From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (qmail 11211 invoked by alias); 16 Jul 2017 19:39:49 -0000 Mailing-List: contact cygwin-help@cygwin.com; run by ezmlm Precedence: bulk List-Id: List-Subscribe: List-Archive: List-Post: List-Help: , Sender: cygwin-owner@cygwin.com Mail-Followup-To: cygwin@cygwin.com Received: (qmail 11183 invoked by uid 89); 16 Jul 2017 19:39:46 -0000 Authentication-Results: sourceware.org; auth=none X-Virus-Found: No X-Spam-SWARE-Status: No, score=1.8 required=5.0 tests=BAYES_50,FREEMAIL_FROM,KAM_LAZY_DOMAIN_SECURITY autolearn=no version=3.3.2 spammy=H*UA:en-US, H*u:en-US, H*u:5.1, ca-trust X-HELO: blaine.gmane.org Received: from Unknown (HELO blaine.gmane.org) (195.159.176.226) by sourceware.org (qpsmtpd/0.93/v0.84-503-g423c35a) with ESMTP; Sun, 16 Jul 2017 19:39:45 +0000 Received: from list by blaine.gmane.org with local (Exim 4.84_2) (envelope-from ) id 1dWpO8-0006hQ-FD for cygwin@cygwin.com; Sun, 16 Jul 2017 21:39:32 +0200 To: cygwin@cygwin.com From: =?UTF-8?Q?Ren=c3=a9_Berber?= Subject: Re: gpg ca-cert-file=[which file???] Date: Sun, 16 Jul 2017 21:07:00 -0000 Message-ID: References: Mime-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 7bit User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.19) Gecko/20081209 Lightning/0.9 Thunderbird/2.0.0.19 Mnenhy/0.7.6.0 In-Reply-To: X-IsSubscribed: yes X-SW-Source: 2017-07/txt/msg00251.txt.bz2 On 7/16/2017 11:38 AM, Lee wrote: [snip] > ok... man update-ca-trust > FILES > /etc/pki/tls/certs/ca-bundle.trust.crt > Classic filename, file contains a list of CA certificates in > the extended BEGIN/END TRUSTED CERTIFICATE file format, > which includes trust (and/or distrust) flags specific to > certificate usage. This file is a symbolic link that refers > to the consolidated output created by the update-ca-trust command. [snip] > It looks like there's some certs in > /etc/pki/ca-trust/extracted/openssl/ca-bundle.trust.crt that I don't > want to trust.. but how to tell which ones & how to set > distrust/blacklist trust flags on them? or maybe I need to copy them > to /etc/pki/ca-trust/source/blacklist/ ??? > > Anyone have any pointers on how to distrust certs in > ca-bundle.trust.crt (assuming that _is_ the file I should be using) or > even how to show exactly what's in there? > $ grep "#" ca-bundle.trust.crt > shows lots of comments but > $ openssl x509 -in ca-bundle.trust.crt -noout -subject -dates > just shows me the first cert :( You should refer to the package announcement, and direct any questions about the package (not about its use) to its maintainer. As I understand the package is just a bundle of the files distributed by Mozilla (which is the maintainer of the root certs). For questions about those files, its contents, or its use... refer to Mozilla. Actually Mozilla distributes one file, which is then processed to create all the files that you see. The link you show to Mozilla about the trust on CNNIC also points out that the exception is made in code (i.e. hard-coded), and if you look above it clearly states: "The status of whether a root is approved to issue EV certificates or not is stored in PSM rather than certdata.txt", this certdata.txt is precisely the file I'm talking about above, so don't expect any of those Extended Validation changes to be present (and you can ask Mozilla why they do it in code, instead of in the certs). -- R. Berber -- Problem reports: http://cygwin.com/problems.html FAQ: http://cygwin.com/faq/ Documentation: http://cygwin.com/docs.html Unsubscribe info: http://cygwin.com/ml/#unsubscribe-simple