wireguard-openbsd/lib/libcrypto/cert.pem, branch jd/queueboostsWireGuard implementation for the OpenBSD kernelhttps://git.zx2c4.com/wireguard-openbsd/atom/lib/libcrypto/cert.pem?h=jd%2Fqueueboosts2020-06-01T18:53:53ZRemove expired certificate, ok tb@2020-06-01T18:53:53Zsthensthen@openbsd.org2020-06-01T18:53:53Zurn:sha1:ea801e78b224d11fe341dd4b8cd1807da4acb5c2
/C=SE/O=AddTrust AB/OU=AddTrust External TTP Network/CN=AddTrust External CA Root
sync cert.pem with Mozilla's root ca list, ok beck@2020-04-10T12:13:17Zsthensthen@openbsd.org2020-04-10T12:13:17Zurn:sha1:c53e842115754c5e80626c2893466d0fc6fa4b31update root CAs in cert.pem in sync with Mozilla2019-04-04T12:42:01Zsthensthen@openbsd.org2019-04-04T12:42:01Zurn:sha1:fa52bfb4417ae5e82a39d4724f53efcbe02da04d
ok millert@
Regenerate root CA list using updated format-pem.pl. Specifically this2018-12-16T12:08:32Zsthensthen@openbsd.org2018-12-16T12:08:32Zurn:sha1:4e9c419856037f26b4e4523973bebd76637ca8b8
drops CA certificates whose validity dates don't comply with the rules on
ASN.1 encoding in RFC 5280 (and predecessors - same rule goes back to at
least RFC 2459, section 4.1.2.5).
LibreSSL strictly enforces this, so attempting to validate certificates
signed by these CAs just result in the following:
error 13 at 1 depth lookup:format error in certificate's notBefore field
"probably" beck@
sync with mozilla-release (one removal, TURKTRUST, more details at2018-09-12T22:17:08Zsthensthen@openbsd.org2018-09-12T22:17:08Zurn:sha1:a94812e9f1e8f3c5635d9625353ab55cdb55a288
https://bugzilla.mozilla.org/show_bug.cgi?id=1439127)
ok danj guenther millert
Full sync of CA list with Mozilla's.2018-03-21T15:26:09Zsthensthen@openbsd.org2018-03-21T15:26:09Zurn:sha1:8150b4c9c5601f494cae95d8a3d9f3c8555f5d89
Produced using curl's make-ca-bundle.pl and then reformatted with our
format-pem.pl from:
https://hg.mozilla.org/releases/mozilla-release/raw-file/default/security/nss/lib/ckfw/builtins/certdata.txt
OK benno@. juanfra agrees with syncing with Mozilla. No objections received.
Add the following root CAs, from SECOM Trust Systems / Security Communication2017-02-24T10:42:00Zsthensthen@openbsd.org2017-02-24T10:42:00Zurn:sha1:97bbcd5907a6e2906a7d7372b37b0f2a9b9f3fdb
of Japan, they are present in Mozilla's CA store. OK ajacoutot@
/C=JP/O=SECOM Trust Systems CO.,LTD./OU=Security Communication EV RootCA1
/C=JP/O=SECOM Trust Systems CO.,LTD./OU=Security Communication RootCA2
/C=JP/O=SECOM Trust.net/OU=Security Communication RootCA1
Various work on cert.pem, ok bcook@2017-01-01T15:15:36Zsthensthen@openbsd.org2017-01-01T15:15:36Zurn:sha1:c68acebb6b7db03f6912901ba64e6a08ecf8b8f1
- print/sort using the full certificate subject rather than a pretty-printed
subset (as done in the current version of format-pem.pl); previously this was
resulting in a problem where a CN conflict resulted in the GlobalSign R2 CA
accidentally getting dropped in r1.10; problem found by Steven McDonald
- remove CA certificates that are no longer present in the CA store of the
release branch of Mozilla - possible now that libressl has support for
alternate chains (libcrypto/x509/x509_vfy.c r1.52)
- add new CA certificates from Mozilla's store from those organisations
which we already list
Add ISRG Root X1, the letsencrypt CA root. This is now included in its own2016-09-04T11:58:15Zsthensthen@openbsd.org2016-09-04T11:58:15Zurn:sha1:d2a835441f5fdcf8e3a90270bf3e9bcb1e1e499b
right in Mozilla's CA list, rather than relying on IdenTrust cross-signing.
ok beck@ jca@
use -nameopt esc_msb so "NetLock Kft" cert has the non-ascii2016-05-25T00:45:08Zjsgjsg@openbsd.org2016-05-25T00:45:08Zurn:sha1:4c7d5cf5f9275059c30759b1196a2ed6dbea8387
and non-utf8 bytes escaped.
ok sthen@