aboutsummaryrefslogtreecommitdiff
path: root/secure/caroot
Commit message (Collapse)AuthorAgeFilesLines
* caroot: Rename script and normalize licenseDag-Erling Smørgrav2025-08-252-35/+35
| | | | | | MFC after: 1 week Reviewed by: mandree, markj Differential Revision: https://reviews.freebsd.org/D51775
* caroot: Generate both trusted and untrustedDag-Erling Smørgrav2025-08-254-99/+51
| | | | | | | | | | Until now, the untrusted directory has been maintained manually. Modify the script used to maintain the trusted directory so it can handle both. While here, clean it up a bit. MFC after: 1 week Reviewed by: mandree, markj Differential Revision: https://reviews.freebsd.org/D51774
* caroot: Update certdata URL for GitHub switchMichael Osipov2025-05-281-1/+1
| | | | | | | | | | | Mozilla has migrated its projects' source code to GitHub, update certdata URL along with it. Reference: https://github.com/curl/curl/pull/17321 Reviewed by: jrm (mentor), otis (mentor), kevans MFC after: 1 week Differential Revision: https://reviews.freebsd.org/D50575
* caroot: update the root bundleMichael Osipov2025-03-1325-1465/+781
| | | | | | | | | | | Summary: - Seven (7) new roots - Four (4) distrusted roots - Fifteen (15) removed (expired) roots Reviewed by: kevans MFC after: 1 week Differential Revision: https://reviews.freebsd.org/D49294
* caroot: Ignore soft distrust of server CA certificates after 398 daysMichael Osipov2025-03-081-10/+10
| | | | | | | | | | | | | | | | | | Mozilla introduced the field CKA_NSS_SERVER_DISTRUST_AFTER which indicates that a CA certificate will be distrusted in the future before its NotAfter time. This means that the CA stops issuing new certificates, but previous ones are still valid, but at most for 398 days after the distrust date. See also: * https://bugzilla.mozilla.org/show_bug.cgi?id=1465613 * https://github.com/Lukasa/mkcert/issues/19 * https://gitlab.alpinelinux.org/alpine/ca-certificates/-/merge_requests/16 * https://github.com/curl/curl/commit/448df98d9280b3290ecf63e5fc9452d487f41a7c Tested by: michaelo Reviewed by: emaste MFC after: 1 week Differential Revision: https://reviews.freebsd.org/D49075
* Remove residual blank line at start of MakefileWarner Losh2024-07-154-4/+0
| | | | | | | This is a residual of the $FreeBSD$ removal. MFC After: 3 days (though I'll just run the command on the branches) Sponsored by: Netflix
* caroot: routine updateKyle Evans2024-02-1110-59/+875
| | | | | | | | | Changes: - One (1) modified - Eight (8) added - One (1) expired, now untrusted MFC after: 3 days
* caroot: regenerate the root bundle with OpenSSL 3Kyle Evans2023-08-26191-3791/+3872
| | | | No functional change intended.
* caroot: update the root bundleKyle Evans2023-08-2610-0/+605
| | | | | | | | | | | | | Summary: - Six (6) new roots - Four (4) distrusted roots Note that this was intentionally generated with OpenSSL 1.1.1 to avoid mixing updates and non-functional changes -- there will be some churn with OpenSSL 3. The next commit will update the current batch of trusted certs with the format OpenSSL 3 produces, which I've tested against OpenSSL 1.1.1 to be sure that that doesn't hurt us in older branches.
* caroot: drop the VERSION tag from already-processed certsKyle Evans2023-08-26166-166/+0
| | | | | An update is imminent; drop these now to make it easier to audit the results.
* caroot: drop VERSION tags from certsKyle Evans2023-08-261-3/+0
| | | | | | | | | | | | With this change, we'll drop the "with $FreeBSD$" lines from trusted/ certs in the next update. untrusted/ will need to be done manually, but I'll likely just do them all manually, commit, then run the script and commit any legitimate updates after confirming the output matches what I did manually. Reported by: imp Reviewed by: imp Differential Revision: https://reviews.freebsd.org/D41597
* Remove $FreeBSD$: one-line sh patternWarner Losh2023-08-165-5/+0
| | | | Remove /^\s*#[#!]?\s*\$FreeBSD\$.*$\n/
* caroot: add new certsKyle Evans2023-06-2520-0/+2059
| | | | | | | Based on dates, these were likely just missed in the last update... add them now. - Twenty (20) new
* caroot: update the root bundleKyle Evans2023-06-1514-180/+179
| | | | | | | | | Summary: - Zero (0) newly trusted - Five (5) modified - Nine (9) distrusted MFC after: 3 days
* caroot: Update VCS instructionsLi-Wen Hsu2022-11-071-1/+1
|
* caroot: update root storeKyle Evans2021-09-046-0/+481
| | | | | - Four (4) added - Two (2) removed
* secure/caroot, certctl: Rename secure/caroot/blacklistedCeri Davies2021-06-1840-12/+12
| | | | | | | Old certctl commands still work for compatability, but are deprecated. Approved by: secteam (gordon) Differential Revision: https://reviews.freebsd.org/D30807
* caroot: reroll the remaining certsKyle Evans2021-04-13125-0/+250
| | | | | | | This adds a specific note that these are explicitly trusted for server auth. MFC after: 3 days
* caroot: remove certs distrusted for server authKyle Evans2021-04-1315-0/+0
| | | | | | - Fifteen (15) removed MFC after: 3 days
* caroot: update CA bundle processorKyle Evans2021-04-131-12/+43
| | | | | | | | | | | | Our current processor was identified as trusting cert not explicitly marked for SERVER_AUTH, as well as certs that were tagged with DISTRUST_AFTER. Update the script to handle both scenarios. This patch was originally authored by mandree@ for ports, and it was subsequently ported to base caroot. MFC after: 3 days
* caroot: routine cert updateKyle Evans2021-04-135-0/+263
| | | | | | | - Three (3) added - Two (2) removed MFC after: 3 days
* caroot: drop $FreeBSD$ expansion from root bundleKyle Evans2020-12-28139-139/+139
| | | | | | | | This debatably could have waited until the next update would have taken place, but it's easier to see what changes if we get it out of the way now. MFC after: 3 days
* caroot: update bundleKyle Evans2020-12-1111-0/+134
| | | | | | | | | | | Summary: - One (1) added - Ten (10) removed MFC after: 3 days Notes: svn path=/head/; revision=368555
* caroot: update base storeKyle Evans2020-09-195-0/+265
| | | | | | | | | | | Count: - Two (2) removed - Three (3) added MFC after: 3 days Notes: svn path=/head/; revision=365896
* caroot: properly remove old distrusted rootsKyle Evans2020-09-027-0/+698
| | | | | | | | | | | | | | | | | | | | | The proper procedure was not followed in r364943; all of these that were deleted should have instead been moved over to the blacklist so that certctl can DTRT. Users must still `certctl rehash` after this, but this should generally be done by one of mergemaster/etcupdate/freebsd-update/pkgbase already; note that freebsd-update doesn't come into play for this particular update, as these have not yet made it into a release. Future work (after svn -> git) will likely change the script that updatecert invokes to facilitate the process, rather than trusting that kevans or whomever updates in the future will remember. Reported by: Helge Oldach <freebsd oldach net> MFC after: 3 days Notes: svn path=/head/; revision=365248
* carrot: update bundleKyle Evans2020-08-2911-698/+401
| | | | | | | | | | | Stats: - Seven (7) removed - Four (4) added MFC after: 3 days Notes: svn path=/head/; revision=364943
* caroot: switch to using echo+shell glob to enumerate certsKyle Evans2020-08-232-2/+2
| | | | | | | | | | | | This solves an issue on stable/12 that causes certs to not get installed. ls is apparently not in PATH during installworld, so TRUSTED_CERTS ends up blank and nothing gets installed. We don't really require anything ls-specific, though, so let's just simplify it. MFC after: 3 days Notes: svn path=/head/; revision=364600
* pkgbase: fix caroot packaging and add post-install scriptKyle Evans2020-01-292-2/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | The original intention for caroot was to be packaged separately, perhaps so that users can have a more/less conservative upgrade policy for this separated from the rest of base. secure/caroot/Makefile doesn't have anything interesting to package, but its subdirectories might. Move the PACKAGE= to Makefile.inc so both blacklisted and trusted get packaged consistently into the correct one rather than the default -utilities. Also tag the directories for package=caroot, as they could also be empty; blacklisted is empty by default, but trusted is not. Add a post-install script to do certctl rehash, along with a note should we eventually come up with a way to detect that files have been added or removed that requires a rehash. -caroot gets a dependency on -utilities, as that's where we provide certctl at the moment. We can perhaps reconsider this and put certctl into this package in the future, but there are some bits within -utilities that unconditionally invoke certctl so let's hold off for now. Reviewed by: manu (earlier version, before -utilities dep added) Differential Revision: https://reviews.freebsd.org/D23352 Notes: svn path=/head/; revision=357264
* caroot: blacklisted: automatically pick up *.pem in the treeKyle Evans2020-01-281-1/+3
| | | | | | | | | | | | | | | This kind of automagica got picked up in trusted/ prior to the initial commit, but never got applied over in blacklisted. Ideally no one will be using blacklisted/ to store arbitrary certs that they don't intend to blacklist, so we should just install anything that's in here rather than force consumer to first copy cert into place and then modify the file listing in the Makefile. Wise man once say: "it is better to restrict too much, than not enough. sometimes." Notes: svn path=/head/; revision=357193
* caroot: use bsd.obj.mk, not bsd.prog.mkKyle Evans2020-01-241-2/+1
| | | | | | | | | | This directory stages certdata into .OBJDIR and processes it, but does not actually build a prog-shaped object; bsd.obj.mk provides the minimal support that we actually need, an .OBJDIR and descent into subdirs. This is admittedly the nittiest of nits. Notes: svn path=/head/; revision=357084
* caroot update to latest tip: one (1) addition, none (0) removedKyle Evans2019-12-041-0/+137
| | | | | | | | Added: - Entrust Root Certification Authority - G4 Notes: svn path=/head/; revision=355376
* caroot: commit initial bundleKyle Evans2019-10-04149-0/+15631
| | | | | | | | | | | | | | | | | | | Interested users can blacklist any/all of these with certctl(8), examples: - mv /usr/share/certs/trusted/... /usr/share/certs/blacklisted/...; \ certctl rehash - certctl blacklist /usr/share/certs/trusted/*; \ certctl rehash Certs can be easily examined after installation with `certctl list`, and certctl blacklist will accept the hashed filename as output by list or as seen in /etc/ssl/certs No objection from: secteam Relnotes: Definite maybe Notes: svn path=/head/; revision=353095
* caroot: add @generated tags to extracted .pemKyle Evans2019-10-021-0/+5
| | | | | | | | | As is the current trend; while these files are manually curated, they are still generated. If they end up in a review, it would be helpful to also take the hint and hide them. Notes: svn path=/head/; revision=352951
* [1/3] Initial infrastructure for SSL root bundle in baseKyle Evans2019-10-025-0/+346
This setup will add the trusted certificates from the Mozilla NSS bundle to base. This commit includes: - CAROOT option to opt out of installation of certs - mtree amendments for final destinations - infrastructure to fetch/update certs, along with instructions A follow-up commit will add a certctl(8) utility to give the user control over trust specifics. Another follow-up commit will actually commit the initial result of updatecerts. This work was done primarily by allanjude@, with minor contributions by myself. No objection from: secteam Relnotes: yes Differential Revision: https://reviews.freebsd.org/D16856 Notes: svn path=/head/; revision=352948
generated by cgit v1.2.3 (git 2.25.1) at 2026-03-01 08:24:16 +0000