crypto: update root certificates #7363

bnoordhuis · 2016-06-22T10:24:10Z

Update the list of root certificates in src/node_root_certs.h with
tools/mk-ca-bundle.pl.

Certificates added:

Certum Trusted Network CA 2
SZAFIR ROOT CA2

Certificates removed:

CA Disig
NetLock Notary (Class A) Root
Staat der Nederlanden Root CA

Note: added/removed will be different across branches.

R=@nodejs/crypto
CI: https://ci.nodejs.org/job/node-test-pull-request/3049/

jasnell · 2016-06-22T15:13:47Z

LGTM

shigeki · 2016-06-22T16:34:14Z

I made make test-internet and found that test/internet/test-tls-connnect-cnnic.js sometimes leads an error with the message of "unable to verify the first certificate". This is because some of servers of www1.cnnnic.cn seems to be misconfigured so as not to send its intermediate certs. We cannot avoid its error now and I'm not sure if there are other valid and robust web sites of cnnic that we can make tests.

@bnoordhuis Could you add one more commit to remove the test of test/internet/test-tls-connnect-cnnic.js?
I think we need not to have it because the CNNNIC White list of src/CNNICHashWhitelist.inc are not changed for long time in firefox as https://hg.mozilla.org/mozilla-central/log/tip/security/certverifier/CNNICHashWhitelist.inc . Chrome is pruning the list of expired certs as https://chromium.googlesource.com/chromium/src.git/+log/master/net/cert/cert_verify_proc_whitelist.cc but I think we need to not to do it as long as its size does not cause issues.

Other tests of make test-internet are fine.

The current certdata.txt in nightly of Firefox50 has already been updated. It will be scheduled in this November when Firefox50 becomes a stable release

shigeki · 2016-06-22T16:38:41Z

If it is better to open a new PR to remove the test, I'm okay with it.

indutny · 2016-06-22T18:56:18Z

Rubber-stamp LGTM.

thefourtheye · 2016-06-23T04:56:19Z

Do we have regressions to make sure that the certificate updates don't break?

Edit: nvm. internet tests. LGTM.

This is the certdata.txt[0] that ships in Firefox 47 and NSS 3.23, last updated on 2016-02-26. [0] https://hg.mozilla.org/mozilla-central/raw-file/1f84dea6508d/security/nss/lib/ckfw/builtins/certdata.txt PR-URL: nodejs#7363 Reviewed-By: Fedor Indutny <fedor.indutny@gmail.com> Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Sakthipriyan Vairamani <thechargingvolcano@gmail.com>

Commit eff96d3 ("src: add include guards to internal headers") adds include guards. Update tools/mk-ca-bundle.pl to output them when generating src/node_root_certs.h. PR-URL: nodejs#7363 Reviewed-By: Fedor Indutny <fedor.indutny@gmail.com> Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Sakthipriyan Vairamani <thechargingvolcano@gmail.com>

Update the list of root certificates in src/node_root_certs.h with tools/mk-ca-bundle.pl. Certificates added: - Certum Trusted Network CA 2 - SZAFIR ROOT CA2 Certificates removed: - CA Disig - NetLock Notary (Class A) Root - Staat der Nederlanden Root CA PR-URL: nodejs#7363 Reviewed-By: Fedor Indutny <fedor.indutny@gmail.com> Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Sakthipriyan Vairamani <thechargingvolcano@gmail.com>

Shigeki Ohtsu points out that the test is unreliable because some of the www1.cnnnic.cn servers are misconfigured. Remove it. PR-URL: nodejs#7363 Refs: nodejs#7363 (comment) Reviewed-By: Fedor Indutny <fedor.indutny@gmail.com> Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Sakthipriyan Vairamani <thechargingvolcano@gmail.com>

bnoordhuis · 2016-06-23T07:34:21Z

I've removed the test in ede98a7.

The current certdata.txt in nightly of Firefox50 has already been updated. It will be scheduled in this November when Firefox50 becomes a stable release

Yes, I've seen that but I thought it prudent to update to root certificates that are currently shipping in stable FF.

If you want, we can revisit. We could follow latest stable NSS rather than latest stable FF, for example.

shigeki · 2016-06-23T15:28:55Z

@bnoordhuis Thanks for adding the commits. I agree your decision to use the one in the stable Firefox. We will mark the next update schedule in this November.

This is the certdata.txt[0] that ships in Firefox 47 and NSS 3.23, last updated on 2016-02-26. [0] https://hg.mozilla.org/mozilla-central/raw-file/1f84dea6508d/security/nss/lib/ckfw/builtins/certdata.txt PR-URL: #7363 Reviewed-By: Fedor Indutny <fedor.indutny@gmail.com> Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Sakthipriyan Vairamani <thechargingvolcano@gmail.com>

Commit eff96d3 ("src: add include guards to internal headers") adds include guards. Update tools/mk-ca-bundle.pl to output them when generating src/node_root_certs.h. PR-URL: #7363 Reviewed-By: Fedor Indutny <fedor.indutny@gmail.com> Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Sakthipriyan Vairamani <thechargingvolcano@gmail.com>

Update the list of root certificates in src/node_root_certs.h with tools/mk-ca-bundle.pl. Certificates added: - Certum Trusted Network CA 2 - SZAFIR ROOT CA2 Certificates removed: - CA Disig - NetLock Notary (Class A) Root - Staat der Nederlanden Root CA PR-URL: #7363 Reviewed-By: Fedor Indutny <fedor.indutny@gmail.com> Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Sakthipriyan Vairamani <thechargingvolcano@gmail.com>

Shigeki Ohtsu points out that the test is unreliable because some of the www1.cnnnic.cn servers are misconfigured. Remove it. PR-URL: #7363 Refs: #7363 (comment) Reviewed-By: Fedor Indutny <fedor.indutny@gmail.com> Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Sakthipriyan Vairamani <thechargingvolcano@gmail.com>

Shigeki Ohtsu points out that the test is unreliable because some of the www1.cnnnic.cn servers are misconfigured. Remove it. PR-URL: nodejs#7363 Refs: nodejs#7363 (comment) Reviewed-By: Fedor Indutny <fedor.indutny@gmail.com> Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Sakthipriyan Vairamani <thechargingvolcano@gmail.com>

bnoordhuis · 2016-07-11T21:43:21Z

#7662

This is the certdata.txt[0] that ships in Firefox 47 and NSS 3.23, last updated on 2016-02-26. [0] https://hg.mozilla.org/mozilla-central/raw-file/1f84dea6508d/security/nss/lib/ckfw/builtins/certdata.txt PR-URL: #7363 Reviewed-By: Fedor Indutny <fedor.indutny@gmail.com> Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Sakthipriyan Vairamani <thechargingvolcano@gmail.com>

Update the list of root certificates in src/node_root_certs.h with tools/mk-ca-bundle.pl. Certificates added: - CA WoSign ECC Root - Certification Authority of WoSign G2 - Certinomis - Root CA - Certum Trusted Network CA 2 - OISTE WISeKey Global Root GB CA - SZAFIR ROOT CA2 - TURKTRUST Elektronik Sertifika Hizmet Sa?layıcısı H5 - TURKTRUST Elektronik Sertifika Hizmet Sa?layıcısı H6 Certificates removed: - A-Trust-nual-03 - Buypass Class 3 CA 1 - CA Disig - ComSign Secured CA - Equifax Secure CA - NetLock Notary (Class A) Root - Staat der Nederlanden Root CA - TC TrustCenter Class 2 CA II - TC TrustCenter Universal CA I - TURKTRUST Certificate Services Provider Root 1 - TURKTRUST Certificate Services Provider Root 2 - UTN DATACorp SGC Root CA - Verisign Class 4 Public Primary Certification Authority - G3 PR-URL: #7363 Reviewed-By: Fedor Indutny <fedor.indutny@gmail.com> Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Sakthipriyan Vairamani <thechargingvolcano@gmail.com>