openbsd - A mirror of https://github.com/libressl/openbsd.git

	Commit message (Collapse)	Author	Age	Files	Lines
*	delete expired DST Root CA X3 to work around bugs various librarieslibressl-v3.2.7 OPENBSD_6_8	deraadt	2021-09-30	1	-44/+1
\| \| \| \| \| \| \|	ok sthen, beck, jsing, tb, etc etc This cannot be issued as an errata/syspatch, because syspatch cannot handle "etc set" changes, but is still worth putting into -stable
*	Remove expired certificate, ok tb@	sthen	2020-06-01	1	-53/+1
\| \| \| \|	/C=SE/O=AddTrust AB/OU=AddTrust External TTP Network/CN=AddTrust External CA Root
*	sync cert.pem with Mozilla's root ca list, ok beck@	sthen	2020-04-10	1	-276/+343
\|
*	update root CAs in cert.pem in sync with Mozilla	sthen	2019-04-04	1	-287/+440
\| \| \| \|	ok millert@
*	Regenerate root CA list using updated format-pem.pl. Specifically this	sthen	2018-12-16	1	-101/+1
\| \| \| \| \| \| \| \| \| \| \| \| \|	drops CA certificates whose validity dates don't comply with the rules on ASN.1 encoding in RFC 5280 (and predecessors - same rule goes back to at least RFC 2459, section 4.1.2.5). LibreSSL strictly enforces this, so attempting to validate certificates signed by these CAs just result in the following: error 13 at 1 depth lookup:format error in certificate's notBefore field "probably" beck@
*	sync with mozilla-release (one removal, TURKTRUST, more details at	sthen	2018-09-12	1	-48/+1
\| \| \| \| \| \|	https://bugzilla.mozilla.org/show_bug.cgi?id=1439127) ok danj guenther millert
*	Full sync of CA list with Mozilla's.	sthen	2018-03-21	1	-580/+3448
\| \| \| \| \| \| \| \|	Produced using curl's make-ca-bundle.pl and then reformatted with our format-pem.pl from: https://hg.mozilla.org/releases/mozilla-release/raw-file/default/security/nss/lib/ckfw/builtins/certdata.txt OK benno@. juanfra agrees with syncing with Mozilla. No objections received.
*	Add the following root CAs, from SECOM Trust Systems / Security Communication	sthen	2017-02-24	1	-1/+126
\| \| \| \| \| \| \| \|	of Japan, they are present in Mozilla's CA store. OK ajacoutot@ /C=JP/O=SECOM Trust Systems CO.,LTD./OU=Security Communication EV RootCA1 /C=JP/O=SECOM Trust Systems CO.,LTD./OU=Security Communication RootCA2 /C=JP/O=SECOM Trust.net/OU=Security Communication RootCA1
*	Various work on cert.pem, ok bcook@	sthen	2017-01-01	1	-969/+869
\| \| \| \| \| \| \| \| \| \| \| \| \| \|	- print/sort using the full certificate subject rather than a pretty-printed subset (as done in the current version of format-pem.pl); previously this was resulting in a problem where a CN conflict resulted in the GlobalSign R2 CA accidentally getting dropped in r1.10; problem found by Steven McDonald - remove CA certificates that are no longer present in the CA store of the release branch of Mozilla - possible now that libressl has support for alternate chains (libcrypto/x509/x509_vfy.c r1.52) - add new CA certificates from Mozilla's store from those organisations which we already list
*	Add ISRG Root X1, the letsencrypt CA root. This is now included in its own	sthen	2016-09-04	1	-1/+55
\| \| \| \| \|	right in Mozilla's CA list, rather than relying on IdenTrust cross-signing. ok beck@ jca@
*	use -nameopt esc_msb so "NetLock Kft" cert has the non-ascii	jsg	2016-05-25	1	-2/+2
\| \| \| \| \| \|	and non-utf8 bytes escaped. ok sthen@
*	Sync some root certificates with Mozilla's cert store. ok bcook@	sthen	2016-02-17	1	-84/+1016
\| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \|	- Add new root certificates present in Mozilla cert store from CA organizations who are already in cert.pem (AddTrust, Comodo, DigiCert, Entrust, GeoTrust, USERTrust). - Replace Startcom's root with their updated sha256 version present in Mozilla cert store. (They maintained serial# etc so this is still valid for existing signed certificates). - Add two root certificates from CA not previously present: "C=US, O=Network Solutions L.L.C., CN=Network Solutions Certificate Authority" "C=PL, O=Unizeto Sp. z o.o., CN=Certum CA" (the latter used by yandex.ru) We are still listing some certificates that have been removed from Mozilla's store (1024-bit etc) however these cannot be removed until cert validation is improved (we don't currently accept a certificate as valid unless the CA is at the end of a chain).
*	Sort cert.pem alphabetically, first by organisation, then by CA name	sthen	2016-02-01	1	-1604/+1584
\| \| \| \| \| \| \| \| \| \| \|	(CN if available, otherwise OU). Add a comment identifying the org. Now to get an easy-to-read list of certificates in the file you can use "grep ^[#=] cert.pem". Prepared with https://spacehopper.org/format-pem.20160201. If you would like to verify this commit to ensure that I didn't sneak in any other changes, it will be easier to use the script rather than do it by hand.
*	Revamp cert.pem certificate information formatting. Skip headers which	sthen	2016-01-31	1	-2459/+184
\| \| \| \| \| \| \| \| \|	aren't really useful (the information can be obtained by feeding the cert into "openssl x509 -in filename -text") and add a separator between certs showing the CA's CN or OU (similar to the display format in web browsers). Include both SHA1 and SHA256 fingerprints for all certificates. ok beck@ zhuk@ jung@
*	Remove "C=US, O=VeriSign, Inc., OU=Class 3 Public Primary Certification	sthen	2015-12-15	1	-49/+0
\| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \|	Authority" (serial 3c:91:31:cb:1f:f6:d0:1b:0e:9a:b8:d0:44:bf:12:be) root certificate from cert.pem. ok rpe@ Symantec/VeriSign say "Browsers/root store operators are encouraged to remove/untrust this root from their root stores" and "hasn't been used to generate new certificates in several years, and will now be repurposed to provide transition support for some of our enterprise customers' legacy, non-public applications" (https://www.symantec.com/page.jsp?id=roots, http://www.scmagazine.com/google-will-remove-trust-of-symantecs-pca3-g1-certificate/article/459688/). Also see https://knowledge.symantec.com/support/ssl-certificates-support/index?page=content&id=ALERT1941 https://googleonlinesecurity.blogspot.co.uk/2015/12/proactive-measures-in-digital.html
*	Add root certificate for COMODO RSA Certification Authority, ok beck@	sthen	2015-12-07	1	-0/+122
\| \| \| \| \| \| \|	In some cases sites signed by this are covered by the old "AddTrust External CA Root" that we already had, but that depends on the site sending a fairly large chain of intermediate certificates which most aren't doing (because there's no need because this newer one is in browser stores..).
*	add QuoVadis root certificates, present in Mozilla/Chrome/Apple/Windows/etc	sthen	2015-11-16	1	-0/+722
\| \| \| \|	req by and OK dlg, no objections in 5 days
*	Add Certplus CA root certificate:	sthen	2015-09-13	1	-0/+86
\| \| \| \| \| \|	C=FR, O=Certplus, CN=Class 2 Primary CA req by beck@, ok miod@ beck@
*	add NetLock Kft. CA root certificate, already present in web browsers and	steven	2015-07-20	1	-0/+80
\| \| \| \| \|	needed for fetching ports distfiles. ok sthen@
*	add DST Root CA X3 certificate, already present in most browser cert stores.	sthen	2015-06-17	1	-0/+77
\| \| \| \| \| \|	"O=Digital Signature Trust Co., CN=DST Root CA X3". This CA is cross signing the issuing intermediates for letsencrypt.org so is expected to be important for at least ports distfile fetching in the future. ok ajacoutot@ juanfra@
*	Add SwissSign CA root certificates. Requested by robert@, ok dcoppa@ aja@ miod@	sthen	2015-05-04	1	-0/+381
\|
*	Move build machinery for libcrypto from libssl/crypto to libcrypto, as well	miod	2014-04-11	1	-0/+3524
	as configuration files; split manpages and .pc files between libcrypto and libssl. No functional change, only there to make engineering easier, and libcrypto sources are still found in libssl/src/crypto at the moment. ok reyk@, also discussed with deraadt@ beck@ and the usual crypto suspects.