system/freebsd-src
system/freebsd-src
1
0
Fork 0
mirror of https://github.com/freebsd/freebsd-src synced 2024-10-04 15:40:44 +00:00
Code Issues Packages Projects Releases Wiki Activity
freebsd-src/secure/caroot
History
Kyle Evans 62aaa70143 caroot: cumulative cert update 
This adds a note in all existing certs that they are explicitly trusted
for server auth, and also:

- Seven (7) added
- Nineteen (19) removed

(cherry picked from commit 446169e0b6)
(cherry picked from commit 3016c5c2bf)
(cherry picked from commit fac832b271)
(cherry picked from commit 76461921da)
2021-09-04 02:39:07 -05:00
..
blacklisted caroot: cumulative cert update 2021-09-04 02:39:07 -05:00
trusted caroot: cumulative cert update 2021-09-04 02:39:07 -05:00
MAca-bundle.pl caroot: update CA bundle processor 2021-09-04 02:38:53 -05:00
Makefile pkgbase: fix caroot packaging and add post-install script 2020-01-29 18:47:08 +00:00
Makefile.inc pkgbase: fix caroot packaging and add post-install script 2020-01-29 18:47:08 +00:00
README

README 

# $FreeBSD$

This directory contains the scripts to update the TLS CA Root Certificates
that comprise the 'root trust store'.

The 'updatecerts' make target should be run periodically by secteam@
specifically when there is an important change to the list of trusted root
certificates included by Mozilla.

It will:
	1) Remove the old trusted certificates (cleancerts)
	2) Download the latest certdata.txt from Mozilla (fetchcerts)
	3) Split certdata.txt into the individual .pem files (updatecerts)

Then the results should manually be inspected (svn status)
	1) Any no-longer-trusted certificates should be moved to the
	blacklisted directory (svn mv)
	2) any newly added certificates will need to be added (svn add)


The following make targets exist:

cleancerts:
	Delete the old certificates, run as a dependency of updatecerts.

fetchcerts:
	Download the latest certdata.txt from the Mozilla NSS hg repo
	See the changelog here:
		https://hg.mozilla.org/projects/nss/log/tip/lib/ckfw/builtins/certdata.txt

updatecerts:
	Runs a perl script (MAca-bundle.pl) on the downloaded certdata.txt
	to generate the individual certificate files (.pem) and store them
	in the trusted/ directory.