From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (qmail 83640 invoked by alias); 17 Jul 2017 11:35:22 -0000 Mailing-List: contact cygwin-help@cygwin.com; run by ezmlm Precedence: bulk List-Id: List-Subscribe: List-Archive: List-Post: List-Help: , Sender: cygwin-owner@cygwin.com Mail-Followup-To: cygwin@cygwin.com Received: (qmail 83571 invoked by uid 89); 17 Jul 2017 11:35:22 -0000 Authentication-Results: sourceware.org; auth=none X-Virus-Found: No X-Spam-SWARE-Status: No, score=1.3 required=5.0 tests=AWL,BAYES_50,FREEMAIL_ENVFROM_END_DIGIT,FREEMAIL_FROM,RCVD_IN_DNSWL_NONE,RCVD_IN_SORBS_SPAM,SPF_PASS autolearn=no version=3.3.2 spammy=Trust, Classic, catrust, ca-trust X-HELO: mail-io0-f170.google.com Received: from mail-io0-f170.google.com (HELO mail-io0-f170.google.com) (209.85.223.170) by sourceware.org (qpsmtpd/0.93/v0.84-503-g423c35a) with ESMTP; Mon, 17 Jul 2017 11:35:20 +0000 Received: by mail-io0-f170.google.com with SMTP id h134so41486784iof.2 for ; Mon, 17 Jul 2017 04:35:20 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:content-transfer-encoding; bh=r5KHWi1CKubvvfNxahDH7yxlwvxEe7nlwylaThArsnU=; b=cBZmWrdZygzTpOcUxKenZ4V6TufBX8/xT0kEtndnirYSsW/3UKek8uID6lXEG4rvgy Ukkvk5fP8A5gX2QYb+OYjGAbfFzBNZYwJJR3oHSJXNhYuBw+MdckvR40s5WM+O7YsSLV KvbmmRV5IlasGM4rw6E8I5pCaYCJHAaYV+P6CgzjXZEC7nTvi56CbvS/kJJmASvNsLEM lXRE6Xji09H/7nhercWLSiW8sL9LD/c188BBFoWS/ruUGcuWQycCTygFmh8Vv++bdtGr mpMR+SIGCHYO+DSO7B3tP3NiiX5kE0DvvTrmEcA9E92d0UUwJ3tzOuP2QmnzDaBjlkdT Gb5g== X-Gm-Message-State: AIVw112fbvIQRO4yvUTfNCjmk+wlIoxg3Ddhk1DZUVaoudmWfCRTv6Jp D1Ct0I5zDzPO7aqFodaL1rkkXOBpvA== X-Received: by 10.107.12.28 with SMTP id w28mr21056208ioi.150.1500291318549; Mon, 17 Jul 2017 04:35:18 -0700 (PDT) MIME-Version: 1.0 Received: by 10.79.155.66 with HTTP; Mon, 17 Jul 2017 04:35:17 -0700 (PDT) In-Reply-To: References: From: Lee Date: Mon, 17 Jul 2017 13:40:00 -0000 Message-ID: Subject: Re: gpg ca-cert-file=[which file???] To: cygwin@cygwin.com Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable X-IsSubscribed: yes X-SW-Source: 2017-07/txt/msg00256.txt.bz2 On 7/16/17, Ren=C3=A9 Berber wrote: > On 7/16/2017 11:38 AM, Lee wrote: > > [snip] >> ok... man update-ca-trust >> FILES >> /etc/pki/tls/certs/ca-bundle.trust.crt >> Classic filename, file contains a list of CA certificates in >> the extended BEGIN/END TRUSTED CERTIFICATE file format, >> which includes trust (and/or distrust) flags specific to >> certificate usage. This file is a symbolic link that refers >> to the consolidated output created by the update-ca-trust >> command. > [snip] >> It looks like there's some certs in >> /etc/pki/ca-trust/extracted/openssl/ca-bundle.trust.crt that I don't >> want to trust.. but how to tell which ones & how to set >> distrust/blacklist trust flags on them? or maybe I need to copy them >> to /etc/pki/ca-trust/source/blacklist/ ??? >> >> Anyone have any pointers on how to distrust certs in >> ca-bundle.trust.crt (assuming that _is_ the file I should be using) or >> even how to show exactly what's in there? >> $ grep "#" ca-bundle.trust.crt >> shows lots of comments but >> $ openssl x509 -in ca-bundle.trust.crt -noout -subject -dates >> just shows me the first cert :( > > You should refer to the package announcement, and direct any questions > about the package (not about its use) to its maintainer. I came across this when looking for the ca-certificates package announcemen= t: https://cygwin.com/ml/cygwin/2013-05/msg00385.html it's from 2013: It has been brought to my attention that gnutls does not seem to be configured to use ca-certificates by default. This can be enabled by adding --with-default-trust-store-file=3D/usr/ssl/certs/ca-bundle.crt to configure flags I'm still not clear about which trust store I should be using - ca-bundle.crt or ca-bundle.trust.crt > As I understand the package is just a bundle of the files distributed by > Mozilla (which is the maintainer of the root certs). For questions > about those files, its contents, or its use... refer to Mozilla. As far as I can tell, Mozilla thinks using their trust store for anything other than firefox is out of scope - eg: https://groups.google.com/forum/#!topic/mozilla.dev.security.policy/NHW4J= A6xoAY mozilla.dev.security.policy =E2=80=BA Configuring Graduated Trust for Non-Browser Consumption > Actually Mozilla distributes one file, which is then processed to create > all the files that you see. > > The link you show to Mozilla about the trust on CNNIC also points out > that the exception is made in code (i.e. hard-coded), and if you look > above it clearly states: "The status of whether a root is approved to > issue EV certificates or not is stored in PSM rather than certdata.txt", > this certdata.txt is precisely the file I'm talking about above, so > don't expect any of those Extended Validation changes to be present (and > you can ask Mozilla why they do it in code, instead of in the certs). I don't care about EV right now. I don't want to trust any certificate issued by CNNIC & a few other CAs. How do I do that? Thanks Lee -- Problem reports: http://cygwin.com/problems.html FAQ: http://cygwin.com/faq/ Documentation: http://cygwin.com/docs.html Unsubscribe info: http://cygwin.com/ml/#unsubscribe-simple