The MirOS Project

CVS log for src/etc/ssl.certs.shar

Up to [The MirOS Project] / src / etc

Request diff between arbitrary revisions - Display revisions graphically

Keyword substitution: kv
Default branch: MAIN

nuke expired SSL cert

drop expired certificates

drop pkioverheid.nl which was also accessible to the DigiNotar crackers, sorry dutch people you’ve got a problem now

http://blog.mozilla.com/security/2011/08/29/fraudulent-google-com-certificate/

small SSL CA Certificate update (don’t have the time for a full one ATM):
• CAcert.org Class 3 rollover
• drop one expired
• drop two duplicates (wtf…)

part 1/2 of periodical x.509 cert update; prodded by gecko2@tarent

• sync with Netscape
• sync from Startcom
• drop those expiring this year

• remove expired certs
• add two new, from plänet debian, for MSN Messenger

roll over almost-expired c61efb68.0 (c61efb68.1 is its replacement
and now called c61efb68.0 instead)

update from Opera and Microsoft (rootsupd.exe) and nuke expired ones
note: intermediates are now included for the first time

rolling updates for e.g. IPS, Endmail Org CA, Startcom intermediates, etc.
and removal of expired ones; sync with Mozilla/NSS bundle too and add notes

• remove “RSA Security 1024 V3” root, cf.
  http://groups.google.com/group/mozilla.dev.security.policy/browse_thread/thread/b6493a285ba79998/26fca75f9aeff1dc
• I managed to forget the passphrase for the MirBSD Infrastructure CA, RIP…

Include the "Gandi Standard SSL CA" (intermediate CA) from France,
because Freenode PDPC is too stupid to properly include their own
certificate chain into the server response.

nuke expired certs, before they stink (:

update; begin to take notes and make scripts

• update from https://certs.opera.com/
• mention that ca-certificates_20081127.dsc contains no new ones
• mention that M*zilla contains no new ones with trust

remove expired certificates
• C=BE, O=GlobalSign nv-sa
• C=AT, ST=Austria, L=Vienna, O=Arge Daten Oesterreichische Gesellschaft fuer Datenschutz

add the MirBSD CA Root CA Certificate
since CAcert.org gets too much red tape, new roots delay infinitively, but they impose too much liability
this is so that we have a sane and safe upgrade path in all cases

according to http://broadcast.oreilly.com/2009/01/new-pki-problem-resolved.html the “broken” CAs have resolved the issues and stopped using MD5 starting with 2009

on second thought, can’t do that to the MD2 ones, still used in business,
and people d̲o̲ focus on MD5…

• after looking at http://www.win.tue.nl/hashclash/rogue-ca/
  disable¹ all of the mentioned almost-certainly-cracked ones,
  all still using MD2 as their own hash algorithm,
  and a fair share of these still using 1024 bit keys only,
  where suspicion arose

  ① disabling is new: by renaming XXXXXXXX.Y to XXXXXXXX.Y.untrusted,
    where X is the certificate hash and Y a local collision counter,
    browsers such as lynx(1) do not trust them any more unless the
    sysadmin symlinks them back to XXXXXXXX.Y
• the usual round of “let’s remove expired certificates”
  (thinking back, naming them XXXXXXXX.Y.expired would’ve been better)

This is going to shake the world, guys.

add some from https://certs.opera.com/

UK eScience CA

add new ones from M*zilla-current, except expired ones

update from
- ca-certificates_20080617_all.deb and its source package
  includes latest mozilla bundle
- opera-9.51
and remove expired and insecure certificates

• remove broken SPI, Inc. certificate (even if not yet expired, as
  signatures can’t be successfully validated)
• add their new 2008 one

With help from Michael Schultheiss <schultmc@debian.org>
Signature validated from Joerg Jaspert <joerg@debian.org>

update from curl/netscape and boinc bundles; remove no longer valid ones

• remove two no longer valid certs
• add one new from sendmail 8.14.2

add certs of DFN-PCA by DFN e.V. and DFN-CERT GmbH

major update:
• add certs from StartCom Ltd, Israel
• add certs bundled with Opera 9.20
• remove already-expired certs

pending:
• updated certificate from SPI (still waiting for them to move their arse,
  but they're affiliated with Debian and thus will probably need 10 years)
• more expiries this year (3)

upgrade to OpenSSL 0.9.7m

+spi-inc.org CA, fingerprint was gpg signed by Joerg Jaspert (loosely checked)

remove expired certs

nuke expired certs

update the two TrustCenter Hamburg certs (from OpenSSL upstream)
and add CAcert class 3 (to aid broken server certs)

bloatzilla trusts the startcom certificates now that they have
been third-party-audited so why shan't we... it's a little risk
though because a 1024-bit RSA key, valid until 2035... well, I
have seen commercial CAs do worse, so I figure it's okay

new from OpenBSD:src/lib/libssl/cert.pem (their Verisign is too old tho)

Add some missing files, such as some ISDN4BSD stuff,
documentation, tmac and tab files, TAI64 etc.

Initial revision