The Mozilla CA root certificate bundle
c4c1a32e95
Fix the updated merge scripts to handle this.
Prune Expired certificates from certdata.txt and the object signing cert list
Update to CKBI 2.48 from NSS 3.64
Removing:
# Certificate "Verisign Class 3 Public Primary Certification Authority - G3"
# Certificate "GeoTrust Universal CA 2"
# Certificate "QuoVadis Root CA"
# Certificate "Sonera Class 2 Root CA"
# Certificate "Taiwan GRCA"
# Certificate "VeriSign Class 3 Public Primary Certification Authority - G4"
# Certificate "EE Certification Centre Root CA"
# Certificate "LuxTrust Global Root 2"
# Certificate "Symantec Class 1 Public Primary Certification Authority - G4"
# Certificate "Symantec Class 2 Public Primary Certification Authority - G4"
Adding:
# Certificate "Microsoft ECC Root Certificate Authority 2017"
# Certificate "Microsoft RSA Root Certificate Authority 2017"
# Certificate "e-Szigno Root CA 2017"
# Certificate "certSIGN Root CA G2"
# Certificate "Trustwave Global Certification Authority"
# Certificate "Trustwave Global ECC P256 Certification Authority"
# Certificate "Trustwave Global ECC P384 Certification Authority"
# Certificate "NAVER Global Root Certification Authority"
# Certificate "AC RAIZ FNMT-RCM SERVIDORES SEGUROS"
# Certificate "GlobalSign Secure Mail Root R45"
# Certificate "GlobalSign Secure Mail Root E45"
# Certificate "GlobalSign Root R46"
# Certificate "GlobalSign Root E46"
# Certificate "Certum EC-384 CA"
# Certificate "Certum Trusted Root CA"
# Certificate "GlobalSign Code Signing Root R45"
# Certificate "GlobalSign Code Signing Root E45"
# Certificate "Halcom Root Certificate Authority"
# Certificate "Symantec Class 3 Public Primary Certification Authority - G6"
# Certificate "GLOBALTRUST"
# Certificate "MULTICERT Root Certification Authority 01"
# Certificate "Verizon Global Root CA"
# Certificate "Tunisian Root Certificate Authority - TunRootCA2"
# Certificate "CAEDICOM Root"
# Certificate "COMODO Certification Authority"
# Certificate "Security Communication ECC RootCA1"
# Certificate "Security Communication RootCA3"
# Certificate "AC RAIZ DNIE"
# Certificate "VeriSign Class 3 Public Primary Certification Authority - G3"
# Certificate "NetLock Platina (Class Platinum) Főtanúsítvány"
# Certificate "GLOBALTRUST 2015"
# Certificate "emSign Root CA - G2"
# Certificate "emSign Root CA - C2"
|
||
|---|---|---|
| tests | ||
| .gitignore | ||
| ca-certificates.spec | ||
| ca-legacy | ||
| ca-legacy.8.txt | ||
| ca-legacy.conf | ||
| certdata2pem.py | ||
| certdata.txt | ||
| check_certs.sh | ||
| fetch_objsign.sh | ||
| fetch.sh | ||
| mergepem2certdata.py | ||
| nssckbi.h | ||
| README.edk2 | ||
| README.etc | ||
| README.extr | ||
| README.java | ||
| README.openssl | ||
| README.pem | ||
| README.src | ||
| README.usr | ||
| sort-blocks.py | ||
| sources | ||
| trust-fixes | ||
| update-ca-trust | ||
| update-ca-trust.8.txt | ||
This directory /usr/share/pki/ca-trust-source/ contains CA certificates and
trust settings in the PEM file format. The trust settings found here will be
interpreted with a low priority - lower than the ones found in
/etc/pki/ca-trust/source/ .
=============================================================================
QUICK HELP: To add a certificate in the simple PEM or DER file formats to the
list of CAs trusted on the system:
Copy it to the
/usr/share/pki/ca-trust-source/anchors/
subdirectory, and run the
update-ca-trust
command.
If your certificate is in the extended BEGIN TRUSTED file format,
then place it into the main source/ directory instead.
=============================================================================
Please refer to the update-ca-trust(8) manual page for additional information.