upstream/opnsense-src
1
0
Fork 0
mirror of https://github.com/opnsense/src.git synced 2026-02-20 00:11:07 -05:00
Code Issues Projects Releases Packages Wiki Activity Actions
opnsense-src/secure/caroot
History
Michael Osipov 7577dae4d6 caroot: update the root bundle 
Summary:
- Seven (7) new roots
- Four (4) distrusted roots
- Fifteen (15) removed (expired) roots

Reviewed by:	kevans
MFC after:	1 week
Differential Revision:	https://reviews.freebsd.org/D49294

(cherry picked from commit 0100da4deb96e15acf72d7655127c6faafa4148f)
2025-03-20 11:18:27 +01:00
..
trusted caroot: update the root bundle 2025-03-20 11:18:27 +01:00
untrusted caroot: update the root bundle 2025-03-20 11:18:27 +01:00
MAca-bundle.pl caroot: Ignore soft distrust of server CA certificates after 398 days 2025-03-15 14:51:24 +01:00
Makefile Remove $FreeBSD$: one-line sh pattern 2023-08-16 11:55:03 -06:00
Makefile.inc Remove $FreeBSD$: one-line sh pattern 2023-08-16 11:55:03 -06:00
README Remove $FreeBSD$: one-line sh pattern 2023-08-16 11:55:03 -06:00

README 

This directory contains the scripts to update the TLS CA Root Certificates
that comprise the 'root trust store'.

The 'updatecerts' make target should be run periodically by secteam@
specifically when there is an important change to the list of trusted root
certificates included by Mozilla.

It will:
	1) Remove the old trusted certificates (cleancerts)
	2) Download the latest certdata.txt from Mozilla (fetchcerts)
	3) Split certdata.txt into the individual .pem files (updatecerts)

Then the results should manually be inspected (git status)
	1) Any no-longer-trusted certificates should be moved to the
	untrusted directory (git mv)
	2) any newly added certificates will need to be added (git add)


The following make targets exist:

cleancerts:
	Delete the old certificates, run as a dependency of updatecerts.

fetchcerts:
	Download the latest certdata.txt from the Mozilla NSS hg repo
	See the changelog here:
		https://hg.mozilla.org/projects/nss/log/tip/lib/ckfw/builtins/certdata.txt

updatecerts:
	Runs a perl script (MAca-bundle.pl) on the downloaded certdata.txt
	to generate the individual certificate files (.pem) and store them
	in the trusted/ directory.