freebsd-src

mirror of https://github.com/freebsd/freebsd-src synced 2024-07-05 17:59:19 +00:00

History

Kyle Evans 0d3b2bdbf7 caroot: routine update Changes: - One (1) modified - Eight (8) added - One (1) expired, now untrusted MFC after: 3 days		2024-02-11 00:35:16 -06:00
..
trusted	caroot: routine update	2024-02-11 00:35:16 -06:00
untrusted	caroot: routine update	2024-02-11 00:35:16 -06:00
MAca-bundle.pl	caroot: drop VERSION tags from certs	2023-08-25 20:16:35 -05:00
Makefile	Remove $FreeBSD$: one-line sh pattern	2023-08-16 11:55:03 -06:00
Makefile.inc	Remove $FreeBSD$: one-line sh pattern	2023-08-16 11:55:03 -06:00
README	Remove $FreeBSD$: one-line sh pattern	2023-08-16 11:55:03 -06:00

README

This directory contains the scripts to update the TLS CA Root Certificates
that comprise the 'root trust store'.

The 'updatecerts' make target should be run periodically by secteam@
specifically when there is an important change to the list of trusted root
certificates included by Mozilla.

It will:
	1) Remove the old trusted certificates (cleancerts)
	2) Download the latest certdata.txt from Mozilla (fetchcerts)
	3) Split certdata.txt into the individual .pem files (updatecerts)

Then the results should manually be inspected (git status)
	1) Any no-longer-trusted certificates should be moved to the
	untrusted directory (git mv)
	2) any newly added certificates will need to be added (git add)


The following make targets exist:

cleancerts:
	Delete the old certificates, run as a dependency of updatecerts.

fetchcerts:
	Download the latest certdata.txt from the Mozilla NSS hg repo
	See the changelog here:
		https://hg.mozilla.org/projects/nss/log/tip/lib/ckfw/builtins/certdata.txt

updatecerts:
	Runs a perl script (MAca-bundle.pl) on the downloaded certdata.txt
	to generate the individual certificate files (.pem) and store them
	in the trusted/ directory.