From owner-freebsd-questions@freebsd.org Fri Feb 12 19:28:28 2021 Return-Path: Delivered-To: freebsd-questions@mailman.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.nyi.freebsd.org (Postfix) with ESMTP id A555352E062 for ; Fri, 12 Feb 2021 19:28:28 +0000 (UTC) (envelope-from kevans@freebsd.org) Received: from mailman.nyi.freebsd.org (mailman.nyi.freebsd.org [IPv6:2610:1c1:1:606c::50:13]) by mx1.freebsd.org (Postfix) with ESMTP id 4Dck7J4CwSz3nvg for ; Fri, 12 Feb 2021 19:28:28 +0000 (UTC) (envelope-from kevans@freebsd.org) Received: by mailman.nyi.freebsd.org (Postfix) id 8EDA252E0E4; Fri, 12 Feb 2021 19:28:28 +0000 (UTC) Delivered-To: questions@mailman.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.nyi.freebsd.org (Postfix) with ESMTP id 8EA3052DF49 for ; Fri, 12 Feb 2021 19:28:28 +0000 (UTC) (envelope-from kevans@freebsd.org) Received: from smtp.freebsd.org (smtp.freebsd.org [96.47.72.83]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "smtp.freebsd.org", Issuer "R3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4Dck7J3gNWz3nlL; Fri, 12 Feb 2021 19:28:28 +0000 (UTC) (envelope-from kevans@freebsd.org) Received: from mail-qt1-f175.google.com (mail-qt1-f175.google.com [209.85.160.175]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (Client CN "smtp.gmail.com", Issuer "GTS CA 1O1" (verified OK)) (Authenticated sender: kevans) by smtp.freebsd.org (Postfix) with ESMTPSA id 6C70F4FE6; Fri, 12 Feb 2021 19:28:28 +0000 (UTC) (envelope-from kevans@freebsd.org) Received: by mail-qt1-f175.google.com with SMTP id n28so416933qtv.12; Fri, 12 Feb 2021 11:28:28 -0800 (PST) X-Gm-Message-State: AOAM532EfQF0YEG+Ar72PT/FwfNkGfs9nBy9UBVtnKje1uDVpKlloh5p Q3SxW7bE5SpoJxL41oz29s+krYpidN7H2i0drQ8= X-Google-Smtp-Source: ABdhPJwY5+3vnUJRhzR3uLH8DQCnTTTAj4auQkeMB31HCmfyHYHMa0F7LkWbRsRRmn+zEYHkUxpoY1fovfq2rVOmOuc= X-Received: by 2002:ac8:100b:: with SMTP id z11mr3956168qti.60.1613158107998; Fri, 12 Feb 2021 11:28:27 -0800 (PST) MIME-Version: 1.0 References: <8f7cdfd9-7c4f-2e5d-948c-34ae45f1c9d@prime.gushi.org> In-Reply-To: <8f7cdfd9-7c4f-2e5d-948c-34ae45f1c9d@prime.gushi.org> From: Kyle Evans Date: Fri, 12 Feb 2021 13:28:14 -0600 X-Gmail-Original-Message-ID: Message-ID: Subject: Re: splitting ca_root_nss into component pem files To: "Dan Mahoney (Gushi)" Cc: questions@freebsd.org, Allan Jude Content-Type: text/plain; charset="UTF-8" X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 12 Feb 2021 19:28:28 -0000 On Fri, Feb 12, 2021 at 1:23 PM Dan Mahoney (Gushi) wrote: > > Allan (and all), > > I notice FreeBSD now comes with certctl which knows how to split and > manage trusted SSL certs. FreeBSD 12.2 includes a /usr/share/ssl/certs > directory now (no mention of that in the release notes?) and a tool called > certctl. > > Certctl has (for some reason) been backported to 11.x, where there are no > individual certs provided by default, so I'm confused as to why this is. > I fully intended to ship 11.4 with them, but pulled them at the last minute due to some issues with certctl. > ca_root_nss only provides a monolithic cert. > > Some apps require a directory of hashes and symlinks. This is common, > especially when you want to trust your local CA as well as the netscape > ones. Additionally, some tools (like sendmail) seem to require the > symlinked approach. > > Is there a tool (installed with base, or from ports) that will do this > splitting of ca_root_nss, to some standard directory? (certctl doesn't > appear to). > I have some local WIP that's going to split ca_root_nss out like the base bundle is, so that it's compatible with certctl and friends. My vision is that ca_root_nss will provide more expedient updates of the bundle to folks that need it on a better timeline than EN/SA can deliver. > Should this not be a standard thing in the pkg-message for ca_root_nss? > > (This seems to be a tangly problem to google). > > Note I solved this myself a few years back: > https://gushi.dreamwidth.org/1064679.html, but I'd like to have a "right" > answer. > > But...this feels like something that should have a base tool AND be in the > handbook, since the *removal* of a cert from ca_root_nss will cause users > to still trust it -- a clean rebuild should be possible. > Right, that's the problem I'm hoping to solve by splitting ca_root_nss up. Thanks, Kyle Evans