rpms/ca-certificates
7
0
Fork 0
Code Issues Pull Requests Releases Activity
9bf988861b
ca-certificates/README.src

21 lines
932 B
Plaintext
Raw Normal View History

* Fri Mar 08 2013 Kai Engert <kaie@redhat.com> - 2012.87-9 - Major rework for the Fedora SharedSystemCertificates feature. - Only ship a PEM bundle file using the BEGIN TRUSTED CERTIFICATE file format. - Require the p11-kit package that contains tools to automatically create other file format bundles. - Convert old file locations to symbolic links that point to dynamically generated files. - Old files, which might have been locally modified, will be saved in backup files with .rpmsave extension. - Added a update-ca-certificates script which can be used to regenerate the merged trusted output. - Refer to the various README files that have been added for more detailed explanation of the new system. - No longer require rsc for building. - Add explanation for the future version numbering scheme, because the old numbering scheme was based on upstream using cvs, which is no longer true, and therefore can no longer be used. - Includes changes from rhbz#873369.
2013-03-08 23:09:26 +00:00
This directory /etc/pki/ca-trust/source/ contains CA certificates and
trust settings in the PEM file format. The trust settings found here will be
* Tue Mar 19 2013 Kai Engert <kaie@redhat.com> - 2012.87-11 - adjust to changed and new functionality provided by p11-kit 0.17.3 - updated READMEs to describe the new directory-specific treatment of files - ship a new file that contains certificates with neutral trust - ship a new file that contains distrust objects, and also staple a basic constraint extension to one legacy root contained in the Mozilla CA list - adjust the build script to dynamically produce most of above files - add and own the anchors and blacklist subdirectories - file generate-cacerts.pl is no longer required
2013-03-23 23:36:13 +00:00
interpreted with a high priority - higher than the ones found in
* Fri Mar 08 2013 Kai Engert <kaie@redhat.com> - 2012.87-9 - Major rework for the Fedora SharedSystemCertificates feature. - Only ship a PEM bundle file using the BEGIN TRUSTED CERTIFICATE file format. - Require the p11-kit package that contains tools to automatically create other file format bundles. - Convert old file locations to symbolic links that point to dynamically generated files. - Old files, which might have been locally modified, will be saved in backup files with .rpmsave extension. - Added a update-ca-certificates script which can be used to regenerate the merged trusted output. - Refer to the various README files that have been added for more detailed explanation of the new system. - No longer require rsc for building. - Add explanation for the future version numbering scheme, because the old numbering scheme was based on upstream using cvs, which is no longer true, and therefore can no longer be used. - Includes changes from rhbz#873369.
2013-03-08 23:09:26 +00:00
/usr/share/pki/ca-trust-source/.
* Tue Mar 19 2013 Kai Engert <kaie@redhat.com> - 2012.87-11 - adjust to changed and new functionality provided by p11-kit 0.17.3 - updated READMEs to describe the new directory-specific treatment of files - ship a new file that contains certificates with neutral trust - ship a new file that contains distrust objects, and also staple a basic constraint extension to one legacy root contained in the Mozilla CA list - adjust the build script to dynamically produce most of above files - add and own the anchors and blacklist subdirectories - file generate-cacerts.pl is no longer required
2013-03-23 23:36:13 +00:00
=============================================================================
QUICK HELP: To add a certificate in the simple PEM or DER file formats to the
list of CAs trusted on the system:
* Fri Mar 08 2013 Kai Engert <kaie@redhat.com> - 2012.87-9 - Major rework for the Fedora SharedSystemCertificates feature. - Only ship a PEM bundle file using the BEGIN TRUSTED CERTIFICATE file format. - Require the p11-kit package that contains tools to automatically create other file format bundles. - Convert old file locations to symbolic links that point to dynamically generated files. - Old files, which might have been locally modified, will be saved in backup files with .rpmsave extension. - Added a update-ca-certificates script which can be used to regenerate the merged trusted output. - Refer to the various README files that have been added for more detailed explanation of the new system. - No longer require rsc for building. - Add explanation for the future version numbering scheme, because the old numbering scheme was based on upstream using cvs, which is no longer true, and therefore can no longer be used. - Includes changes from rhbz#873369.
2013-03-08 23:09:26 +00:00
* Tue Mar 19 2013 Kai Engert <kaie@redhat.com> - 2012.87-11 - adjust to changed and new functionality provided by p11-kit 0.17.3 - updated READMEs to describe the new directory-specific treatment of files - ship a new file that contains certificates with neutral trust - ship a new file that contains distrust objects, and also staple a basic constraint extension to one legacy root contained in the Mozilla CA list - adjust the build script to dynamically produce most of above files - add and own the anchors and blacklist subdirectories - file generate-cacerts.pl is no longer required
2013-03-23 23:36:13 +00:00
Copy it to the
/etc/pki/ca-trust/source/anchors/
subdirectory, and run the
update-ca-trust
command.
* Fri Mar 08 2013 Kai Engert <kaie@redhat.com> - 2012.87-9 - Major rework for the Fedora SharedSystemCertificates feature. - Only ship a PEM bundle file using the BEGIN TRUSTED CERTIFICATE file format. - Require the p11-kit package that contains tools to automatically create other file format bundles. - Convert old file locations to symbolic links that point to dynamically generated files. - Old files, which might have been locally modified, will be saved in backup files with .rpmsave extension. - Added a update-ca-certificates script which can be used to regenerate the merged trusted output. - Refer to the various README files that have been added for more detailed explanation of the new system. - No longer require rsc for building. - Add explanation for the future version numbering scheme, because the old numbering scheme was based on upstream using cvs, which is no longer true, and therefore can no longer be used. - Includes changes from rhbz#873369.
2013-03-08 23:09:26 +00:00
* Tue Mar 19 2013 Kai Engert <kaie@redhat.com> - 2012.87-11 - adjust to changed and new functionality provided by p11-kit 0.17.3 - updated READMEs to describe the new directory-specific treatment of files - ship a new file that contains certificates with neutral trust - ship a new file that contains distrust objects, and also staple a basic constraint extension to one legacy root contained in the Mozilla CA list - adjust the build script to dynamically produce most of above files - add and own the anchors and blacklist subdirectories - file generate-cacerts.pl is no longer required
2013-03-23 23:36:13 +00:00
If your certificate is in the extended BEGIN TRUSTED file format,
then place it into the main source/ directory instead.
=============================================================================
- added a manual page and related build requirements - simplify the README files now that we have a manual page - set a certificate alias in trusted bundle (thanks to Ludwig Nussel)
2013-07-08 22:59:15 +00:00
Please refer to the update-ca-trust(8) manual page for additional information.
Reference in New Issue Copy Permalink