Date: Fri, 12 Feb 2021 13:28:14 -0600 From: Kyle Evans <kevans@freebsd.org> To: "Dan Mahoney (Gushi)" <freebsd@gushi.org> Cc: questions@freebsd.org, Allan Jude <allanjude@freebsd.org> Subject: Re: splitting ca_root_nss into component pem files Message-ID: <CACNAnaHcy5jLGDpU1jPrjnkDhnPm=XAzmWSekwCX92DyNeUDQw@mail.gmail.com> In-Reply-To: <8f7cdfd9-7c4f-2e5d-948c-34ae45f1c9d@prime.gushi.org> References: <8f7cdfd9-7c4f-2e5d-948c-34ae45f1c9d@prime.gushi.org>
next in thread | previous in thread | raw e-mail | index | archive | help
On Fri, Feb 12, 2021 at 1:23 PM Dan Mahoney (Gushi) <freebsd@gushi.org> wrote: > > Allan (and all), > > I notice FreeBSD now comes with certctl which knows how to split and > manage trusted SSL certs. FreeBSD 12.2 includes a /usr/share/ssl/certs > directory now (no mention of that in the release notes?) and a tool called > certctl. > > Certctl has (for some reason) been backported to 11.x, where there are no > individual certs provided by default, so I'm confused as to why this is. > I fully intended to ship 11.4 with them, but pulled them at the last minute due to some issues with certctl. > ca_root_nss only provides a monolithic cert. > > Some apps require a directory of hashes and symlinks. This is common, > especially when you want to trust your local CA as well as the netscape > ones. Additionally, some tools (like sendmail) seem to require the > symlinked approach. > > Is there a tool (installed with base, or from ports) that will do this > splitting of ca_root_nss, to some standard directory? (certctl doesn't > appear to). > I have some local WIP that's going to split ca_root_nss out like the base bundle is, so that it's compatible with certctl and friends. My vision is that ca_root_nss will provide more expedient updates of the bundle to folks that need it on a better timeline than EN/SA can deliver. > Should this not be a standard thing in the pkg-message for ca_root_nss? > > (This seems to be a tangly problem to google). > > Note I solved this myself a few years back: > https://gushi.dreamwidth.org/1064679.html, but I'd like to have a "right" > answer. > > But...this feels like something that should have a base tool AND be in the > handbook, since the *removal* of a cert from ca_root_nss will cause users > to still trust it -- a clean rebuild should be possible. > Right, that's the problem I'm hoping to solve by splitting ca_root_nss up. Thanks, Kyle Evans
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?CACNAnaHcy5jLGDpU1jPrjnkDhnPm=XAzmWSekwCX92DyNeUDQw>