openbsd/src/lib/libcrypto/cert.pem, branch OPENBSD_6_8_BASE A mirror of https://github.com/libressl/openbsd.git https://git.lua4.win/openbsd/atom?h=OPENBSD_6_8_BASE 2020-06-01T18:53:53+00:00 Remove expired certificate, ok tb@ 2020-06-01T18:53:53+00:00 sthen 2020-06-01T18:53:53+00:00 urn:sha1:09a2b91baf5db7bc9b25e377c750bc853528ce37 /C=SE/O=AddTrust AB/OU=AddTrust External TTP Network/CN=AddTrust External CA Root sync cert.pem with Mozilla's root ca list, ok beck@ 2020-04-10T12:13:17+00:00 sthen 2020-04-10T12:13:17+00:00 urn:sha1:678710fe8b84dce66a5a76351e75b47682b09285 update root CAs in cert.pem in sync with Mozilla 2019-04-04T12:42:01+00:00 sthen 2019-04-04T12:42:01+00:00 urn:sha1:851b71845fe694005a74fd062752d2cb0679a497 ok millert@ Regenerate root CA list using updated format-pem.pl. Specifically this 2018-12-16T12:08:32+00:00 sthen 2018-12-16T12:08:32+00:00 urn:sha1:59fc26dd77445f3e639280bc8f9bfa8d0ee0b95e drops CA certificates whose validity dates don't comply with the rules on ASN.1 encoding in RFC 5280 (and predecessors - same rule goes back to at least RFC 2459, section 4.1.2.5). LibreSSL strictly enforces this, so attempting to validate certificates signed by these CAs just result in the following: error 13 at 1 depth lookup:format error in certificate's notBefore field "probably" beck@ sync with mozilla-release (one removal, TURKTRUST, more details at 2018-09-12T22:17:08+00:00 sthen 2018-09-12T22:17:08+00:00 urn:sha1:0731e37042e0d53709a76cd8c185118bfdc9a087 https://bugzilla.mozilla.org/show_bug.cgi?id=1439127) ok danj guenther millert Full sync of CA list with Mozilla's. 2018-03-21T15:26:09+00:00 sthen 2018-03-21T15:26:09+00:00 urn:sha1:ad16532e09fae3995a7ca4e3a077a36312389d5d Produced using curl's make-ca-bundle.pl and then reformatted with our format-pem.pl from: https://hg.mozilla.org/releases/mozilla-release/raw-file/default/security/nss/lib/ckfw/builtins/certdata.txt OK benno@. juanfra agrees with syncing with Mozilla. No objections received. Add the following root CAs, from SECOM Trust Systems / Security Communication 2017-02-24T10:42:00+00:00 sthen 2017-02-24T10:42:00+00:00 urn:sha1:9ccf8d3f60083ee1f2a236236b5021676bee6445 of Japan, they are present in Mozilla's CA store. OK ajacoutot@ /C=JP/O=SECOM Trust Systems CO.,LTD./OU=Security Communication EV RootCA1 /C=JP/O=SECOM Trust Systems CO.,LTD./OU=Security Communication RootCA2 /C=JP/O=SECOM Trust.net/OU=Security Communication RootCA1 Various work on cert.pem, ok bcook@ 2017-01-01T15:15:36+00:00 sthen 2017-01-01T15:15:36+00:00 urn:sha1:6aa05405d0f9fa9421ab0d6566ad1a33c4722163 - print/sort using the full certificate subject rather than a pretty-printed subset (as done in the current version of format-pem.pl); previously this was resulting in a problem where a CN conflict resulted in the GlobalSign R2 CA accidentally getting dropped in r1.10; problem found by Steven McDonald - remove CA certificates that are no longer present in the CA store of the release branch of Mozilla - possible now that libressl has support for alternate chains (libcrypto/x509/x509_vfy.c r1.52) - add new CA certificates from Mozilla's store from those organisations which we already list Add ISRG Root X1, the letsencrypt CA root. This is now included in its own 2016-09-04T11:58:15+00:00 sthen 2016-09-04T11:58:15+00:00 urn:sha1:3da37bf7a3b3f62ad580afc3aa16ad2bf30d701c right in Mozilla's CA list, rather than relying on IdenTrust cross-signing. ok beck@ jca@ use -nameopt esc_msb so "NetLock Kft" cert has the non-ascii 2016-05-25T00:45:08+00:00 jsg 2016-05-25T00:45:08+00:00 urn:sha1:a2511cce65b951b5ef2e92c077eb255fddb2cdc1 and non-utf8 bytes escaped. ok sthen@