openbsd/src/lib, branch OPENBSD_5_9_BASE A mirror of https://github.com/libressl/openbsd.git https://git.lua4.win/openbsd/atom?h=OPENBSD_5_9_BASE 2016-02-17T13:06:55+00:00 This commit was manufactured by cvs2git to create tag 'OPENBSD_5_9_BASE'. 2016-02-17T13:06:55+00:00 cvs2svn admin@example.com 2016-02-17T13:06:55+00:00 urn:sha1:c192600fadb763f0d8645c69f309093e3709f18c Sync some root certificates with Mozilla's cert store. ok bcook@ 2016-02-17T13:06:54+00:00 sthen 2016-02-17T13:06:54+00:00 urn:sha1:5e028a458eda039db3f8d1a098b2934bd6d466e4 - Add new root certificates present in Mozilla cert store from CA organizations who are already in cert.pem (AddTrust, Comodo, DigiCert, Entrust, GeoTrust, USERTrust). - Replace Startcom's root with their updated sha256 version present in Mozilla cert store. (They maintained serial# etc so this is still valid for existing signed certificates). - Add two root certificates from CA not previously present: "C=US, O=Network Solutions L.L.C., CN=Network Solutions Certificate Authority" "C=PL, O=Unizeto Sp. z o.o., CN=Certum CA" (the latter used by yandex.ru) We are still listing some certificates that have been removed from Mozilla's store (1024-bit etc) however these cannot be removed until cert validation is improved (we don't currently accept a certificate as valid unless the CA is at the end of a chain). compare pointer to NULL in example code 2016-02-07T20:50:24+00:00 mmcc 2016-02-07T20:50:24+00:00 urn:sha1:64550dd44c759e7be9834a688c8b91cfd3f5593a be more forceful about not using these. 2016-02-05T18:09:19+00:00 espie 2016-02-05T18:09:19+00:00 urn:sha1:b0da4200672d59fc9ea66c08b5f36d7848ea6a37 improvements sthen@, jmc@. okay millert@, jca@ jmc@ Fix err(3) calls after allocation failures in examples. 2016-02-05T15:09:09+00:00 schwarze 2016-02-05T15:09:09+00:00 urn:sha1:e4c0bcd220ad855573e4c0ced2e868becf4d563d There is long-standing consensus that err(1, NULL) is the best idiom after failure of malloc(3) and friends. Quirk in the manual noticed by tb@. Sort cert.pem alphabetically, first by organisation, then by CA name 2016-02-01T00:23:43+00:00 sthen 2016-02-01T00:23:43+00:00 urn:sha1:225f1ee35564ab235a59d5bd45096011a51741cd (CN if available, otherwise OU). Add a comment identifying the org. Now to get an easy-to-read list of certificates in the file you can use "grep ^[#=] cert.pem". Prepared with https://spacehopper.org/format-pem.20160201. If you would like to verify this commit to ensure that I didn't sneak in any other changes, it will be easier to use the script rather than do it by hand. Revamp cert.pem certificate information formatting. Skip headers which 2016-01-31T23:10:02+00:00 sthen 2016-01-31T23:10:02+00:00 urn:sha1:0b99bfb21d223cf0ce031b1a6e7d6e7e4c0ee255 aren't really useful (the information can be obtained by feeding the cert into "openssl x509 -in filename -text") and add a separator between certs showing the CA's CN or OU (similar to the display format in web browsers). Include both SHA1 and SHA256 fingerprints for all certificates. ok beck@ zhuk@ jung@ Therefor -> Therefore (where appropriate) 2016-01-29T11:50:40+00:00 tb 2016-01-29T11:50:40+00:00 urn:sha1:e1b6a5f13ec0571bad17f6591a7490d542b32f65 from ray@, ok jmc@ deprecate SSL_OP_SINGLE_DH_USE 2016-01-27T02:06:16+00:00 beck 2016-01-27T02:06:16+00:00 urn:sha1:e2e517f4c81621a7346f82a2064c31e7066f1198 ok jsing@ Don't crash dumping malloc stats if malloc_init hasn't been called, noted by 2016-01-26T15:44:28+00:00 otto 2016-01-26T15:44:28+00:00 urn:sha1:7dd2931bc4345541724ce4f62b54914fbc4e0274 David CARLIER