Skip to content
Snippets Groups Projects

ca-certificates bundle incorrectly excludes root CAs with CKA_NSS_SERVER_DISTRUST_AFTER

    • Closed Issue created by Lucas Azzola @azz1

    The build script in ca-certificates incorrectly omits CA roots with a "DistrustAfter" attribute.

    See this fix in curl: https://github.com/curl/curl/commit/448df98d9280b3290ecf63e5fc9452d487f41a7c#diff-672849fde302af412196cdff759aa84b274074a01561227ee4f8c102c1ee346dL556

    And curl issue report here: https://github.com/curl/curl/issues/15547

    This fix should be included in ca-certificates: https://gitlab.alpinelinux.org/alpine/ca-certificates/-/blob/master/mk-ca-bundle.pl?ref_type=heads#L555-600

    https://sslmate.com/blog/post/entrust_distrust_more_disruptive_than_intended

    Impact: Any consumers of ca-certificates@20241121-r0 connecting to an Entrust G2-issued certificate will fail outright. The intended behaviour is that leaf certificates issued only after the "distrust after" date should be distrusted. Not all certificates.

    Edited
    To upload designs, you'll need to enable LFS and have an admin enable hashed storage. More information

    Child items ...

    • Activity

    Please register or sign in to reply