1DYyLZ6dLSJt121Vb58s8gQvI/7n6MdUP1IniQLbtPW+7wnV0
-6LYagJQ11ZUJMxYUs6lB91yhwAO9NoN4QJWWB0i23DoZ6cg4dHmYKmQQ/HRndwm+
-EATkJSnBAk8O2xmIm8CXbJ0W0lvaXEjzRfeoiEjQ0/THeo4hXvGOMPm31d+r4ji5
-/u2+9jrpTII0kjCwFjqC97lPID14s9QRMqMB1CCV6fgT19EGYi9I7H6mnyukkmfX
-9wOhLHSk6A2l5+5eJrZYXLOhcS31VBd54sb1Vvg+Bp05HMYjo051JcRlvxoIUsHT
-JQDn8QrzwZBDBh4Pie3AwOM=
------END CERTIFICATE-----
\ No newline at end of file
diff --git a/security/manager/ssl/tests/unit/test_pinning_dynamic/a.pinning2.example.com-badca.pem.certspec b/security/manager/ssl/tests/unit/test_pinning_dynamic/a.pinning2.example.com-badca.pem.certspec
deleted file mode 100644
index f365b8a18..000000000
--- a/security/manager/ssl/tests/unit/test_pinning_dynamic/a.pinning2.example.com-badca.pem.certspec
+++ /dev/null
@@ -1,5 +0,0 @@
-issuer:badca
-subject:test end-entity
-issuerKey:alternate
-subjectKey:alternate
-extension:subjectAlternativeName:a.pinning2.example.com
diff --git a/security/manager/ssl/tests/unit/test_pinning_dynamic/a.pinning2.example.com-pinningroot.pem b/security/manager/ssl/tests/unit/test_pinning_dynamic/a.pinning2.example.com-pinningroot.pem
deleted file mode 100644
index 2439b5775..000000000
--- a/security/manager/ssl/tests/unit/test_pinning_dynamic/a.pinning2.example.com-pinningroot.pem
+++ /dev/null
@@ -1,18 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIC4zCCAc2gAwIBAgIUPQgjdPeWdWy/0oKRi+5Lr7JJorMwCwYJKoZIhvcNAQEL
-MBYxFDASBgNVBAMMC3Bpbm5pbmdyb290MCIYDzIwMTUxMTI4MDAwMDAwWhgPMjAx
-ODAyMDUwMDAwMDBaMBoxGDAWBgNVBAMMD3Rlc3QgZW5kLWVudGl0eTCCASIwDQYJ
-KoZIhvcNAQEBBQADggEPADCCAQoCggEBAMF1xlJmCZ93CCpnkfG4dsN/XOU4sGxK
-zSKxy9RvplraKt1ByMJJisSjs8H2FIf0G2mJQb2ApRw8EgJExYSkxEgzBeUTjAEG
-zwi+moYnYLrmoujzbyPF2YMTud+vN4NF2s5R1Nbc0qbLPMcG680wcOyYzOQKpZHX
-KVp/ccW+ZmkdKy3+yElEWQvFo+pJ/ZOx11NAXxdzdpmVhmYlR5ftQmkIiAgRQiBp
-mIpD/uSM5oeB3SK2ppzSg3UTH5MrEozihvp9JRwGKtJ+8Bbxh83VToMrNbiTD3S6
-kKqLx2FnJCqx/W1iFA0YxMC4xo/DdIRXMkrX3obmVS8dHhkdcSFo07sCAwEAAaMl
-MCMwIQYDVR0RBBowGIIWYS5waW5uaW5nMi5leGFtcGxlLmNvbTALBgkqhkiG9w0B
-AQsDggEBAFUlxnwpxOFbSxtsBthWu6xmDxeFAzP+u5YOfuKeiIGnAx70k8ODQufJ
-Vm1rXvKtN5r8jR6AZh/hdA+tGhnu4+pGi9/aqWnaF1FEs2mW0saUV8atQZwNGRBO
-E9FXdAHA8WmGIfRf8TOuWpmEWejjJt5Zsfs+V3ARIxjCrVE7ixyfJ/hYpmthLtYJ
-5vgp0iiPjzorKeFnqooLVAfzeayRX0bE5H79NISIWq4CN/9J50ZFkRORURlANU95
-2Dcuw416b3BGrWVmWlKWOpA6NZ+Rj+AI+z9UTDpqCczTfMXMabX4EveW1GKMMYiA
-eLD8SY4VQ4403eaCp6rxYFrCNOeDczs=
------END CERTIFICATE-----
\ No newline at end of file
diff --git a/security/manager/ssl/tests/unit/test_pinning_dynamic/a.pinning2.example.com-pinningroot.pem.certspec b/security/manager/ssl/tests/unit/test_pinning_dynamic/a.pinning2.example.com-pinningroot.pem.certspec
deleted file mode 100644
index aef72ce39..000000000
--- a/security/manager/ssl/tests/unit/test_pinning_dynamic/a.pinning2.example.com-pinningroot.pem.certspec
+++ /dev/null
@@ -1,4 +0,0 @@
-issuer:pinningroot
-subject:test end-entity
-subjectKey:alternate
-extension:subjectAlternativeName:a.pinning2.example.com
diff --git a/security/manager/ssl/tests/unit/test_pinning_dynamic/a.preload.example.com-badca.pem b/security/manager/ssl/tests/unit/test_pinning_dynamic/a.preload.example.com-badca.pem
deleted file mode 100644
index 2a157d8e6..000000000
--- a/security/manager/ssl/tests/unit/test_pinning_dynamic/a.preload.example.com-badca.pem
+++ /dev/null
@@ -1,18 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIC3DCCAcagAwIBAgIUKUG7kBZ72CvuLQ0uPfjKHLkKDQAwCwYJKoZIhvcNAQEL
-MBAxDjAMBgNVBAMMBWJhZGNhMCIYDzIwMTUxMTI4MDAwMDAwWhgPMjAxODAyMDUw
-MDAwMDBaMBoxGDAWBgNVBAMMD3Rlc3QgZW5kLWVudGl0eTCCASIwDQYJKoZIhvcN
-AQEBBQADggEPADCCAQoCggEBAMF1xlJmCZ93CCpnkfG4dsN/XOU4sGxKzSKxy9Rv
-plraKt1ByMJJisSjs8H2FIf0G2mJQb2ApRw8EgJExYSkxEgzBeUTjAEGzwi+moYn
-YLrmoujzbyPF2YMTud+vN4NF2s5R1Nbc0qbLPMcG680wcOyYzOQKpZHXKVp/ccW+
-ZmkdKy3+yElEWQvFo+pJ/ZOx11NAXxdzdpmVhmYlR5ftQmkIiAgRQiBpmIpD/uSM
-5oeB3SK2ppzSg3UTH5MrEozihvp9JRwGKtJ+8Bbxh83VToMrNbiTD3S6kKqLx2Fn
-JCqx/W1iFA0YxMC4xo/DdIRXMkrX3obmVS8dHhkdcSFo07sCAwEAAaMkMCIwIAYD
-VR0RBBkwF4IVYS5wcmVsb2FkLmV4YW1wbGUuY29tMAsGCSqGSIb3DQEBCwOCAQEA
-tx5YO8uvYac92scnMEswv4ZIslou8UYV/2mtxA+MaXf/g+MizOKeZgTI1+b9hR48
-IDOgvrqPCbn1hKY6gb2gtRI1mC5dg9T8EYEXcC1TM+ncY/l4SZUjfMhzY2iOf62x
-jhDqMMt4V5uaHUxVmJQI82X5qpxH3yJ3WOC87iGZNfMB8MSbLM3lxor9OHeTlTHQ
-vPb/r7cLW+ikxirDGyBBvThkvDA/8qyN5Qp6Ae1BiPeEMoScNf3fChvNV6Jyb8g8
-e9q0LnTlTuVgaDWtg7PVOxeiI+wf3Jhv9uqXQLX8JHZDKebLbQEkNcbR4DK/8wsP
-uFhj0j8DY6+/YZbcF7Jgfw==
------END CERTIFICATE-----
\ No newline at end of file
diff --git a/security/manager/ssl/tests/unit/test_pinning_dynamic/a.preload.example.com-badca.pem.certspec b/security/manager/ssl/tests/unit/test_pinning_dynamic/a.preload.example.com-badca.pem.certspec
deleted file mode 100644
index c1cb36576..000000000
--- a/security/manager/ssl/tests/unit/test_pinning_dynamic/a.preload.example.com-badca.pem.certspec
+++ /dev/null
@@ -1,5 +0,0 @@
-issuer:badca
-subject:test end-entity
-issuerKey:alternate
-subjectKey:alternate
-extension:subjectAlternativeName:a.preload.example.com
diff --git a/security/manager/ssl/tests/unit/test_pinning_dynamic/a.preload.example.com-pinningroot.pem b/security/manager/ssl/tests/unit/test_pinning_dynamic/a.preload.example.com-pinningroot.pem
deleted file mode 100644
index 5fa43f052..000000000
--- a/security/manager/ssl/tests/unit/test_pinning_dynamic/a.preload.example.com-pinningroot.pem
+++ /dev/null
@@ -1,18 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIC4jCCAcygAwIBAgIURV3mf9Dz42lALe31OAm2SYbpFaEwCwYJKoZIhvcNAQEL
-MBYxFDASBgNVBAMMC3Bpbm5pbmdyb290MCIYDzIwMTUxMTI4MDAwMDAwWhgPMjAx
-ODAyMDUwMDAwMDBaMBoxGDAWBgNVBAMMD3Rlc3QgZW5kLWVudGl0eTCCASIwDQYJ
-KoZIhvcNAQEBBQADggEPADCCAQoCggEBAMF1xlJmCZ93CCpnkfG4dsN/XOU4sGxK
-zSKxy9RvplraKt1ByMJJisSjs8H2FIf0G2mJQb2ApRw8EgJExYSkxEgzBeUTjAEG
-zwi+moYnYLrmoujzbyPF2YMTud+vN4NF2s5R1Nbc0qbLPMcG680wcOyYzOQKpZHX
-KVp/ccW+ZmkdKy3+yElEWQvFo+pJ/ZOx11NAXxdzdpmVhmYlR5ftQmkIiAgRQiBp
-mIpD/uSM5oeB3SK2ppzSg3UTH5MrEozihvp9JRwGKtJ+8Bbxh83VToMrNbiTD3S6
-kKqLx2FnJCqx/W1iFA0YxMC4xo/DdIRXMkrX3obmVS8dHhkdcSFo07sCAwEAAaMk
-MCIwIAYDVR0RBBkwF4IVYS5wcmVsb2FkLmV4YW1wbGUuY29tMAsGCSqGSIb3DQEB
-CwOCAQEATOA0bbfg81JieQkTzr4oxBqPuFamtLSAsLpbKakikYQo2znMGNnHV7Xe
-uxMGMhCIPRsiJ6jj6ZTQJNqQRKzXWEiBgREsarmJxA53ITIcO2cK2rqyetNAAwzZ
-oViENmK3tLA5KT2VC9IGgMXdSE7IfXn+5yCdpKZ2ohwtkYHNkCbQIU+4KaCPa/dB
-yAelZZPE0mVHJLkd5HoOsFmjFOBQuOkn9/AAOmkgBZIk1Dp833ywn/mnwLZdVsdV
-+TjqWKenDJXxhO2+aCCtZbUVxKMn0TACpAA+rhjS5vigCyIZh7V4rxki9UXaOfVq
-EVy4rFlRIYYtXV40HavDZoPgxuCHDw==
------END CERTIFICATE-----
\ No newline at end of file
diff --git a/security/manager/ssl/tests/unit/test_pinning_dynamic/a.preload.example.com-pinningroot.pem.certspec b/security/manager/ssl/tests/unit/test_pinning_dynamic/a.preload.example.com-pinningroot.pem.certspec
deleted file mode 100644
index 5c1865314..000000000
--- a/security/manager/ssl/tests/unit/test_pinning_dynamic/a.preload.example.com-pinningroot.pem.certspec
+++ /dev/null
@@ -1,4 +0,0 @@
-issuer:pinningroot
-subject:test end-entity
-subjectKey:alternate
-extension:subjectAlternativeName:a.preload.example.com
diff --git a/security/manager/ssl/tests/unit/test_pinning_dynamic/b.pinning2.example.com-badca.pem b/security/manager/ssl/tests/unit/test_pinning_dynamic/b.pinning2.example.com-badca.pem
deleted file mode 100644
index cffb37c1f..000000000
--- a/security/manager/ssl/tests/unit/test_pinning_dynamic/b.pinning2.example.com-badca.pem
+++ /dev/null
@@ -1,18 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIC3TCCAcegAwIBAgIUV89JsAhywp3graSGqjeSpMzd1B0wCwYJKoZIhvcNAQEL
-MBAxDjAMBgNVBAMMBWJhZGNhMCIYDzIwMTUxMTI4MDAwMDAwWhgPMjAxODAyMDUw
-MDAwMDBaMBoxGDAWBgNVBAMMD3Rlc3QgZW5kLWVudGl0eTCCASIwDQYJKoZIhvcN
-AQEBBQADggEPADCCAQoCggEBAMF1xlJmCZ93CCpnkfG4dsN/XOU4sGxKzSKxy9Rv
-plraKt1ByMJJisSjs8H2FIf0G2mJQb2ApRw8EgJExYSkxEgzBeUTjAEGzwi+moYn
-YLrmoujzbyPF2YMTud+vN4NF2s5R1Nbc0qbLPMcG680wcOyYzOQKpZHXKVp/ccW+
-ZmkdKy3+yElEWQvFo+pJ/ZOx11NAXxdzdpmVhmYlR5ftQmkIiAgRQiBpmIpD/uSM
-5oeB3SK2ppzSg3UTH5MrEozihvp9JRwGKtJ+8Bbxh83VToMrNbiTD3S6kKqLx2Fn
-JCqx/W1iFA0YxMC4xo/DdIRXMkrX3obmVS8dHhkdcSFo07sCAwEAAaMlMCMwIQYD
-VR0RBBowGIIWYi5waW5uaW5nMi5leGFtcGxlLmNvbTALBgkqhkiG9w0BAQsDggEB
-ABevzhH9/hjTBgTtUk4ytZX0A7Tu0DR5F9ooFnlUwzupHFihO+9NzEoCSIvCy3L9
-+i3LbkaiUWEHQItLjIg+aice13ZkuMp+DeZ+D/YR9ulxyY1QBYeZLQj/gSdkj/fK
-uDm0Izgt8OBsgP+KFX2c2cGZyOcXmFFAwSfkLz7p2qzrmuM7r5ploNpxeHBUIxUW
-jJzSFeQMfy5wflcKDBY+PDejzN9Ik4weRyERsckVgmZSJXuodb8xgYkNPvl/GOVJ
-o+eDw+E3uOsdBIDrsyb+bcQTG7nBkQoSqG8M0610h0OqFhksfv/0HcB/wfW8VdU+
-+C4+tR2KfvqTCm3T6gzRWX8=
------END CERTIFICATE-----
\ No newline at end of file
diff --git a/security/manager/ssl/tests/unit/test_pinning_dynamic/b.pinning2.example.com-badca.pem.certspec b/security/manager/ssl/tests/unit/test_pinning_dynamic/b.pinning2.example.com-badca.pem.certspec
deleted file mode 100644
index 5aa8aaa5e..000000000
--- a/security/manager/ssl/tests/unit/test_pinning_dynamic/b.pinning2.example.com-badca.pem.certspec
+++ /dev/null
@@ -1,5 +0,0 @@
-issuer:badca
-subject:test end-entity
-issuerKey:alternate
-subjectKey:alternate
-extension:subjectAlternativeName:b.pinning2.example.com
diff --git a/security/manager/ssl/tests/unit/test_pinning_dynamic/b.pinning2.example.com-pinningroot.pem b/security/manager/ssl/tests/unit/test_pinning_dynamic/b.pinning2.example.com-pinningroot.pem
deleted file mode 100644
index 791f64b4c..000000000
--- a/security/manager/ssl/tests/unit/test_pinning_dynamic/b.pinning2.example.com-pinningroot.pem
+++ /dev/null
@@ -1,18 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIC4zCCAc2gAwIBAgIUVQNTrx+mRE96ggRLuZeFm+9uBdcwCwYJKoZIhvcNAQEL
-MBYxFDASBgNVBAMMC3Bpbm5pbmdyb290MCIYDzIwMTUxMTI4MDAwMDAwWhgPMjAx
-ODAyMDUwMDAwMDBaMBoxGDAWBgNVBAMMD3Rlc3QgZW5kLWVudGl0eTCCASIwDQYJ
-KoZIhvcNAQEBBQADggEPADCCAQoCggEBAMF1xlJmCZ93CCpnkfG4dsN/XOU4sGxK
-zSKxy9RvplraKt1ByMJJisSjs8H2FIf0G2mJQb2ApRw8EgJExYSkxEgzBeUTjAEG
-zwi+moYnYLrmoujzbyPF2YMTud+vN4NF2s5R1Nbc0qbLPMcG680wcOyYzOQKpZHX
-KVp/ccW+ZmkdKy3+yElEWQvFo+pJ/ZOx11NAXxdzdpmVhmYlR5ftQmkIiAgRQiBp
-mIpD/uSM5oeB3SK2ppzSg3UTH5MrEozihvp9JRwGKtJ+8Bbxh83VToMrNbiTD3S6
-kKqLx2FnJCqx/W1iFA0YxMC4xo/DdIRXMkrX3obmVS8dHhkdcSFo07sCAwEAAaMl
-MCMwIQYDVR0RBBowGIIWYi5waW5uaW5nMi5leGFtcGxlLmNvbTALBgkqhkiG9w0B
-AQsDggEBAHYCfQaolF6z4IicBDTEQQVfYi4A3BcCNLTdInQlal/DHNytNRufM5TB
-ccNpau5U9e10NBYWbMqRUBb/7wtYE4O7jhEWxjaHBOz5KTYLv8hjEc2wcHXfhlYM
-QKmxOnA7SguSNYBdfXywav//ssLmDnB06nc2vv5NaKvIWbUv3HvfM8oRAr+NICUs
-UMcIb+hjY+u/qrnOeFJxXzeqPYKMa7H+33baRgy7xnL95PxAwkz0XL8vcMFupTX5
-dL5HsSKku23C0BoE6pK39TVh758fQjCAnD+QRTH/o+dfE2sIFpRiyszdXGmh2IRR
-gMSy+gJbH+zh0D9ncL0Kev0PyEuBYR4=
------END CERTIFICATE-----
\ No newline at end of file
diff --git a/security/manager/ssl/tests/unit/test_pinning_dynamic/b.pinning2.example.com-pinningroot.pem.certspec b/security/manager/ssl/tests/unit/test_pinning_dynamic/b.pinning2.example.com-pinningroot.pem.certspec
deleted file mode 100644
index 17f22dab5..000000000
--- a/security/manager/ssl/tests/unit/test_pinning_dynamic/b.pinning2.example.com-pinningroot.pem.certspec
+++ /dev/null
@@ -1,4 +0,0 @@
-issuer:pinningroot
-subject:test end-entity
-subjectKey:alternate
-extension:subjectAlternativeName:b.pinning2.example.com
diff --git a/security/manager/ssl/tests/unit/test_pinning_dynamic/b.preload.example.com-badca.pem b/security/manager/ssl/tests/unit/test_pinning_dynamic/b.preload.example.com-badca.pem
deleted file mode 100644
index 4ef23a2c2..000000000
--- a/security/manager/ssl/tests/unit/test_pinning_dynamic/b.preload.example.com-badca.pem
+++ /dev/null
@@ -1,18 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIC3DCCAcagAwIBAgIUf2T4BVvxeCgWVp/FL3tCFNjuZYQwCwYJKoZIhvcNAQEL
-MBAxDjAMBgNVBAMMBWJhZGNhMCIYDzIwMTUxMTI4MDAwMDAwWhgPMjAxODAyMDUw
-MDAwMDBaMBoxGDAWBgNVBAMMD3Rlc3QgZW5kLWVudGl0eTCCASIwDQYJKoZIhvcN
-AQEBBQADggEPADCCAQoCggEBAMF1xlJmCZ93CCpnkfG4dsN/XOU4sGxKzSKxy9Rv
-plraKt1ByMJJisSjs8H2FIf0G2mJQb2ApRw8EgJExYSkxEgzBeUTjAEGzwi+moYn
-YLrmoujzbyPF2YMTud+vN4NF2s5R1Nbc0qbLPMcG680wcOyYzOQKpZHXKVp/ccW+
-ZmkdKy3+yElEWQvFo+pJ/ZOx11NAXxdzdpmVhmYlR5ftQmkIiAgRQiBpmIpD/uSM
-5oeB3SK2ppzSg3UTH5MrEozihvp9JRwGKtJ+8Bbxh83VToMrNbiTD3S6kKqLx2Fn
-JCqx/W1iFA0YxMC4xo/DdIRXMkrX3obmVS8dHhkdcSFo07sCAwEAAaMkMCIwIAYD
-VR0RBBkwF4IVYi5wcmVsb2FkLmV4YW1wbGUuY29tMAsGCSqGSIb3DQEBCwOCAQEA
-okmxK2NDRYWSAn6b1YZpLiZnoaNrM0HXHY6fkARY/9EiAApvNPxT663EKtTZn27a
-JtwXP2zzlYQDRc9cxa1zBX9Tp+0sn5aqokqzoVWx4VIe/emzi9FDf3lgaYewHLez
-RINv3kUZmqlw6tmMQxjd51UGyvNsi52+gcet1cPr5kBzGQv/q7iNs/lcetL3+KQF
-klJ3PfI4VjFwRRYNhScxiRczklPVDySvxSNw+csUxNRunFLXIi3+WqQzYhw7R8ga
-ASwozTfvVAUySOmDipCZZXAHFtlpBr6vAllfD9v8hAsrE7Bkivafr+i5HMD3DtJE
-4ZedqFCkTkqKvd0fMIbOIA==
------END CERTIFICATE-----
\ No newline at end of file
diff --git a/security/manager/ssl/tests/unit/test_pinning_dynamic/b.preload.example.com-badca.pem.certspec b/security/manager/ssl/tests/unit/test_pinning_dynamic/b.preload.example.com-badca.pem.certspec
deleted file mode 100644
index 9901ead60..000000000
--- a/security/manager/ssl/tests/unit/test_pinning_dynamic/b.preload.example.com-badca.pem.certspec
+++ /dev/null
@@ -1,5 +0,0 @@
-issuer:badca
-subject:test end-entity
-issuerKey:alternate
-subjectKey:alternate
-extension:subjectAlternativeName:b.preload.example.com
diff --git a/security/manager/ssl/tests/unit/test_pinning_dynamic/b.preload.example.com-pinningroot.pem b/security/manager/ssl/tests/unit/test_pinning_dynamic/b.preload.example.com-pinningroot.pem
deleted file mode 100644
index c6ea38a12..000000000
--- a/security/manager/ssl/tests/unit/test_pinning_dynamic/b.preload.example.com-pinningroot.pem
+++ /dev/null
@@ -1,18 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIC4jCCAcygAwIBAgIUI5rdRX/x0w0bDx6hQhc8ZhGLfqQwCwYJKoZIhvcNAQEL
-MBYxFDASBgNVBAMMC3Bpbm5pbmdyb290MCIYDzIwMTUxMTI4MDAwMDAwWhgPMjAx
-ODAyMDUwMDAwMDBaMBoxGDAWBgNVBAMMD3Rlc3QgZW5kLWVudGl0eTCCASIwDQYJ
-KoZIhvcNAQEBBQADggEPADCCAQoCggEBAMF1xlJmCZ93CCpnkfG4dsN/XOU4sGxK
-zSKxy9RvplraKt1ByMJJisSjs8H2FIf0G2mJQb2ApRw8EgJExYSkxEgzBeUTjAEG
-zwi+moYnYLrmoujzbyPF2YMTud+vN4NF2s5R1Nbc0qbLPMcG680wcOyYzOQKpZHX
-KVp/ccW+ZmkdKy3+yElEWQvFo+pJ/ZOx11NAXxdzdpmVhmYlR5ftQmkIiAgRQiBp
-mIpD/uSM5oeB3SK2ppzSg3UTH5MrEozihvp9JRwGKtJ+8Bbxh83VToMrNbiTD3S6
-kKqLx2FnJCqx/W1iFA0YxMC4xo/DdIRXMkrX3obmVS8dHhkdcSFo07sCAwEAAaMk
-MCIwIAYDVR0RBBkwF4IVYi5wcmVsb2FkLmV4YW1wbGUuY29tMAsGCSqGSIb3DQEB
-CwOCAQEAg2VdHBLmFLJ03N9VT4uUrnpjuYY9bsvPJF2JCk9817nxBbeMf+Qn0C/o
-OeoQnZRqsaFbKZ80JXmh/j4RO6T/aaQUMpk+NXrdSPddy2B3eUByF/NJqipV3M2a
-CRNWUUVF+msjRWwbzJafju2nEZcD4d4cUkHHYAaRRxAHH3ylEvWmdv/brgfAPCPH
-WDVaCMc3OXgHkyrLAfkMKSYTNPJ7DJn/BXET5tCzqYGRUgRnME4ON2Mmp19lsdig
-dIFbm76wg6l5M+s9pqiYzODUxJXUOd6BkAR5pqB9WyIRVfBr5LGT72nv00LHVcSm
-hnsti9nAtFdJx4E1lJilrnQwu0q4Iw==
------END CERTIFICATE-----
\ No newline at end of file
diff --git a/security/manager/ssl/tests/unit/test_pinning_dynamic/b.preload.example.com-pinningroot.pem.certspec b/security/manager/ssl/tests/unit/test_pinning_dynamic/b.preload.example.com-pinningroot.pem.certspec
deleted file mode 100644
index 6f5807700..000000000
--- a/security/manager/ssl/tests/unit/test_pinning_dynamic/b.preload.example.com-pinningroot.pem.certspec
+++ /dev/null
@@ -1,4 +0,0 @@
-issuer:pinningroot
-subject:test end-entity
-subjectKey:alternate
-extension:subjectAlternativeName:b.preload.example.com
diff --git a/security/manager/ssl/tests/unit/test_pinning_dynamic/badca.pem b/security/manager/ssl/tests/unit/test_pinning_dynamic/badca.pem
deleted file mode 100644
index 9443a4c91..000000000
--- a/security/manager/ssl/tests/unit/test_pinning_dynamic/badca.pem
+++ /dev/null
@@ -1,17 +0,0 @@
------BEGIN CERTIFICATE-----
-MIICyzCCAbWgAwIBAgIUXQevdaeXMieCrG6ZqhI2yfACBq4wCwYJKoZIhvcNAQEL
-MBAxDjAMBgNVBAMMBWJhZGNhMCIYDzIwMTUxMTI4MDAwMDAwWhgPMjAxODAyMDUw
-MDAwMDBaMBAxDjAMBgNVBAMMBWJhZGNhMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A
-MIIBCgKCAQEAwXXGUmYJn3cIKmeR8bh2w39c5TiwbErNIrHL1G+mWtoq3UHIwkmK
-xKOzwfYUh/QbaYlBvYClHDwSAkTFhKTESDMF5ROMAQbPCL6ahidguuai6PNvI8XZ
-gxO53683g0XazlHU1tzSpss8xwbrzTBw7JjM5AqlkdcpWn9xxb5maR0rLf7ISURZ
-C8Wj6kn9k7HXU0BfF3N2mZWGZiVHl+1CaQiICBFCIGmYikP+5Izmh4HdIramnNKD
-dRMfkysSjOKG+n0lHAYq0n7wFvGHzdVOgys1uJMPdLqQqovHYWckKrH9bWIUDRjE
-wLjGj8N0hFcyStfehuZVLx0eGR1xIWjTuwIDAQABox0wGzAMBgNVHRMEBTADAQH/
-MAsGA1UdDwQEAwIBBjALBgkqhkiG9w0BAQsDggEBAHitWfZzPxR/UWEKQgz9zzm2
-NXszG7nV82w8qfC9pq8mU3f7eqbHJ2HNFkZzttJsH9DNl30OK2Y5IVLUiZHckz2e
-OFUyxK0tBCCBYd79FiK4BgP/Ys/7LK+4UaDhbRQP//MGuofwjsrNxgPgtkNaeKtF
-EXKCuDrHoa4ua7afrkUWKzPZ6JbDOEjJIyuJ3ISI0Q20Oc3ERxGwG1SQ1EldgWBr
-0dJJWBHZtNpIVvSm1dRfjMYtSrBoUXwbn6kDrdk4T98OHnFP0V0KW4j4umLHK7Gi
-OSAwvWtir3fSJaLJClTCFe1XoNvJnQ53PJs0JR26mAixV2VuylStO2KlbYy7fOc=
------END CERTIFICATE-----
\ No newline at end of file
diff --git a/security/manager/ssl/tests/unit/test_pinning_dynamic/badca.pem.certspec b/security/manager/ssl/tests/unit/test_pinning_dynamic/badca.pem.certspec
deleted file mode 100644
index 311bbb3f8..000000000
--- a/security/manager/ssl/tests/unit/test_pinning_dynamic/badca.pem.certspec
+++ /dev/null
@@ -1,6 +0,0 @@
-issuer:badca
-subject:badca
-issuerKey:alternate
-subjectKey:alternate
-extension:basicConstraints:cA,
-extension:keyUsage:keyCertSign,cRLSign
diff --git a/security/manager/ssl/tests/unit/test_pinning_dynamic/moz.build b/security/manager/ssl/tests/unit/test_pinning_dynamic/moz.build
deleted file mode 100644
index eb8b582f5..000000000
--- a/security/manager/ssl/tests/unit/test_pinning_dynamic/moz.build
+++ /dev/null
@@ -1,26 +0,0 @@
-# -*- Mode: python; indent-tabs-mode: nil; tab-width: 40 -*-
-# vim: set filetype=python:
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, You can obtain one at http://mozilla.org/MPL/2.0/.
-
-# Temporarily disabled. See bug 1256495.
-#test_certificates = (
-#    'badca.pem',
-#    'a.pinning2.example.com-badca.pem',
-#    'a.pinning2.example.com-pinningroot.pem',
-#    'a.preload.example.com-badca.pem',
-#    'a.preload.example.com-pinningroot.pem',
-#    'b.pinning2.example.com-badca.pem',
-#    'b.pinning2.example.com-pinningroot.pem',
-#    'b.preload.example.com-badca.pem',
-#    'b.preload.example.com-pinningroot.pem',
-#    'x.a.pinning2.example.com-badca.pem',
-#    'x.a.pinning2.example.com-pinningroot.pem',
-#    'x.b.pinning2.example.com-badca.pem',
-#    'x.b.pinning2.example.com-pinningroot.pem',
-#    'pinningroot.pem',
-#)
-#
-#for test_certificate in test_certificates:
-#    GeneratedTestCertificate(test_certificate)
diff --git a/security/manager/ssl/tests/unit/test_pinning_dynamic/pinningroot.pem b/security/manager/ssl/tests/unit/test_pinning_dynamic/pinningroot.pem
deleted file mode 100644
index 9a041991a..000000000
--- a/security/manager/ssl/tests/unit/test_pinning_dynamic/pinningroot.pem
+++ /dev/null
@@ -1,18 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIC1zCCAcGgAwIBAgIUMwSUmBShbg5sMNZSTiPd5Tb1udkwCwYJKoZIhvcNAQEL
-MBYxFDASBgNVBAMMC3Bpbm5pbmdyb290MCIYDzIwMTUxMTI4MDAwMDAwWhgPMjAx
-ODAyMDUwMDAwMDBaMBYxFDASBgNVBAMMC3Bpbm5pbmdyb290MIIBIjANBgkqhkiG
-9w0BAQEFAAOCAQ8AMIIBCgKCAQEAuohRqESOFtZB/W62iAY2ED08E9nq5DVKtOz1
-aFdsJHvBxyWo4NgfvbGcBptuGobya+KvWnVramRxCHqlWqdFh/cc1SScAn7NQ/we
-adA4ICmTqyDDSeTbuUzCa2wO7RWCD/F+rWkasdMCOosqQe6ncOAPDY39ZgsrsCSS
-pH25iGF5kLFXkD3SO8XguEgfqDfTiEPvJxbYVbdmWqp+ApAvOnsQgAYkzBxsl62W
-YVu34pYSwHUxowyR3bTK9/ytHSXTCe+5Fw6naOGzey8ib2njtIqVYR3uJtYlnauR
-CE42yxwkBCy/Fosv5fGPmRcxuLP+SSP6clHEMdUDrNoYCjXtjQIDAQABox0wGzAM
-BgNVHRMEBTADAQH/MAsGA1UdDwQEAwIBBjALBgkqhkiG9w0BAQsDggEBADNuQnKg
-y8zWnKlfBq/50UOtdSlvevg6u6tsUTvay2kVgB8BRTvm76aw4yOLgk84eHHkrX5c
-TqdutWh2JZarUWbO7JnPTdDE2CAkDh1smSe9L/XJENbgVXleg/VYLgnfnuSQCCnK
-WjjExcorX6IKDks1ZoBJ1HIvBzMRMWzIQgBL9B2Y1V05lgfn0bwZD+TjUJBmN1w0
-NTaPgrxE7FWZ2CTcowrYRKEEDAUX4cTFoce5YMwALCgW59KfVQfQdHaiCCcdNbfi
-qSQGZu+59JrrasmgK9VTahukYWcaQCz8HBCasdknGodLAzThuWMkjXU3D2IZYl15
-GfE5yrRFop/89xo=
------END CERTIFICATE-----
\ No newline at end of file
diff --git a/security/manager/ssl/tests/unit/test_pinning_dynamic/pinningroot.pem.certspec b/security/manager/ssl/tests/unit/test_pinning_dynamic/pinningroot.pem.certspec
deleted file mode 100644
index 86500e16b..000000000
--- a/security/manager/ssl/tests/unit/test_pinning_dynamic/pinningroot.pem.certspec
+++ /dev/null
@@ -1,4 +0,0 @@
-issuer:pinningroot
-subject:pinningroot
-extension:basicConstraints:cA,
-extension:keyUsage:keyCertSign,cRLSign
diff --git a/security/manager/ssl/tests/unit/test_pinning_dynamic/x.a.pinning2.example.com-badca.pem b/security/manager/ssl/tests/unit/test_pinning_dynamic/x.a.pinning2.example.com-badca.pem
deleted file mode 100644
index e4b6e72c0..000000000
--- a/security/manager/ssl/tests/unit/test_pinning_dynamic/x.a.pinning2.example.com-badca.pem
+++ /dev/null
@@ -1,18 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIC3zCCAcmgAwIBAgIUe11LKIzCrdnRTgrLsfuGMoOpL1QwCwYJKoZIhvcNAQEL
-MBAxDjAMBgNVBAMMBWJhZGNhMCIYDzIwMTUxMTI4MDAwMDAwWhgPMjAxODAyMDUw
-MDAwMDBaMBoxGDAWBgNVBAMMD3Rlc3QgZW5kLWVudGl0eTCCASIwDQYJKoZIhvcN
-AQEBBQADggEPADCCAQoCggEBAMF1xlJmCZ93CCpnkfG4dsN/XOU4sGxKzSKxy9Rv
-plraKt1ByMJJisSjs8H2FIf0G2mJQb2ApRw8EgJExYSkxEgzBeUTjAEGzwi+moYn
-YLrmoujzbyPF2YMTud+vN4NF2s5R1Nbc0qbLPMcG680wcOyYzOQKpZHXKVp/ccW+
-ZmkdKy3+yElEWQvFo+pJ/ZOx11NAXxdzdpmVhmYlR5ftQmkIiAgRQiBpmIpD/uSM
-5oeB3SK2ppzSg3UTH5MrEozihvp9JRwGKtJ+8Bbxh83VToMrNbiTD3S6kKqLx2Fn
-JCqx/W1iFA0YxMC4xo/DdIRXMkrX3obmVS8dHhkdcSFo07sCAwEAAaMnMCUwIwYD
-VR0RBBwwGoIYeC5hLnBpbm5pbmcyLmV4YW1wbGUuY29tMAsGCSqGSIb3DQEBCwOC
-AQEAgdFC/SwBLRp6A+n3znR+sEuU8UvmbgbXp7pIFVh6cbC6lNF0nXk9ywPeIWyh
-B7TCn3YHj4uc/PbvzRj9Py0gQLXcimKpmLoxclV5g1uTAydgXPiPulv/kaL9NOME
-lm88pyQeDwfEkUz7VijabIzFRTEVRmOudb8mX4SuzjhxsdzSMjffpae335beJ4Im
-lxgJgMsuJdEoK0WyG5nlBhVdzrT/kwdiwULeVNV//UHid1YZy56G5Lo22Hgd4wT3
-1W3LXQelBdHhee7Hf7mg4rjCUPulFAr8qBLdywf1Hnu1o7rXUcn46PLwKLOWJPOM
-SKpiqRKqvzlrzLaHPejfT0IMrw==
------END CERTIFICATE-----
\ No newline at end of file
diff --git a/security/manager/ssl/tests/unit/test_pinning_dynamic/x.a.pinning2.example.com-badca.pem.certspec b/security/manager/ssl/tests/unit/test_pinning_dynamic/x.a.pinning2.example.com-badca.pem.certspec
deleted file mode 100644
index ad8636d43..000000000
--- a/security/manager/ssl/tests/unit/test_pinning_dynamic/x.a.pinning2.example.com-badca.pem.certspec
+++ /dev/null
@@ -1,5 +0,0 @@
-issuer:badca
-subject:test end-entity
-issuerKey:alternate
-subjectKey:alternate
-extension:subjectAlternativeName:x.a.pinning2.example.com
diff --git a/security/manager/ssl/tests/unit/test_pinning_dynamic/x.a.pinning2.example.com-pinningroot.pem b/security/manager/ssl/tests/unit/test_pinning_dynamic/x.a.pinning2.example.com-pinningroot.pem
deleted file mode 100644
index ed58de323..000000000
--- a/security/manager/ssl/tests/unit/test_pinning_dynamic/x.a.pinning2.example.com-pinningroot.pem
+++ /dev/null
@@ -1,18 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIC5TCCAc+gAwIBAgIUefEeE+Sj5fBSec+97B6UmZFQEncwCwYJKoZIhvcNAQEL
-MBYxFDASBgNVBAMMC3Bpbm5pbmdyb290MCIYDzIwMTUxMTI4MDAwMDAwWhgPMjAx
-ODAyMDUwMDAwMDBaMBoxGDAWBgNVBAMMD3Rlc3QgZW5kLWVudGl0eTCCASIwDQYJ
-KoZIhvcNAQEBBQADggEPADCCAQoCggEBAMF1xlJmCZ93CCpnkfG4dsN/XOU4sGxK
-zSKxy9RvplraKt1ByMJJisSjs8H2FIf0G2mJQb2ApRw8EgJExYSkxEgzBeUTjAEG
-zwi+moYnYLrmoujzbyPF2YMTud+vN4NF2s5R1Nbc0qbLPMcG680wcOyYzOQKpZHX
-KVp/ccW+ZmkdKy3+yElEWQvFo+pJ/ZOx11NAXxdzdpmVhmYlR5ftQmkIiAgRQiBp
-mIpD/uSM5oeB3SK2ppzSg3UTH5MrEozihvp9JRwGKtJ+8Bbxh83VToMrNbiTD3S6
-kKqLx2FnJCqx/W1iFA0YxMC4xo/DdIRXMkrX3obmVS8dHhkdcSFo07sCAwEAAaMn
-MCUwIwYDVR0RBBwwGoIYeC5hLnBpbm5pbmcyLmV4YW1wbGUuY29tMAsGCSqGSIb3
-DQEBCwOCAQEAT2fxisiLJvVdFTba07a2Pc6UHBE+O0tOaLfMmHx/ET2FZdd9sLTL
-X2f+hQCmXEBQ7Au2eYTew8hTyXYGYFauMJNk+XHHUIaSOhmnYTccye4d6j5bXRCp
-7zA1qPlReCDLjp7o/34whkvngvdgdLYf60EkBO/NJfj+zsR1JTVfyVzIKXl6veLz
-0xKicBAq9vS0Yqq10japVYKKqAw6gDpbNkSAd3xsl4+EbMRq+BnMB4W2anw1gM/e
-hV11JQVA/MREtmUiTkvJFF6chHVCn5aL7JzVM2miZjZC8Ix59LUBoyO3SrxgrzZw
-xeYuwoDhzTCrcFxn8gdKNajbGHuW5ekQpg==
------END CERTIFICATE-----
\ No newline at end of file
diff --git a/security/manager/ssl/tests/unit/test_pinning_dynamic/x.a.pinning2.example.com-pinningroot.pem.certspec b/security/manager/ssl/tests/unit/test_pinning_dynamic/x.a.pinning2.example.com-pinningroot.pem.certspec
deleted file mode 100644
index 260f2184b..000000000
--- a/security/manager/ssl/tests/unit/test_pinning_dynamic/x.a.pinning2.example.com-pinningroot.pem.certspec
+++ /dev/null
@@ -1,4 +0,0 @@
-issuer:pinningroot
-subject:test end-entity
-subjectKey:alternate
-extension:subjectAlternativeName:x.a.pinning2.example.com
diff --git a/security/manager/ssl/tests/unit/test_pinning_dynamic/x.b.pinning2.example.com-badca.pem b/security/manager/ssl/tests/unit/test_pinning_dynamic/x.b.pinning2.example.com-badca.pem
deleted file mode 100644
index dc24247e8..000000000
--- a/security/manager/ssl/tests/unit/test_pinning_dynamic/x.b.pinning2.example.com-badca.pem
+++ /dev/null
@@ -1,18 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIC3zCCAcmgAwIBAgIUYcTc5Pz7KlQldGOO+KzbuBdf8TswCwYJKoZIhvcNAQEL
-MBAxDjAMBgNVBAMMBWJhZGNhMCIYDzIwMTUxMTI4MDAwMDAwWhgPMjAxODAyMDUw
-MDAwMDBaMBoxGDAWBgNVBAMMD3Rlc3QgZW5kLWVudGl0eTCCASIwDQYJKoZIhvcN
-AQEBBQADggEPADCCAQoCggEBAMF1xlJmCZ93CCpnkfG4dsN/XOU4sGxKzSKxy9Rv
-plraKt1ByMJJisSjs8H2FIf0G2mJQb2ApRw8EgJExYSkxEgzBeUTjAEGzwi+moYn
-YLrmoujzbyPF2YMTud+vN4NF2s5R1Nbc0qbLPMcG680wcOyYzOQKpZHXKVp/ccW+
-ZmkdKy3+yElEWQvFo+pJ/ZOx11NAXxdzdpmVhmYlR5ftQmkIiAgRQiBpmIpD/uSM
-5oeB3SK2ppzSg3UTH5MrEozihvp9JRwGKtJ+8Bbxh83VToMrNbiTD3S6kKqLx2Fn
-JCqx/W1iFA0YxMC4xo/DdIRXMkrX3obmVS8dHhkdcSFo07sCAwEAAaMnMCUwIwYD
-VR0RBBwwGoIYeC5iLnBpbm5pbmcyLmV4YW1wbGUuY29tMAsGCSqGSIb3DQEBCwOC
-AQEAd6HusXqftFBpSUzivIY6icTZ95+wY+xIOsf1QOgyzZ/CDx4Tly+rgue2xSNT
-59FmnFvh8jW202K8TykamsAX20A8ArzubNoc/+soA752YEvrMmOgWjmH2arqTfqg
-zcfNdgUDESwnOoy123F+PkT3rRDXwINzCwftxhKbvmqhO6YENteqyWWmSZoMClsJ
-xtm+bmPN+m26k6zMMYWzIu2HIXI3CgqOmJltfyqea02Y58S1+XlajrcewPpC17xD
-r5a1sizecCFrmV0ssbK8wvEYo9Xs+PNj8Vhi1DUwGjtnjrYn/WQ6v/luMEEO7EMD
-b3BbEziS3Pqej2JyprUKqOjv1g==
------END CERTIFICATE-----
\ No newline at end of file
diff --git a/security/manager/ssl/tests/unit/test_pinning_dynamic/x.b.pinning2.example.com-badca.pem.certspec b/security/manager/ssl/tests/unit/test_pinning_dynamic/x.b.pinning2.example.com-badca.pem.certspec
deleted file mode 100644
index 592bdcc58..000000000
--- a/security/manager/ssl/tests/unit/test_pinning_dynamic/x.b.pinning2.example.com-badca.pem.certspec
+++ /dev/null
@@ -1,5 +0,0 @@
-issuer:badca
-subject:test end-entity
-issuerKey:alternate
-subjectKey:alternate
-extension:subjectAlternativeName:x.b.pinning2.example.com
diff --git a/security/manager/ssl/tests/unit/test_pinning_dynamic/x.b.pinning2.example.com-pinningroot.pem b/security/manager/ssl/tests/unit/test_pinning_dynamic/x.b.pinning2.example.com-pinningroot.pem
deleted file mode 100644
index 642135994..000000000
--- a/security/manager/ssl/tests/unit/test_pinning_dynamic/x.b.pinning2.example.com-pinningroot.pem
+++ /dev/null
@@ -1,18 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIC5TCCAc+gAwIBAgIUNXGolw8M2HU/gP4dOSMD2bdTQ+MwCwYJKoZIhvcNAQEL
-MBYxFDASBgNVBAMMC3Bpbm5pbmdyb290MCIYDzIwMTUxMTI4MDAwMDAwWhgPMjAx
-ODAyMDUwMDAwMDBaMBoxGDAWBgNVBAMMD3Rlc3QgZW5kLWVudGl0eTCCASIwDQYJ
-KoZIhvcNAQEBBQADggEPADCCAQoCggEBAMF1xlJmCZ93CCpnkfG4dsN/XOU4sGxK
-zSKxy9RvplraKt1ByMJJisSjs8H2FIf0G2mJQb2ApRw8EgJExYSkxEgzBeUTjAEG
-zwi+moYnYLrmoujzbyPF2YMTud+vN4NF2s5R1Nbc0qbLPMcG680wcOyYzOQKpZHX
-KVp/ccW+ZmkdKy3+yElEWQvFo+pJ/ZOx11NAXxdzdpmVhmYlR5ftQmkIiAgRQiBp
-mIpD/uSM5oeB3SK2ppzSg3UTH5MrEozihvp9JRwGKtJ+8Bbxh83VToMrNbiTD3S6
-kKqLx2FnJCqx/W1iFA0YxMC4xo/DdIRXMkrX3obmVS8dHhkdcSFo07sCAwEAAaMn
-MCUwIwYDVR0RBBwwGoIYeC5iLnBpbm5pbmcyLmV4YW1wbGUuY29tMAsGCSqGSIb3
-DQEBCwOCAQEAevN1gW64H2kCjW5W4wbQFkJIITjcdEUsw+8GPzDuBDJCvgGirhOi
-ArBie8Bz+JlqzgNCXSe6pFVLoNfLosG5xksLwHljEit/7gFQ5twFazdg7dwPXs9Z
-MIV2iv3vHmKYTFTcjfw07UWy0rHHt6EH+zXqpZFtFkJHqSgngKxAHgQlvSKeyynM
-albu5YAX/hzJ7TyAVGxVN8uxnvYqPbLCy3wKf9ILFiDer6B9pE4Ii+dUyUbqVQFZ
-tY2ac1474nkcfj3uj5qbV0TTpd9EL9HMvixTnoUrT3bqkRX7orvL4gXpnJJyRjvC
-/LvTh/Vt1mYKkNLc/ruOj7WfUUC0SJIDzQ==
------END CERTIFICATE-----
\ No newline at end of file
diff --git a/security/manager/ssl/tests/unit/test_pinning_dynamic/x.b.pinning2.example.com-pinningroot.pem.certspec b/security/manager/ssl/tests/unit/test_pinning_dynamic/x.b.pinning2.example.com-pinningroot.pem.certspec
deleted file mode 100644
index 7e6d33d50..000000000
--- a/security/manager/ssl/tests/unit/test_pinning_dynamic/x.b.pinning2.example.com-pinningroot.pem.certspec
+++ /dev/null
@@ -1,4 +0,0 @@
-issuer:pinningroot
-subject:test end-entity
-subjectKey:alternate
-extension:subjectAlternativeName:x.b.pinning2.example.com
diff --git a/security/manager/ssl/tests/unit/test_pinning_header_parsing.js b/security/manager/ssl/tests/unit/test_pinning_header_parsing.js
deleted file mode 100644
index 0dcf6993b..000000000
--- a/security/manager/ssl/tests/unit/test_pinning_header_parsing.js
+++ /dev/null
@@ -1,147 +0,0 @@
-/* This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-"use strict";
-
-// The purpose of this test is to check that parsing of HPKP headers
-// is correct.
-
-var profileDir = do_get_profile();
-const certdb = Cc["@mozilla.org/security/x509certdb;1"]
-                 .getService(Ci.nsIX509CertDB);
-var gSSService = Cc["@mozilla.org/ssservice;1"]
-                   .getService(Ci.nsISiteSecurityService);
-
-function certFromFile(cert_name) {
-  return constructCertFromFile("test_pinning_dynamic/" + cert_name + ".pem");
-}
-
-function loadCert(cert_name, trust_string) {
-  let cert_filename = "test_pinning_dynamic/" + cert_name + ".pem";
-  addCertFromFile(certdb, cert_filename, trust_string);
-  return constructCertFromFile(cert_filename);
-}
-
-function checkFailParseInvalidPin(pinValue) {
-  let sslStatus = new FakeSSLStatus(
-                        certFromFile('a.pinning2.example.com-pinningroot'));
-  let uri = Services.io.newURI("https://a.pinning2.example.com", null, null);
-  throws(() => {
-    gSSService.processHeader(Ci.nsISiteSecurityService.HEADER_HPKP, uri,
-                             pinValue, sslStatus, 0);
-  }, /NS_ERROR_FAILURE/, `Invalid pin "${pinValue}" should be rejected`);
-}
-
-function checkPassValidPin(pinValue, settingPin, expectedMaxAge) {
-  let sslStatus = new FakeSSLStatus(
-                        certFromFile('a.pinning2.example.com-pinningroot'));
-  let uri = Services.io.newURI("https://a.pinning2.example.com", null, null);
-  let maxAge = {};
-
-  // setup preconditions for the test, if setting ensure there is no previous
-  // state, if removing ensure there is a valid pin in place.
-  if (settingPin) {
-    gSSService.removeState(Ci.nsISiteSecurityService.HEADER_HPKP, uri, 0);
-  } else {
-    // add a known valid pin!
-    let validPinValue = "max-age=5000;" + VALID_PIN1 + BACKUP_PIN1;
-    gSSService.processHeader(Ci.nsISiteSecurityService.HEADER_HPKP, uri,
-                             validPinValue, sslStatus, 0);
-  }
-  try {
-    gSSService.processHeader(Ci.nsISiteSecurityService.HEADER_HPKP, uri,
-                             pinValue, sslStatus, 0, maxAge);
-    ok(true, "Valid pin should be accepted");
-  } catch (e) {
-    ok(false, "Valid pin should have been accepted");
-  }
-
-  // check that maxAge was processed correctly
-  if (settingPin && expectedMaxAge) {
-    ok(maxAge.value == expectedMaxAge, `max-age value should be ${expectedMaxAge}`);
-  }
-
-  // after processing ensure that the postconditions are true, if setting
-  // the host must be pinned, if removing the host must not be pinned
-  let hostIsPinned = gSSService.isSecureHost(Ci.nsISiteSecurityService.HEADER_HPKP,
-                                             "a.pinning2.example.com", 0);
-  if (settingPin) {
-    ok(hostIsPinned, "Host should be considered pinned");
-  } else {
-    ok(!hostIsPinned, "Host should not be considered pinned");
-  }
-}
-
-function checkPassSettingPin(pinValue, expectedMaxAge) {
-  return checkPassValidPin(pinValue, true, expectedMaxAge);
-}
-
-function checkPassRemovingPin(pinValue) {
-  return checkPassValidPin(pinValue, false);
-}
-
-const MAX_MAX_AGE_SECONDS = 100000;
-const GOOD_MAX_AGE_SECONDS = 69403;
-const LONG_MAX_AGE_SECONDS = 2 * MAX_MAX_AGE_SECONDS;
-const NON_ISSUED_KEY_HASH1 = "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=";
-const NON_ISSUED_KEY_HASH2 = "ZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZ=";
-const PINNING_ROOT_KEY_HASH = "VCIlmPM9NkgFQtrs4Oa5TeFcDu6MWRTKSNdePEhOgD8=";
-const MAX_AGE_ZERO = "max-age=0;";
-const VALID_PIN1 = `pin-sha256="${PINNING_ROOT_KEY_HASH}";`;
-const BACKUP_PIN1 = `pin-sha256="${NON_ISSUED_KEY_HASH1}";`;
-const BACKUP_PIN2 = `pin-sha256="${NON_ISSUED_KEY_HASH2}";`;
-const BROKEN_PIN1 = "pin-sha256=\"jdjsjsjs\";";
-const GOOD_MAX_AGE = `max-age=${GOOD_MAX_AGE_SECONDS};`;
-const LONG_MAX_AGE = `max-age=${LONG_MAX_AGE_SECONDS};`;
-const INCLUDE_SUBDOMAINS = "includeSubdomains;";
-const REPORT_URI = "report-uri=\"https://www.example.com/report/\";";
-const UNRECOGNIZED_DIRECTIVE = "unreconized-dir=12343;";
-
-function run_test() {
-  Services.prefs.setBoolPref("security.cert_pinning.hpkp.enabled", true);
-  Services.prefs.setIntPref("security.cert_pinning.enforcement_level", 2);
-  Services.prefs.setIntPref("security.cert_pinning.max_max_age_seconds", MAX_MAX_AGE_SECONDS);
-  Services.prefs.setBoolPref("security.cert_pinning.process_headers_from_non_builtin_roots", true);
-
-  loadCert("pinningroot", "CTu,CTu,CTu");
-  loadCert("badca", "CTu,CTu,CTu");
-
-  checkFailParseInvalidPin("max-age=INVALID");
-  // check that incomplete headers are failure
-  checkFailParseInvalidPin(GOOD_MAX_AGE);
-  checkFailParseInvalidPin(VALID_PIN1);
-  checkFailParseInvalidPin(REPORT_URI);
-  checkFailParseInvalidPin(UNRECOGNIZED_DIRECTIVE);
-  checkFailParseInvalidPin(VALID_PIN1 + BACKUP_PIN1);
-  checkFailParseInvalidPin(GOOD_MAX_AGE + VALID_PIN1);
-  checkFailParseInvalidPin(GOOD_MAX_AGE + VALID_PIN1 + BROKEN_PIN1);
-  // next ensure a backup pin is present
-  checkFailParseInvalidPin(GOOD_MAX_AGE + VALID_PIN1 + VALID_PIN1);
-  // next section ensure duplicate directives result in failure
-  checkFailParseInvalidPin(GOOD_MAX_AGE + GOOD_MAX_AGE + VALID_PIN1 + BACKUP_PIN1);
-  checkFailParseInvalidPin(GOOD_MAX_AGE + VALID_PIN1 + BACKUP_PIN1 + INCLUDE_SUBDOMAINS + INCLUDE_SUBDOMAINS);
-  checkFailParseInvalidPin(GOOD_MAX_AGE + VALID_PIN1 + BACKUP_PIN1 + REPORT_URI + REPORT_URI);
-  checkFailParseInvalidPin("thisisinvalidtest");
-  checkFailParseInvalidPin("invalid" + GOOD_MAX_AGE + VALID_PIN1 + BACKUP_PIN1);
-
-  checkPassRemovingPin("max-age=0"); //test removal without terminating ';'
-  checkPassRemovingPin(MAX_AGE_ZERO);
-  checkPassRemovingPin(MAX_AGE_ZERO + VALID_PIN1);
-
-  checkPassSettingPin(GOOD_MAX_AGE + VALID_PIN1 + BACKUP_PIN1, GOOD_MAX_AGE_SECONDS);
-  checkPassSettingPin(LONG_MAX_AGE + VALID_PIN1 + BACKUP_PIN1, MAX_MAX_AGE_SECONDS);
-
-  checkPassRemovingPin(VALID_PIN1 + MAX_AGE_ZERO + VALID_PIN1);
-  checkPassSettingPin(GOOD_MAX_AGE + VALID_PIN1 + BACKUP_PIN1);
-  checkPassSettingPin(GOOD_MAX_AGE + VALID_PIN1 + BACKUP_PIN2);
-  checkPassSettingPin(GOOD_MAX_AGE + VALID_PIN1 + BACKUP_PIN2 + INCLUDE_SUBDOMAINS);
-  checkPassSettingPin(VALID_PIN1 + GOOD_MAX_AGE + BACKUP_PIN2 + INCLUDE_SUBDOMAINS);
-  checkPassSettingPin(VALID_PIN1 + GOOD_MAX_AGE + BACKUP_PIN2 + REPORT_URI + INCLUDE_SUBDOMAINS);
-  checkPassSettingPin(INCLUDE_SUBDOMAINS + VALID_PIN1 + GOOD_MAX_AGE + BACKUP_PIN2);
-  checkPassSettingPin(GOOD_MAX_AGE + VALID_PIN1 + BACKUP_PIN1 + UNRECOGNIZED_DIRECTIVE);
-  
-  Services.prefs.clearUserPref("security.cert_pinning.hpkp.enabled");
-  Services.prefs.clearUserPref("security.cert_pinning.enforcement_level");
-  Services.prefs.clearUserPref("security.cert_pinning.max_max_age_seconds");
-  Services.prefs.clearUserPref("security.cert_pinning.process_headers_from_non_builtin_roots");
-}
diff --git a/security/manager/ssl/tests/unit/test_sts_holepunch.js b/security/manager/ssl/tests/unit/test_sts_holepunch.js
deleted file mode 100644
index b7e643148..000000000
--- a/security/manager/ssl/tests/unit/test_sts_holepunch.js
+++ /dev/null
@@ -1,34 +0,0 @@
-/* This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
- */
-"use strict";
-
-// bug 961528: chart.apis.google.com doesn't handle https. Check that
-// it isn't considered HSTS (other example.apis.google.com hosts should be
-// HSTS as long as they're on the preload list, however).
-function run_test() {
-  let SSService = Cc["@mozilla.org/ssservice;1"]
-                    .getService(Ci.nsISiteSecurityService);
-  ok(!SSService.isSecureHost(Ci.nsISiteSecurityService.HEADER_HSTS,
-                             "chart.apis.google.com", 0));
-  ok(!SSService.isSecureHost(Ci.nsISiteSecurityService.HEADER_HSTS,
-                             "CHART.APIS.GOOGLE.COM", 0));
-  ok(!SSService.isSecureHost(Ci.nsISiteSecurityService.HEADER_HSTS,
-                             "sub.chart.apis.google.com", 0));
-  ok(!SSService.isSecureHost(Ci.nsISiteSecurityService.HEADER_HSTS,
-                             "SUB.CHART.APIS.GOOGLE.COM", 0));
-  ok(SSService.isSecureHost(Ci.nsISiteSecurityService.HEADER_HSTS,
-                            "example.apis.google.com", 0));
-  ok(SSService.isSecureHost(Ci.nsISiteSecurityService.HEADER_HSTS,
-                            "EXAMPLE.APIS.GOOGLE.COM", 0));
-  ok(SSService.isSecureHost(Ci.nsISiteSecurityService.HEADER_HSTS,
-                            "sub.example.apis.google.com", 0));
-  ok(SSService.isSecureHost(Ci.nsISiteSecurityService.HEADER_HSTS,
-                            "SUB.EXAMPLE.APIS.GOOGLE.COM", 0));
-  // also check isSecureURI
-  let chartURI = Services.io.newURI("http://chart.apis.google.com", null, null);
-  ok(!SSService.isSecureURI(Ci.nsISiteSecurityService.HEADER_HSTS, chartURI, 0));
-  let otherURI = Services.io.newURI("http://other.apis.google.com", null, null);
-  ok(SSService.isSecureURI(Ci.nsISiteSecurityService.HEADER_HSTS, otherURI, 0));
-}
diff --git a/security/manager/ssl/tests/unit/xpcshell.ini b/security/manager/ssl/tests/unit/xpcshell.ini
index bdf9933f4..01384b19a 100644
--- a/security/manager/ssl/tests/unit/xpcshell.ini
+++ b/security/manager/ssl/tests/unit/xpcshell.ini
@@ -26,7 +26,6 @@ support-files =
   test_ocsp_fetch_method/**
   test_ocsp_url/**
   test_onecrl/**
-  test_pinning_dynamic/**
   test_signed_apps/**
   test_signed_dir/**
   test_startcom_wosign/**
@@ -111,13 +110,6 @@ run-sequentially = hardcoded ports
 [test_ocsp_url.js]
 run-sequentially = hardcoded ports
 [test_password_prompt.js]
-[test_pinning.js]
-run-sequentially = hardcoded ports
-# This test can take longer than 300 seconds on B2G emulator debug builds, so
-# give it enough time to finish. See bug 1081128.
-requesttimeoutfactor = 2
-[test_pinning_dynamic.js]
-[test_pinning_header_parsing.js]
 [test_sdr.js]
 [test_session_resumption.js]
 run-sequentially = hardcoded ports
@@ -137,7 +129,6 @@ skip-if = toolkit == 'android'
 [test_sss_savestate.js]
 [test_startcom_wosign.js]
 [test_sts_fqdn.js]
-[test_sts_holepunch.js]
 [test_sts_ipv4_ipv6.js]
 [test_sts_preloadlist_perwindowpb.js]
 [test_sts_preloadlist_selfdestruct.js]
diff --git a/security/manager/tools/PreloadedHPKPins.json b/security/manager/tools/PreloadedHPKPins.json
deleted file mode 100644
index d9c394a1d..000000000
--- a/security/manager/tools/PreloadedHPKPins.json
+++ /dev/null
@@ -1,222 +0,0 @@
-// -*- Mode: javascript; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*-
-// This Source Code Form is subject to the terms of the Mozilla Public
-// License, v. 2.0. If a copy of the MPL was not distributed with this
-// file, You can obtain one at http://mozilla.org/MPL/2.0/.
-
-// The top-level element is a dictionary with two keys: "pinsets" maps details
-// of certificate pinning to a name and "entries" contains the HPKP details for
-// each host.
-//
-// "pinsets" is a list of objects. Each object has the following members:
-//   name: (string) the name of the pinset
-//   sha256_hashes: (list of strings) the set of allowed SPKIs hashes
-//
-// For a given pinset, a certificate is accepted if at least one of the
-// Subject Public Key Infos (SPKIs) is found in the chain.  SPKIs are specified
-// as names, which must match up with the name given in the Mozilla root store.
-//
-// "entries" is a list of objects. Each object has the following members:
-//   name: (string) the DNS name of the host in question
-//   include_subdomains: (optional bool) whether subdomains of |name| are also covered
-//   pins: (string) the |name| member of an object in |pinsets|
-//
-// "extra_certs" is a list of base64-encoded certificates. These are used in
-// pinsets that reference certificates not in our root program (for example,
-// Facebook).
-
-// equifax -> aus3
-// Geotrust Primary -> www.mozilla.org
-// Geotrust Global -> *. addons.mozilla.org
-{
-  "chromium_data" : {
-    "cert_file_url": "https://chromium.googlesource.com/chromium/src/net/+/master/http/transport_security_state_static.pins?format=TEXT",
-    "json_file_url": "https://chromium.googlesource.com/chromium/src/net/+/master/http/transport_security_state_static.json?format=TEXT",
-    "substitute_pinsets": {
-      // Use the larger google_root_pems pinset instead of google
-      "google": "google_root_pems"
-    },
-    "production_pinsets": [
-      "google_root_pems",
-      "facebook"
-    ],
-    "production_domains": [
-      // Chrome's test domains.
-      "pinningtest.appspot.com",
-      "pinning-test.badssl.com",
-      // Dropbox
-      "dropbox.com",
-      "www.dropbox.com",
-      // Twitter
-      "api.twitter.com",
-      "business.twitter.com",
-      "dev.twitter.com",
-      "mobile.twitter.com",
-      "oauth.twitter.com",
-      "platform.twitter.com",
-      "twimg.com",
-      "www.twitter.com",
-      // Tor
-      "torproject.org",
-      "blog.torproject.org",
-      "check.torproject.org",
-      "dist.torproject.org",
-      "www.torproject.org",
-      // SpiderOak
-      "spideroak.com"
-    ],
-    "exclude_domains" : [
-      // Chrome's entry for twitter.com doesn't include subdomains, so replace
-      // it with our own entry below which also uses an expanded pinset.
-      "twitter.com"
-    ]
-   },
-  "pinsets": [
-    {
-      // From bug 772756, mozilla uses GeoTrust, Digicert and Thawte.  Our
-      // cdn sites use Verisign and Baltimore. We exclude 1024-bit root certs
-      // from all providers. geotrust ca info:
-      // http://www.geotrust.com/resources/root-certificates/index.html
-      "name": "mozilla",
-      "sha256_hashes": [
-        "Baltimore CyberTrust Root",
-        "DigiCert Assured ID Root CA",
-        "DigiCert Global Root CA",
-        "DigiCert High Assurance EV Root CA",
-        "GeoTrust Global CA",
-        "GeoTrust Global CA 2",
-        "GeoTrust Primary Certification Authority",
-        "GeoTrust Primary Certification Authority - G2",
-        "GeoTrust Primary Certification Authority - G3",
-        "GeoTrust Universal CA",
-        "GeoTrust Universal CA 2",
-        "thawte Primary Root CA",
-        "thawte Primary Root CA - G2",
-        "thawte Primary Root CA - G3",
-        "Verisign Class 1 Public Primary Certification Authority - G3",
-        "Verisign Class 2 Public Primary Certification Authority - G3",
-        "Verisign Class 3 Public Primary Certification Authority - G3",
-        "VeriSign Class 3 Public Primary Certification Authority - G4",
-        "VeriSign Class 3 Public Primary Certification Authority - G5",
-        // "Verisign Class 4 Public Primary Certification Authority - G3",
-        "VeriSign Universal Root Certification Authority"
-      ]
-    },
-    {
-      "name": "mozilla_services",
-      "sha256_hashes": [
-        "DigiCert Global Root CA"
-      ]
-    },
-    // For pinning tests on pinning.example.com, the certificate must be 'End
-    // Entity Test Cert'
-    {
-      "name": "mozilla_test",
-      "sha256_hashes": [
-        "End Entity Test Cert"
-      ]
-    },
-    // Google's root PEMs. Chrome pins only to their intermediate certs, but
-    // they'd like us to be more liberal. For the initial list, we are using
-    // the certs from http://pki.google.com/roots.pem.
-    // We have no built-in for commented out CAs.
-    {
-      "name": "google_root_pems",
-      "sha256_hashes": [
-        "AddTrust External Root",
-        "AddTrust Low-Value Services Root",
-        "AddTrust Public Services Root",
-        "AddTrust Qualified Certificates Root",
-        "AffirmTrust Commercial",
-        "AffirmTrust Networking",
-        "AffirmTrust Premium",
-        "AffirmTrust Premium ECC",
-        "Baltimore CyberTrust Root",
-        "Comodo AAA Services root",
-        "COMODO Certification Authority",
-        "COMODO ECC Certification Authority",
-        "COMODO RSA Certification Authority",
-        "Comodo Secure Services root",
-        "Comodo Trusted Services root",
-        "Cybertrust Global Root",
-        "DigiCert Assured ID Root CA",
-        "DigiCert Assured ID Root G2",
-        "DigiCert Assured ID Root G3",
-        "DigiCert Global Root CA",
-        "DigiCert Global Root G2",
-        "DigiCert Global Root G3",
-        "DigiCert High Assurance EV Root CA",
-        "DigiCert Trusted Root G4",
-        "Entrust Root Certification Authority",
-        "Entrust Root Certification Authority - EC1",
-        "Entrust Root Certification Authority - G2",
-        "Entrust.net Premium 2048 Secure Server CA",
-        // "Equifax Secure Certificate Authority",
-        "GeoTrust Global CA",
-        "GeoTrust Global CA 2",
-        "GeoTrust Primary Certification Authority",
-        "GeoTrust Primary Certification Authority - G2",
-        "GeoTrust Primary Certification Authority - G3",
-        "GeoTrust Universal CA",
-        "GeoTrust Universal CA 2",
-        "GlobalSign ECC Root CA - R4",
-        "GlobalSign ECC Root CA - R5",
-        "GlobalSign Root CA",
-        "GlobalSign Root CA - R2",
-        "GlobalSign Root CA - R3",
-        "Go Daddy Class 2 CA",
-        "Go Daddy Root Certificate Authority - G2",
-        "Starfield Class 2 CA",
-        "Starfield Root Certificate Authority - G2",
-        "thawte Primary Root CA",
-        "thawte Primary Root CA - G2",
-        "thawte Primary Root CA - G3",
-        "USERTrust ECC Certification Authority",
-        "USERTrust RSA Certification Authority",
-        "UTN USERFirst Hardware Root CA",
-        "Verisign Class 3 Public Primary Certification Authority - G3",
-        "VeriSign Class 3 Public Primary Certification Authority - G4",
-        "VeriSign Class 3 Public Primary Certification Authority - G5",
-        "VeriSign Universal Root Certification Authority"
-      ]
-    }
-  ],
-
-  "entries": [
-    // Only domains that are operationally crucial to Firefox can have per-host
-    // telemetry reporting (the "id") field
-    { "name": "addons.mozilla.org", "include_subdomains": true,
-      "pins": "mozilla", "test_mode": false, "id": 1 },
-    { "name": "addons.mozilla.net", "include_subdomains": true,
-      "pins": "mozilla", "test_mode": false, "id": 2 },
-    { "name": "aus4.mozilla.org", "include_subdomains": true,
-      "pins": "mozilla", "test_mode": true, "id": 3 },
-    { "name": "accounts.firefox.com", "include_subdomains": true,
-      "pins": "mozilla_services", "test_mode": false, "id": 4 },
-    { "name": "api.accounts.firefox.com", "include_subdomains": true,
-      "pins": "mozilla_services", "test_mode": false, "id": 5 },
-    { "name": "cdn.mozilla.net", "include_subdomains": true,
-      "pins": "mozilla", "test_mode": false },
-    { "name": "cdn.mozilla.org", "include_subdomains": true,
-      "pins": "mozilla", "test_mode": false },
-    { "name": "services.mozilla.com", "include_subdomains": true,
-      "pins": "mozilla_services", "test_mode": false, "id": 6 },
-    { "name": "include-subdomains.pinning.example.com",
-      "include_subdomains": true, "pins": "mozilla_test",
-      "test_mode": false },
-    // Example domain to collect per-host stats for telemetry tests.
-    { "name": "exclude-subdomains.pinning.example.com",
-      "include_subdomains": false, "pins": "mozilla_test",
-      "test_mode": false, "id": 0 },
-    { "name": "test-mode.pinning.example.com", "include_subdomains": true,
-      "pins": "mozilla_test", "test_mode": true },
-    // Expand twitter's pinset to include all of *.twitter.com and use
-    // twitterCDN. More specific rules take precedence because we search for
-    // exact domain name first.
-    { "name": "twitter.com", "include_subdomains": true,
-      "pins": "twitterCDN", "test_mode": false },
-    { "name": "aus5.mozilla.org", "include_subdomains": true,
-      "pins": "mozilla", "test_mode": true, "id": 7 }
-  ],
-
-  "extra_certificates": []
-}
diff --git a/security/manager/tools/genHPKPStaticPins.js b/security/manager/tools/genHPKPStaticPins.js
deleted file mode 100644
index f2b9dbdda..000000000
--- a/security/manager/tools/genHPKPStaticPins.js
+++ /dev/null
@@ -1,630 +0,0 @@
-/* This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-// How to run this file:
-// 1. [obtain firefox source code]
-// 2. [build/obtain firefox binaries]
-// 3. run `[path to]/run-mozilla.sh [path to]/xpcshell \
-//                                  [path to]/genHPKPStaticpins.js \
-//                                  [absolute path to]/PreloadedHPKPins.json \
-//                                  [an unused argument - see bug 1205406] \
-//                                  [absolute path to]/StaticHPKPins.h
-"use strict";
-
-if (arguments.length != 3) {
-  throw new Error("Usage: genHPKPStaticPins.js " +
-                  "<absolute path to PreloadedHPKPins.json> " +
-                  "<an unused argument - see bug 1205406> " +
-                  "<absolute path to StaticHPKPins.h>");
-}
-
-var { 'classes': Cc, 'interfaces': Ci, 'utils': Cu, 'results': Cr } = Components;
-
-var { NetUtil } = Cu.import("resource://gre/modules/NetUtil.jsm", {});
-var { FileUtils } = Cu.import("resource://gre/modules/FileUtils.jsm", {});
-var { Services } = Cu.import("resource://gre/modules/Services.jsm", {});
-
-var gCertDB = Cc["@mozilla.org/security/x509certdb;1"]
-                .getService(Ci.nsIX509CertDB);
-
-const BUILT_IN_NICK_PREFIX = "Builtin Object Token:";
-const SHA256_PREFIX = "sha256/";
-const GOOGLE_PIN_PREFIX = "GOOGLE_PIN_";
-
-// Pins expire in 14 weeks (6 weeks on Beta + 8 weeks on stable)
-const PINNING_MINIMUM_REQUIRED_MAX_AGE = 60 * 60 * 24 * 7 * 14;
-
-const FILE_HEADER = "/* This Source Code Form is subject to the terms of the Mozilla Public\n" +
-" * License, v. 2.0. If a copy of the MPL was not distributed with this\n" +
-" * file, You can obtain one at http://mozilla.org/MPL/2.0/. */\n" +
-"\n" +
-"/*****************************************************************************/\n" +
-"/* This is an automatically generated file. If you're not                    */\n" +
-"/* PublicKeyPinningService.cpp, you shouldn't be #including it.              */\n" +
-"/*****************************************************************************/\n" +
-"#include <stdint.h>" +
-"\n";
-
-const DOMAINHEADER = "/* Domainlist */\n" +
-  "struct TransportSecurityPreload {\n" +
-  "  const char* mHost;\n" +
-  "  const bool mIncludeSubdomains;\n" +
-  "  const bool mTestMode;\n" +
-  "  const bool mIsMoz;\n" +
-  "  const int32_t mId;\n" +
-  "  const StaticFingerprints* pinset;\n" +
-  "};\n\n";
-
-const PINSETDEF = "/* Pinsets are each an ordered list by the actual value of the fingerprint */\n" +
-  "struct StaticFingerprints {\n" +
-  "  const size_t size;\n" +
-  "  const char* const* data;\n" +
-  "};\n\n";
-
-// Command-line arguments
-var gStaticPins = parseJson(arguments[0]);
-
-// arguments[1] is ignored for now. See bug 1205406.
-
-// Open the output file.
-var file = Cc["@mozilla.org/file/local;1"].createInstance(Ci.nsILocalFile);
-file.initWithPath(arguments[2]);
-var gFileOutputStream = FileUtils.openSafeFileOutputStream(file);
-
-function writeString(string) {
-  gFileOutputStream.write(string, string.length);
-}
-
-function readFileToString(filename) {
-  let file = Cc["@mozilla.org/file/local;1"].createInstance(Ci.nsILocalFile);
-  file.initWithPath(filename);
-  let stream = Cc["@mozilla.org/network/file-input-stream;1"]
-                 .createInstance(Ci.nsIFileInputStream);
-  stream.init(file, -1, 0, 0);
-  let buf = NetUtil.readInputStreamToString(stream, stream.available());
-  return buf;
-}
-
-function stripComments(buf) {
-  let lines = buf.split("\n");
-  let entryRegex = /^\s*\/\//;
-  let data = "";
-  for (let i = 0; i < lines.length; ++i) {
-    let match = entryRegex.exec(lines[i]);
-    if (!match) {
-      data = data + lines[i];
-    }
-  }
-  return data;
-}
-
-function isBuiltinToken(tokenName) {
-  return tokenName == "Builtin Object Token";
-}
-
-function isCertBuiltIn(cert) {
-  let tokenNames = cert.getAllTokenNames({});
-  if (!tokenNames) {
-    return false;
-  }
-  if (tokenNames.some(isBuiltinToken)) {
-    return true;
-  }
-  return false;
-}
-
-function download(filename) {
-  let req = Cc["@mozilla.org/xmlextras/xmlhttprequest;1"]
-              .createInstance(Ci.nsIXMLHttpRequest);
-  req.open("GET", filename, false); // doing the request synchronously
-  try {
-    req.send();
-  }
-  catch (e) {
-    throw new Error(`ERROR: problem downloading '${filename}': ${e}`);
-  }
-
-  if (req.status != 200) {
-    throw new Error("ERROR: problem downloading '" + filename + "': status " +
-                    req.status);
-  }
-
-  let resultDecoded;
-  try {
-    resultDecoded = atob(req.responseText);
-  }
-  catch (e) {
-    throw new Error("ERROR: could not decode data as base64 from '" + filename +
-                    "': " + e);
-  }
-  return resultDecoded;
-}
-
-function downloadAsJson(filename) {
-  // we have to filter out '//' comments, while not mangling the json
-  let result = download(filename).replace(/^(\s*)?\/\/[^\n]*\n/mg, "");
-  let data = null;
-  try {
-    data = JSON.parse(result);
-  }
-  catch (e) {
-    throw new Error("ERROR: could not parse data from '" + filename + "': " + e);
-  }
-  return data;
-}
-
-// Returns a Subject Public Key Digest from the given pem, if it exists.
-function getSKDFromPem(pem) {
-  let cert = gCertDB.constructX509FromBase64(pem, pem.length);
-  return cert.sha256SubjectPublicKeyInfoDigest;
-}
-
-/**
- * Hashes |input| using the SHA-256 algorithm in the following manner:
- *   btoa(sha256(atob(input)))
- *
- * @argument {String} input Base64 string to decode and return the hash of.
- * @returns {String} Base64 encoded SHA-256 hash.
- */
-function sha256Base64(input) {
-  let decodedValue;
-  try {
-    decodedValue = atob(input);
-  }
-  catch (e) {
-    throw new Error(`ERROR: could not decode as base64: '${input}': ${e}`);
-  }
-
-  // Convert |decodedValue| to an array so that it can be hashed by the
-  // nsICryptoHash instance below.
-  // In most cases across the code base, convertToByteArray() of
-  // nsIScriptableUnicodeConverter is used to do this, but the method doesn't
-  // seem to work here.
-  let data = [];
-  for (let i = 0; i < decodedValue.length; i++) {
-    data[i] = decodedValue.charCodeAt(i);
-  }
-
-  let hasher = Cc["@mozilla.org/security/hash;1"]
-                 .createInstance(Ci.nsICryptoHash);
-  hasher.init(hasher.SHA256);
-  hasher.update(data, data.length);
-
-  // true is passed so that the hasher returns a Base64 encoded string.
-  return hasher.finish(true);
-}
-
-// Downloads the static certs file and tries to map Google Chrome nicknames
-// to Mozilla nicknames, as well as storing any hashes for pins for which we
-// don't have root PEMs. Each entry consists of a line containing the name of
-// the pin followed either by a hash in the format "sha256/" + base64(hash),
-// a PEM encoded public key, or a PEM encoded certificate.
-// For certificates that we have in our database,
-// return a map of Google's nickname to ours. For ones that aren't return a
-// map of Google's nickname to SHA-256 values. This code is modeled after agl's
-// https://github.com/agl/transport-security-state-generate, which doesn't
-// live in the Chromium repo because go is not an official language in
-// Chromium.
-// For all of the entries in this file:
-// - If the entry has a hash format, find the Mozilla pin name (cert nickname)
-// and stick the hash into certSKDToName
-// - If the entry has a PEM format, parse the PEM, find the Mozilla pin name
-// and stick the hash in certSKDToName
-// We MUST be able to find a corresponding cert nickname for the Chrome names,
-// otherwise we skip all pinsets referring to that Chrome name.
-function downloadAndParseChromeCerts(filename, certNameToSKD, certSKDToName) {
-  // Prefixes that we care about.
-  const BEGIN_CERT = "-----BEGIN CERTIFICATE-----";
-  const END_CERT = "-----END CERTIFICATE-----";
-  const BEGIN_PUB_KEY = "-----BEGIN PUBLIC KEY-----";
-  const END_PUB_KEY = "-----END PUBLIC KEY-----";
-
-  // Parsing states.
-  const PRE_NAME = 0;
-  const POST_NAME = 1;
-  const IN_CERT = 2;
-  const IN_PUB_KEY = 3;
-  let state = PRE_NAME;
-
-  let lines = download(filename).split("\n");
-  let name = "";
-  let pemCert = "";
-  let pemPubKey = "";
-  let hash = "";
-  let chromeNameToHash = {};
-  let chromeNameToMozName = {};
-  let chromeName;
-  for (let line of lines) {
-    // Skip comments and newlines.
-    if (line.length == 0 || line[0] == '#') {
-      continue;
-    }
-    switch (state) {
-      case PRE_NAME:
-        chromeName = line;
-        state = POST_NAME;
-        break;
-      case POST_NAME:
-        if (line.startsWith(SHA256_PREFIX)) {
-          hash = line.substring(SHA256_PREFIX.length);
-          chromeNameToHash[chromeName] = hash;
-          certNameToSKD[chromeName] = hash;
-          certSKDToName[hash] = chromeName;
-          state = PRE_NAME;
-        } else if (line.startsWith(BEGIN_CERT)) {
-          state = IN_CERT;
-        } else if (line.startsWith(BEGIN_PUB_KEY)) {
-          state = IN_PUB_KEY;
-        } else {
-          throw new Error("ERROR: couldn't parse Chrome certificate file " +
-                          "line: " + line);
-        }
-        break;
-      case IN_CERT:
-        if (line.startsWith(END_CERT)) {
-          state = PRE_NAME;
-          hash = getSKDFromPem(pemCert);
-          pemCert = "";
-          let mozName;
-          if (hash in certSKDToName) {
-            mozName = certSKDToName[hash];
-          } else {
-            // Not one of our built-in certs. Prefix the name with
-            // GOOGLE_PIN_.
-            mozName = GOOGLE_PIN_PREFIX + chromeName;
-            dump("Can't find hash in builtin certs for Chrome nickname " +
-                 chromeName + ", inserting " + mozName + "\n");
-            certSKDToName[hash] = mozName;
-            certNameToSKD[mozName] = hash;
-          }
-          chromeNameToMozName[chromeName] = mozName;
-        } else {
-          pemCert += line;
-        }
-        break;
-      case IN_PUB_KEY:
-        if (line.startsWith(END_PUB_KEY)) {
-          state = PRE_NAME;
-          hash = sha256Base64(pemPubKey);
-          pemPubKey = "";
-          chromeNameToHash[chromeName] = hash;
-          certNameToSKD[chromeName] = hash;
-          certSKDToName[hash] = chromeName;
-        } else {
-          pemPubKey += line;
-        }
-        break;
-      default:
-        throw new Error("ERROR: couldn't parse Chrome certificate file " + line);
-    }
-  }
-  return [ chromeNameToHash, chromeNameToMozName ];
-}
-
-// We can only import pinsets from chrome if for every name in the pinset:
-// - We have a hash from Chrome's static certificate file
-// - We have a builtin cert
-// If the pinset meets these requirements, we store a map array of pinset
-// objects:
-// {
-//   pinset_name : {
-//     // Array of names with entries in certNameToSKD
-//     sha256_hashes: []
-//   }
-// }
-// and an array of imported pinset entries:
-// { name: string, include_subdomains: boolean, test_mode: boolean,
-//   pins: pinset_name }
-function downloadAndParseChromePins(filename,
-                                    chromeNameToHash,
-                                    chromeNameToMozName,
-                                    certNameToSKD,
-                                    certSKDToName) {
-  let chromePreloads = downloadAsJson(filename);
-  let chromePins = chromePreloads.pinsets;
-  let chromeImportedPinsets = {};
-  let chromeImportedEntries = [];
-
-  chromePins.forEach(function(pin) {
-    let valid = true;
-    let pinset = { name: pin.name, sha256_hashes: [] };
-    // Translate the Chrome pinset format to ours
-    pin.static_spki_hashes.forEach(function(name) {
-      if (name in chromeNameToHash) {
-        let hash = chromeNameToHash[name];
-        pinset.sha256_hashes.push(certSKDToName[hash]);
-
-        // We should have already added hashes for all of these when we
-        // imported the certificate file.
-        if (!certNameToSKD[name]) {
-          throw new Error("ERROR: No hash for name: " + name);
-        }
-      } else if (name in chromeNameToMozName) {
-        pinset.sha256_hashes.push(chromeNameToMozName[name]);
-      } else {
-        dump("Skipping Chrome pinset " + pinset.name + ", couldn't find " +
-             "builtin " + name + " from cert file\n");
-        valid = false;
-      }
-    });
-    if (valid) {
-      chromeImportedPinsets[pinset.name] = pinset;
-    }
-  });
-
-  // Grab the domain entry lists. Chrome's entry format is similar to
-  // ours, except theirs includes a HSTS mode.
-  const cData = gStaticPins.chromium_data;
-  let entries = chromePreloads.entries;
-  entries.forEach(function(entry) {
-    // HSTS entry only
-    if (!entry.pins) {
-      return;
-    }
-    let pinsetName = cData.substitute_pinsets[entry.pins];
-    if (!pinsetName) {
-      pinsetName = entry.pins;
-    }
-
-    // We trim the entry name here to avoid breaking hostname comparisons in the
-    // HPKP implementation.
-    entry.name = entry.name.trim();
-
-    let isProductionDomain =
-      (cData.production_domains.indexOf(entry.name) != -1);
-    let isProductionPinset =
-      (cData.production_pinsets.indexOf(pinsetName) != -1);
-    let excludeDomain =
-      (cData.exclude_domains.indexOf(entry.name) != -1);
-    let isTestMode = !isProductionPinset && !isProductionDomain;
-    if (entry.pins && !excludeDomain && chromeImportedPinsets[entry.pins]) {
-      chromeImportedEntries.push({
-        name: entry.name,
-        include_subdomains: entry.include_subdomains,
-        test_mode: isTestMode,
-        is_moz: false,
-        pins: pinsetName });
-    }
-  });
-  return [ chromeImportedPinsets, chromeImportedEntries ];
-}
-
-// Returns a pair of maps [certNameToSKD, certSKDToName] between cert
-// nicknames and digests of the SPKInfo for the mozilla trust store
-function loadNSSCertinfo(extraCertificates) {
-  let allCerts = gCertDB.getCerts();
-  let enumerator = allCerts.getEnumerator();
-  let certNameToSKD = {};
-  let certSKDToName = {};
-  while (enumerator.hasMoreElements()) {
-    let cert = enumerator.getNext().QueryInterface(Ci.nsIX509Cert);
-    if (!isCertBuiltIn(cert)) {
-      continue;
-    }
-    let name = cert.nickname.substr(BUILT_IN_NICK_PREFIX.length);
-    let SKD = cert.sha256SubjectPublicKeyInfoDigest;
-    certNameToSKD[name] = SKD;
-    certSKDToName[SKD] = name;
-  }
-
-  for (let cert of extraCertificates) {
-    let name = cert.commonName;
-    let SKD = cert.sha256SubjectPublicKeyInfoDigest;
-    certNameToSKD[name] = SKD;
-    certSKDToName[SKD] = name;
-  }
-
-  {
-    // This is the pinning test certificate. The key hash identifies the
-    // default RSA key from pykey.
-    let name = "End Entity Test Cert";
-    let SKD = "VCIlmPM9NkgFQtrs4Oa5TeFcDu6MWRTKSNdePEhOgD8=";
-    certNameToSKD[name] = SKD;
-    certSKDToName[SKD] = name;
-  }
-  return [certNameToSKD, certSKDToName];
-}
-
-function parseJson(filename) {
-  let json = stripComments(readFileToString(filename));
-  return JSON.parse(json);
-}
-
-function nameToAlias(certName) {
-  // change the name to a string valid as a c identifier
-  // remove  non-ascii characters
-  certName = certName.replace(/[^[:ascii:]]/g, "_");
-  // replace non word characters
-  certName = certName.replace(/[^A-Za-z0-9]/g, "_");
-
-  return "k" + certName + "Fingerprint";
-}
-
-function compareByName (a, b) {
-  return a.name.localeCompare(b.name);
-}
-
-function genExpirationTime() {
-  let now = new Date();
-  let nowMillis = now.getTime();
-  let expirationMillis = nowMillis + (PINNING_MINIMUM_REQUIRED_MAX_AGE * 1000);
-  let expirationMicros = expirationMillis * 1000;
-  return "static const PRTime kPreloadPKPinsExpirationTime = INT64_C(" +
-         expirationMicros + ");\n";
-}
-
-function writeFullPinset(certNameToSKD, certSKDToName, pinset) {
-  let prefix = "kPinset_" + pinset.name;
-  if (!pinset.sha256_hashes || pinset.sha256_hashes.length == 0) {
-    throw new Error(`ERROR: Pinset ${pinset.name} does not contain any hashes`);
-  }
-  writeFingerprints(certNameToSKD, certSKDToName, pinset.name,
-                    pinset.sha256_hashes);
-}
-
-function writeFingerprints(certNameToSKD, certSKDToName, name, hashes) {
-  let varPrefix = "kPinset_" + name;
-  writeString("static const char* const " + varPrefix + "_Data[] = {\n");
-  let SKDList = [];
-  for (let certName of hashes) {
-    if (!(certName in certNameToSKD)) {
-      throw new Error(`ERROR: Can't find '${certName}' in certNameToSKD`);
-    }
-    SKDList.push(certNameToSKD[certName]);
-  }
-  for (let skd of SKDList.sort()) {
-    writeString("  " + nameToAlias(certSKDToName[skd]) + ",\n");
-  }
-  if (hashes.length == 0) {
-    // ANSI C requires that an initialiser list be non-empty.
-    writeString("  0\n");
-  }
-  writeString("};\n");
-  writeString("static const StaticFingerprints " + varPrefix + " = {\n  " +
-    "sizeof(" + varPrefix + "_Data) / sizeof(const char*),\n  " + varPrefix +
-    "_Data\n};\n\n");
-}
-
-function writeEntry(entry) {
-  let printVal = "  { \"" + entry.name + "\",\ ";
-  if (entry.include_subdomains) {
-    printVal += "true, ";
-  } else {
-    printVal += "false, ";
-  }
-  // Default to test mode if not specified.
-  let testMode = true;
-  if (entry.hasOwnProperty("test_mode")) {
-    testMode = entry.test_mode;
-  }
-  if (testMode) {
-    printVal += "true, ";
-  } else {
-    printVal += "false, ";
-  }
-  if (entry.is_moz || (entry.pins.indexOf("mozilla") != -1 &&
-                       entry.pins != "mozilla_test")) {
-    printVal += "true, ";
-  } else {
-    printVal += "false, ";
-  }
-  if ("id" in entry) {
-    if (entry.id >= 256) {
-      throw new Error("ERROR: Not enough buckets in histogram");
-    }
-    if (entry.id >= 0) {
-      printVal += entry.id + ", ";
-    }
-  } else {
-    printVal += "-1, ";
-  }
-  printVal += "&kPinset_" + entry.pins;
-  printVal += " },\n";
-  writeString(printVal);
-}
-
-function writeDomainList(chromeImportedEntries) {
-  writeString("/* Sort hostnames for binary search. */\n");
-  writeString("static const TransportSecurityPreload " +
-          "kPublicKeyPinningPreloadList[] = {\n");
-  let count = 0;
-  let mozillaDomains = {};
-  gStaticPins.entries.forEach(function(entry) {
-    mozillaDomains[entry.name] = true;
-  });
-  // For any domain for which we have set pins, exclude them from
-  // chromeImportedEntries.
-  for (let i = chromeImportedEntries.length - 1; i >= 0; i--) {
-    if (mozillaDomains[chromeImportedEntries[i].name]) {
-      dump("Skipping duplicate pinset for domain " +
-           JSON.stringify(chromeImportedEntries[i], undefined, 2) + "\n");
-      chromeImportedEntries.splice(i, 1);
-    }
-  }
-  let sortedEntries = gStaticPins.entries;
-  sortedEntries.push.apply(sortedEntries, chromeImportedEntries);
-  for (let entry of sortedEntries.sort(compareByName)) {
-    count++;
-    writeEntry(entry);
-  }
-  writeString("};\n");
-
-  writeString("\n// Pinning Preload List Length = " + count + ";\n");
-  writeString("\nstatic const int32_t kUnknownId = -1;\n");
-}
-
-function writeFile(certNameToSKD, certSKDToName,
-                   chromeImportedPinsets, chromeImportedEntries) {
-  // Compute used pins from both Chrome's and our pinsets, so we can output
-  // them later.
-  let usedFingerprints = {};
-  let mozillaPins = {};
-  gStaticPins.pinsets.forEach(function(pinset) {
-    mozillaPins[pinset.name] = true;
-    pinset.sha256_hashes.forEach(function (name) {
-      usedFingerprints[name] = true;
-    });
-  });
-  for (let key in chromeImportedPinsets) {
-    let pinset = chromeImportedPinsets[key];
-    pinset.sha256_hashes.forEach(function(name) {
-      usedFingerprints[name] = true;
-    });
-  }
-
-  writeString(FILE_HEADER);
-
-  // Write actual fingerprints.
-  Object.keys(usedFingerprints).sort().forEach(function(certName) {
-    if (certName) {
-      writeString("/* " + certName + " */\n");
-      writeString("static const char " + nameToAlias(certName) + "[] =\n");
-      writeString("  \"" + certNameToSKD[certName] + "\";\n");
-      writeString("\n");
-    }
-  });
-
-  // Write the pinsets
-  writeString(PINSETDEF);
-  writeString("/* PreloadedHPKPins.json pinsets */\n");
-  gStaticPins.pinsets.sort(compareByName).forEach(function(pinset) {
-    writeFullPinset(certNameToSKD, certSKDToName, pinset);
-  });
-  writeString("/* Chrome static pinsets */\n");
-  for (let key in chromeImportedPinsets) {
-    if (mozillaPins[key]) {
-      dump("Skipping duplicate pinset " + key + "\n");
-    } else {
-      dump("Writing pinset " + key + "\n");
-      writeFullPinset(certNameToSKD, certSKDToName, chromeImportedPinsets[key]);
-    }
-  }
-
-  // Write the domainlist entries.
-  writeString(DOMAINHEADER);
-  writeDomainList(chromeImportedEntries);
-  writeString("\n");
-  writeString(genExpirationTime());
-}
-
-function loadExtraCertificates(certStringList) {
-  let constructedCerts = [];
-  for (let certString of certStringList) {
-    constructedCerts.push(gCertDB.constructX509FromBase64(certString));
-  }
-  return constructedCerts;
-}
-
-var extraCertificates = loadExtraCertificates(gStaticPins.extra_certificates);
-var [ certNameToSKD, certSKDToName ] = loadNSSCertinfo(extraCertificates);
-var [ chromeNameToHash, chromeNameToMozName ] = downloadAndParseChromeCerts(
-  gStaticPins.chromium_data.cert_file_url, certNameToSKD, certSKDToName);
-var [ chromeImportedPinsets, chromeImportedEntries ] =
-  downloadAndParseChromePins(gStaticPins.chromium_data.json_file_url,
-    chromeNameToHash, chromeNameToMozName, certNameToSKD, certSKDToName);
-
-writeFile(certNameToSKD, certSKDToName, chromeImportedPinsets,
-          chromeImportedEntries);
-
-FileUtils.closeSafeFileOutputStream(gFileOutputStream);