Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

crypto: update root certificates #19322

Closed
wants to merge 4 commits into from
Closed

crypto: update root certificates #19322

wants to merge 4 commits into from

Commits on Mar 13, 2018

  1. tools: update certdata.txt 

    This is the certdata.txt[0] from NSS 3.36, released on 2018-03-05.

This is the version of NSS that will ship in Firefox 60 on 2018-05-01.

[0] https://hg.mozilla.org/projects/nss/raw-file/NSS_3_36_RTM/lib/ckfw/builtins/certdata.txt
    @bnoordhuis
    bnoordhuis committed Mar 13, 2018
    Configuration menu
    Copy the full SHA
    0df2cf6 View commit details
    Browse the repository at this point in the history

  2. crypto: update root certificates 

    Update the list of root certificates in src/node_root_certs.h with
tools/mk-ca-bundle.pl.

Certificates added:
- GDCA TrustAUTH R5 ROOT
- SSL.com EV Root Certification Authority ECC
- SSL.com EV Root Certification Authority RSA R2
- SSL.com Root Certification Authority ECC
- SSL.com Root Certification Authority RSA
- TrustCor ECA-1
- TrustCor RootCert CA-1
- TrustCor RootCert CA-2

Certificates removed:
- ACEDICOM Root
- AddTrust Low-Value Services Root
- AddTrust Public Services Root
- AddTrust ualified Certificates Root
- CA Disig Root R1
- Camerfirma Chambers of Commerce Root
- Camerfirma Global Chambersign Root
- CA WoSign ECC Root
- Certification Authority of WoSign G2
- Certinomis - Autorité Racine
- Certum Root CA
- China Internet Network Information Center EV Certificates Root
- CNNIC ROOT
- Comodo Secure Services root
- Comodo Trusted Services root
- DST ACES CA X6
- GeoTrust Global CA 2
- PSCProcert
- Security Communication EV RootCA1
- StartCom Certification Authority
- StartCom Certification Authority
- StartCom Certification Authority G2
- Swisscom Root CA 1
- Swisscom Root CA 2
- Swisscom Root EV CA 2
- TUBITAK UEKAE Kok Sertifika Hizmet Saglayicisi - Surum 3
- TURKTRUST Certificate Services Provider Root 2007
- UTN USERFirst Hardware Root CA
- WoSign
- WoSign China
    @bnoordhuis
    bnoordhuis committed Mar 13, 2018
    Configuration menu
    Copy the full SHA
    ed07975 View commit details
    Browse the repository at this point in the history

  3. fixup! revert CNNIC root removals 

    The previous commit removed the CNNIC root certificates and makes
the test/parallel/test-tls-cnnic-whitelist.js test fail with an
UNABLE_TO_VERIFY_LEAF_SIGNATURE error instead of the "expected"
CERT_REVOKED error.

"Expected" between scare quotes because of course the new error
is not unexpected.
    @bnoordhuis
    bnoordhuis committed Mar 13, 2018
    Configuration menu
    Copy the full SHA
    d5bc08b View commit details
    Browse the repository at this point in the history

  4. src: drop CNNIC+StartCom certificate whitelisting 

    Remove the CNNIC certificates again and remove the whitelist from commit
3beb880 ("crypto: add cert check to CNNIC Whitelist") from June 2015.
    @bnoordhuis
    bnoordhuis committed Mar 13, 2018
    Configuration menu
    Copy the full SHA
    4deccc4 View commit details
    Browse the repository at this point in the history