freebsd-dev/secure/caroot
Kyle Evans 8e0dc55e68 caroot: properly remove old distrusted roots
The proper procedure was not followed in r364943; all of these that were
deleted should have instead been moved over to the blacklist so that certctl
can DTRT.

Users must still `certctl rehash` after this, but this should generally be
done by one of mergemaster/etcupdate/freebsd-update/pkgbase already; note
that freebsd-update doesn't come into play for this particular update, as
these have not yet made it into a release.

Future work (after svn -> git) will likely change the script that updatecert
invokes to facilitate the process, rather than trusting that kevans or
whomever updates in the future will remember.

Reported by:	Helge Oldach <freebsd oldach net>
MFC after:	3 days
2020-09-02 12:57:34 +00:00
..
blacklisted caroot: properly remove old distrusted roots 2020-09-02 12:57:34 +00:00
trusted carrot: update bundle 2020-08-29 02:46:25 +00:00
MAca-bundle.pl
Makefile pkgbase: fix caroot packaging and add post-install script 2020-01-29 18:47:08 +00:00
Makefile.inc pkgbase: fix caroot packaging and add post-install script 2020-01-29 18:47:08 +00:00
README

# $FreeBSD$

This directory contains the scripts to update the TLS CA Root Certificates
that comprise the 'root trust store'.

The 'updatecerts' make target should be run periodically by secteam@
specifically when there is an important change to the list of trusted root
certificates included by Mozilla.

It will:
	1) Remove the old trusted certificates (cleancerts)
	2) Download the latest certdata.txt from Mozilla (fetchcerts)
	3) Split certdata.txt into the individual .pem files (updatecerts)

Then the results should manually be inspected (svn status)
	1) Any no-longer-trusted certificates should be moved to the
	blacklisted directory (svn mv)
	2) any newly added certificates will need to be added (svn add)


The following make targets exist:

cleancerts:
	Delete the old certificates, run as a dependency of updatecerts.

fetchcerts:
	Download the latest certdata.txt from the Mozilla NSS hg repo
	See the changelog here:
		https://hg.mozilla.org/projects/nss/log/tip/lib/ckfw/builtins/certdata.txt

updatecerts:
	Runs a perl script (MAca-bundle.pl) on the downloaded certdata.txt
	to generate the individual certificate files (.pem) and store them
	in the trusted/ directory.