aboutsummaryrefslogtreecommitdiff
path: root/lib/mk-ca-bundle.pl
AgeCommit message (Collapse)Author
2020-04-22lib/mk-ca-bundle: skip empty certsDaniel Stenberg
Reviewed-by: Emil Engler Reported-by: Ashwin Metpalli Fixes #5278 Closes #5280
2020-01-22mk-ca-bundle: add support for CKA_NSS_SERVER_DISTRUST_AFTERDaniel Stenberg
For now, no cert in the bundle actually sets a date there... Co-Authored-by: Jay Satiro Reported-by: Christian Heimes Fixes #4834 Closes #4836
2018-06-14mk-ca-bundle.pl: make -u delete certdata.txt if found not changedMatteo Bignotti
certdata.txt should be deleted also when the process is interrupted by "same certificate downloaded, exiting" The certdata.txt is currently kept on disk even if you give the -u option Closes #2655
2018-06-08mk-ca-bundle.pl: leave certificate name untouched in decode()Vladimir Kotal
Closes #2640
2018-01-07scripts: allow all perl scripts to be run directlyJay Satiro
- Enable execute permission (chmod +x) - Change interpreter to /usr/bin/env perl Closes https://github.com/curl/curl/pull/2222
2017-10-22mk-ca-bundle: Remove URL for auroraJon DeVree
Aurora is no longer used by Mozilla https://hacks.mozilla.org/2017/04/simplifying-firefox-release-channels/
2017-10-22mk-ca-bundle: Fix URL for NSSJon DeVree
The 'tip' is the most recent branch committed to, this should be 'default' like the URLs for the browser are. Closes #1998
2017-06-16mk-ca-bundle.pl: Check curl's exit code after certdata downloadJay Satiro
- No longer allow partial downloads of certdata. Prior to this change partial downloads were (erroneously?) allowed since only the server code was checked to be 200. Bug: https://github.com/curl/curl/pull/1577 Reported-by: Matteo B.
2016-10-30mk-ca-bundle.vbs: Fix UTF-8 outputJay Satiro
- Change initial message box to mention delay when downloading/parsing. Since there is no progress meter it was somewhat unexpected that after choosing a filename nothing appears to happen, when actually the cert data is in the process of being downloaded and parsed. - Warn if OpenSSL is not present. - Use a UTF-8 stream to make the ca-bundle data. - Save the UTF-8 ca-bundle stream as binary so that no BOM is added. --- This is a follow-up to d2c6d15 which switched mk-ca-bundle.vbs output to ANSI due to corrupt UTF-8 output, now fixed. This change completes making the default certificate bundle output of mk-ca-bundle.vbs as close as possible to that of mk-ca-bundle.pl, which should make it easier to review any difference between their output. Ref: https://github.com/curl/curl/pull/1012
2016-10-25mk-ca-bundle: Update the vbscript versionJay Satiro
Bring the VBScript version more in line with the perl version: - Change timestamp to UTC. - Change URL retrieval to HTTPS-only by default. - Comment out the options that disabled SSL cert checking by default. - Assume OpenSSL is present, get SHA256. And add a flag to toggle it. - Fix cert issuer name output. The cert issuer output is now ansi, converted from UTF-8. Prior to this it was corrupt UTF-8. It turns out though we can work with UTF-8 the FSO object that writes ca-bundle can't write UTF-8, so there will have to be some alternative if UTF-8 is needed (like an ADODB.Stream). - Disable the certificate text info feature. The certificate text info doesn't work properly with any recent OpenSSL.
2016-10-24mk-ca-bundle: Change URL retrieval to HTTPS-only by defaultJay Satiro
- Change all predefined Mozilla URLs to HTTPS (Gregory Szorc). - New option -k to allow URLs other than HTTPS and enable HTTP fallback. Prior to this change the default URL retrieval mode was to fall back to HTTP if HTTPS didn't work. Reported-by: Gregory Szorc Closes #1012
2016-09-07mk-ca-bundle.pl: use SHA256 instead of SHA1Viktor Szakats
This hash is used to verify the original downloaded certificate bundle and also included in the generated bundle's comment header. Also rename related internal symbols to algorithm-agnostic names.
2016-08-04mk-ca-bundle.pl: -m keeps ca cert meta data in outputDaniel Stenberg
Makes the script pass on comments holding meta data to the output file. Like fingerprinters, issuer, date ranges etc. Closes #937
2016-02-03URLs: change all http:// URLs to https://Daniel Stenberg
2015-03-11mk-ca-bundle bugfix: Don't report SHA1 numbers with "-q".Alexander Pepper
Also unified printing to STDERR by creating the helper method "report".
2014-12-13mk-ca-bundle.pl: restored forced run again.Guenter Knauf
2014-10-28mk-ca-bundle: spell fix "version"Daniel Stenberg
2014-10-26Cosmetics: lowercase non-special subroutine names.Guenter Knauf
2014-10-23Some cosmetics and simplifies.Guenter Knauf
2014-10-23Remove dependency on openssl and cut.Guenter Knauf
Prefer usage of Perl modules for sha1 calculation since there might be systems where openssl is not installed or not in path. If openssl is used for sha1 calculation then dont rely on cut since it is usually not available on other systems than Linux.
2014-10-15mk-ca-bundle: added SHA-384 signature algorithmBruno Thomsen
Certificates based on SHA-1 are being phased out[1]. So we should expect a rise in certificates based on SHA-2. Adding SHA-384 as a valid signature algorithm. [1] https://blog.mozilla.org/security/2014/09/23/phasing-out-certificates-with-sha-1-based-signature-algorithms/ Signed-off-by: Bruno Thomsen <bth@kamstrup.dk>
2014-09-11mk-ca-bundle.pl: converted tabs to spaces, deleted trailing spacesViktor Szakáts
2014-09-10mk-ca-bundle.pl: first, try downloading HTTPS with curlDaniel Stenberg
As a sort of step forward, this script will now first try to get the data from the HTTPS URL using curl, and only if that fails it will switch back to the HTTP transfer using perl's native LWP functionality. To reduce the risk of this script being tricked. Using HTTPS to get a cert bundle introduces a chicken-and-egg problem so we can't really ever completely disable HTTP, but chances are that most users already have a ca cert bundle that trusts the mozilla.org site that this script downloads from. A future version of this script will probably switch to require a dedicated "insecure" command line option to allow downloading over HTTP (or unverified HTTPS).
2014-08-13mk-ca-bundle.pl: add missing $Daniel Stenberg
2014-08-13mk-ca-bundle.pl: switched to using hg.mozilla.orgDaniel Stenberg
... as mxr.mozilla.org is due to be retired. The new host doesn't support If-Modified-Since nor ETags, meaning that the script will now defer to download and do a post-transfer checksum check to see if a new output is to be generated. The new output format will hold the SHA1 checksum of the source file for that purpose. We call this version 1.22 Reported-by: Ed Morley Bug: http://curl.haxx.se/bug/view.cgi?id=1409
2014-05-08mk-ca-bundle: added -pPatrick Watson
-p takes a list of Mozilla trust purposes and levels for certificates to include in output. Takes the form of a comma separated list of purposes, a colon, and a comma separated list of levels.
2014-01-05mk-ca-bundle.pl: avoid warnings with -d without parameterDaniel Stenberg
2014-01-05mk-ca-bundle: introduces -d and warns about using this scriptLeif W
2013-08-05Simplify check for trusted certificates.Guenter Knauf
This changes the previous check for untrusted certs to a check for certs explicitely marked as trusted. The change is backward-compatible (tested with certdata.txt v1.80).
2013-08-04Skip more untrusted certificates.Guenter Knauf
Christian Heimes brought to our attention that the certdata.txt format has recently changed [1], causing ca-bundle.crt created with mk-ca-bundle.[pl|vbs] to include untrusted certs. [1] http://lists.debian.org/debian-release/2012/11/msg00411.html
2013-04-10Fixed lost OpenSSL output with "-t" - followup.Guenter Knauf
The previously applied patch didnt work on Windows; we cant rely on shell commands like 'echo' since they act diffently on each platform and each shell. In order to keep this script platform-independent the code must only use pure Perl.
2013-04-09Fixed lost OpenSSL output with "-t".Guenter Knauf
The OpenSSL pipe wrote to the final CA bundle file, but the encoded PEM output wrote to a temporary file. Consequently, the OpenSSL output was lost when the temp file was renamed to the final file at script finish (overwriting the final file written earlier by openssl). Patch posted to the list by Richard Michael (rmichael edgeofthenet org).
2013-04-04Another small output fix for --help and --version.Guenter Knauf
2013-04-04Fixed version output.Guenter Knauf
2013-04-04Added support for --help and --version options.Guenter Knauf
2013-04-04Added option to specify length of base64 output.Guenter Knauf
Based on a patch posted to the list by Richard Michael.
2013-01-05mk-ca-bundle: add -f, support passing to stdout and moreDaniel Stenberg
1. When the downloaded data file from Mozilla is current, but the output bundle does not exist: continue processing to create the bundle. The goal is to have the output file - not just download the latest input. 2. added -f option to force re-processing the file. Useful for debugging/testing the process. 3. added support for output to '-' (stdout), allowing the output to be piped. 4. All progress and error messages go to STDERR rather than STDOUT (3) 5. The script opened and closed the output file many times unnecessarily. It now opens it once, does the output and closes it. 6. Backup of the input files happens after successful processing, not before. 7. The output is written to a temporary file, and renamed to the requested name after backup - this greatly reduces the window where the file can be seen partially written. 8. all die calls have a \n at the end to suppress perl's traceback - the traceback isn't useful to end users. Patch: http://curl.haxx.se/mail/lib-2013-01/0045.html
2012-09-04mk-ca-bundle: detect start of trust section betterDaniel Stenberg
Each certificate section of the input certdata.txt file has a trust section following it with details. This script failed to detect the start of the trust for at least one cert[*], which made the script continue pass that section into the next one where it found an 'untrusted' marker and as a result that certficate was not included in the output. [*] = "Hellenic Academic and Research Institutions RootCA 2011" Bug: http://curl.haxx.se/mail/lib-2012-09/0019.html
2012-04-04Revert "access the CA source file using HTTPS"Tim Heckman
This reverts commit f7e2ab6. This change caused fetching of the certificates to become unreliable. Bug: http://curl.haxx.se/mail/lib-2012-03/0238.html Reported by: Tim Heckman
2012-03-31Revert "mk-ca-bundle.pl: use LWP::UserAgent for https"Daniel Stenberg
This reverts commit 9f0e1689f169b83b8fbdae23e0024cc57dcbc770. It turned out that "improvement" instead made the fetching of the certificates unreliable Bug: http://curl.haxx.se/mail/lib-2012-03/0238.html Reported by: Tim Heckman
2012-03-10mk-ca-bundle.pl: use LWP::UserAgent with proper https verify behavior.John Joseph Bachir
An alternative would be: 1. specify HTTPS_CA_DIR and/or HTTPS_CA_FILE 2. ensure that Net::SSL is being used, and IO::Socket::SSL is NOT being used This question and answer explain: http://stackoverflow.com/questions/74358/
2012-03-10access the CA source file using HTTPSJohn Joseph Bachir
2011-09-20Also skip certs masked as CKT_NSS_TRUST_UNKNOWN.Guenter Knauf
Fix posted by Tomas Hoger <thoger redhat com>.
2011-09-04Fixed final message output.Guenter Knauf
2011-09-04Fix to skip untrusted certs.Guenter Knauf
2011-04-14Replaced var manipulations with perlish hacks.Guenter Knauf
2011-04-07mk-ca-bundle.pl: show full URL in outputDaniel Stenberg
When I decided to search for a potential error with the cacert bundle it struck me I wanted to see the full source URL in the output...
2011-04-01Increased script version.Guenter Knauf
2011-04-01Make use of proxy vars if set.Guenter Knauf
Posted to the list by Quanah Gibson-Mount [quanah zimbra.com].
2011-04-01Use var again instead of hard-coded filename.Guenter Knauf
generated by cgit v1.2.3 (git 2.25.1) at 2024-06-02 15:45:58 +0000