Re: gpg ca-cert-file=[which file???]

["René Berber" <rene.berber@gmail.com>]

On 7/16/2017 11:38 AM, Lee wrote:

[snip]
>   ok... man update-ca-trust
>   FILES
>      /etc/pki/tls/certs/ca-bundle.trust.crt
>         Classic filename, file contains a list of CA certificates in
> the extended BEGIN/END TRUSTED CERTIFICATE file format,
>         which includes trust (and/or distrust) flags specific to
> certificate usage. This file is a symbolic link that refers
>         to the consolidated output created by the update-ca-trust command.
[snip]
> It looks like there's some certs in
> /etc/pki/ca-trust/extracted/openssl/ca-bundle.trust.crt that I don't
> want to trust.. but how to tell which ones & how to set
> distrust/blacklist trust flags on them?  or maybe I need to copy them
> to /etc/pki/ca-trust/source/blacklist/ ???
> 
> Anyone have any pointers on how to distrust certs in
> ca-bundle.trust.crt (assuming that _is_ the file I should be using) or
> even how to show exactly what's in there?
> $ grep "#" ca-bundle.trust.crt
>  shows lots of comments but
> $ openssl x509  -in ca-bundle.trust.crt -noout -subject -dates
>  just shows me the first cert :(

You should refer to the package announcement, and direct any questions
about the package (not about its use) to its maintainer.

As I understand the package is just a bundle of the files distributed by
Mozilla (which is the maintainer of the root certs).  For questions
about those files, its contents, or its use... refer to Mozilla.

Actually Mozilla distributes one file, which is then processed to create
all the files that you see.

The link you show to Mozilla about the trust on CNNIC also points out
that the exception is made in code (i.e. hard-coded), and if you look
above it clearly states: "The status of whether a root is approved to
issue EV certificates or not is stored in PSM rather than certdata.txt",
this certdata.txt is precisely the file I'm talking about above, so
don't expect any of those Extended Validation changes to be present (and
you can ask Mozilla why they do it in code, instead of in the certs).
-- 
R. Berber


--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple