Re: gpg ca-cert-file=[which file???]
- Date: Mon, 17 Jul 2017 07:35:17 -0400
- From: Lee <ler762@xxxxxxxxx>
- Subject: Re: gpg ca-cert-file=[which file???]
On 7/16/17, René Berber wrote:
> On 7/16/2017 11:38 AM, Lee wrote:
>> ok... man update-ca-trust
>> Classic filename, file contains a list of CA certificates in
>> the extended BEGIN/END TRUSTED CERTIFICATE file format,
>> which includes trust (and/or distrust) flags specific to
>> certificate usage. This file is a symbolic link that refers
>> to the consolidated output created by the update-ca-trust
>> It looks like there's some certs in
>> /etc/pki/ca-trust/extracted/openssl/ca-bundle.trust.crt that I don't
>> want to trust.. but how to tell which ones & how to set
>> distrust/blacklist trust flags on them? or maybe I need to copy them
>> to /etc/pki/ca-trust/source/blacklist/ ???
>> Anyone have any pointers on how to distrust certs in
>> ca-bundle.trust.crt (assuming that _is_ the file I should be using) or
>> even how to show exactly what's in there?
>> $ grep "#" ca-bundle.trust.crt
>> shows lots of comments but
>> $ openssl x509 -in ca-bundle.trust.crt -noout -subject -dates
>> just shows me the first cert :(
> You should refer to the package announcement, and direct any questions
> about the package (not about its use) to its maintainer.
I came across this when looking for the ca-certificates package announcement:
it's from 2013:
It has been brought to my attention that gnutls does not seem to be
configured to use ca-certificates by default. This can be enabled by
adding --with-default-trust-store-file=/usr/ssl/certs/ca-bundle.crt to
I'm still not clear about which trust store I should be using -
ca-bundle.crt or ca-bundle.trust.crt
> As I understand the package is just a bundle of the files distributed by
> Mozilla (which is the maintainer of the root certs). For questions
> about those files, its contents, or its use... refer to Mozilla.
As far as I can tell, Mozilla thinks using their trust store for
anything other than firefox is out of scope - eg:
Configuring Graduated Trust for Non-Browser Consumption
> Actually Mozilla distributes one file, which is then processed to create
> all the files that you see.
> The link you show to Mozilla about the trust on CNNIC also points out
> that the exception is made in code (i.e. hard-coded), and if you look
> above it clearly states: "The status of whether a root is approved to
> issue EV certificates or not is stored in PSM rather than certdata.txt",
> this certdata.txt is precisely the file I'm talking about above, so
> don't expect any of those Extended Validation changes to be present (and
> you can ask Mozilla why they do it in code, instead of in the certs).
I don't care about EV right now. I don't want to trust any
certificate issued by CNNIC & a few other CAs. How do I do that?
Problem reports: http://cygwin.com/problems.html
Unsubscribe info: http://cygwin.com/ml/#unsubscribe-simple