X-Recipient:	archive-cygwin AT delorie DOT com
DomainKey-Signature:	a=rsa-sha1; c=nofws; d=sourceware.org; h=list-id
	:list-unsubscribe:list-subscribe:list-archive:list-post
	:list-help:sender:to:from:subject:date:message-id:references
	:mime-version:content-type:content-transfer-encoding
	:in-reply-to; q=dns; s=default; b=uYJRBwHpn8ISHr/l7X0ggZFHctTyd6
	BIspetiQpaX5Pgako++HD7riL3OtacwN6PlYyCPSgx2vMiZ8A6LGYN1oB3w/cXyO
	nAU6JvBMQ9KBdRgfCvP2PPX2cL0GptQQd4QjusUO4Kh+w6gtCMKmcKI6OdlOrK4r
	Pvv15uCvQi/nc=
DKIM-Signature:	v=1; a=rsa-sha1; c=relaxed; d=sourceware.org; h=list-id
	:list-unsubscribe:list-subscribe:list-archive:list-post
	:list-help:sender:to:from:subject:date:message-id:references
	:mime-version:content-type:content-transfer-encoding
	:in-reply-to; s=default; bh=PKnqwvNc05+hItMyTIql/v2MQZY=; b=q9iI
	ZbnZIdDzyfaWtIvTihySGtfCjS7GBoNvbphL+CD8L0eck/LJAdwvzaIfkbTV2w05
	ECsOT8ALL1IYP7mqJs1202+bzzz2n+Cu8N/O0Djq3FpRWmHmo5ycaHqWNnVS+YRP
	pEqz1PXY27AEhVLpmv0YWWnE6FzopERIb2fLYFc=
Mailing-List:	contact cygwin-help AT cygwin DOT com; run by ezmlm
List-Id:	<cygwin.cygwin.com>
List-Subscribe:	<mailto:cygwin-subscribe AT cygwin DOT com>
List-Archive:	<http://sourceware.org/ml/cygwin/>
List-Post:	<mailto:cygwin AT cygwin DOT com>
List-Help:	<mailto:cygwin-help AT cygwin DOT com>, <http://sourceware.org/ml/#faqs>
Sender:	cygwin-owner AT cygwin DOT com
Mail-Followup-To:	cygwin AT cygwin DOT com
Delivered-To:	mailing list cygwin AT cygwin DOT com
Authentication-Results:	sourceware.org; auth=none
X-Virus-Found:	No
X-Spam-SWARE-Status:	No, score=1.8 required=5.0 tests=BAYES_50,FREEMAIL_FROM,KAM_LAZY_DOMAIN_SECURITY autolearn=no version=3.3.2 spammy=H*UA:en-US, H*u:en-US, H*u:5.1, ca-trust
X-HELO:	blaine.gmane.org
To:	cygwin AT cygwin DOT com
From:	=?UTF-8?Q?Ren=c3=a9_Berber?= <rene DOT berber AT gmail DOT com>
Subject:	Re: gpg ca-cert-file=[which file???]
Date:	Sun, 16 Jul 2017 14:39:13 -0500
Lines:	45
Message-ID:	<okgfdb$n59$1@blaine.gmane.org>
References:	<CAD8GWsvT9rgHz+vcdBmX-opfckZS8g06_Px57JCNG_xCT_ku6A AT mail DOT gmail DOT com> <okef84$e7f$1 AT blaine DOT gmane DOT org> <CAD8GWsuvpZqOmajdyBBSNza20un_BZuJOdRH15XhKFqzx4H3OA AT mail DOT gmail DOT com> <okesn6$agb$1 AT blaine DOT gmane DOT org> <CAD8GWsuMuda5O2X-1N_q8TpZ_wZQBhEEJpfdA1eQO+x1iDLH5A AT mail DOT gmail DOT com>
Mime-Version:	1.0
User-Agent:	Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.19) Gecko/20081209 Lightning/0.9 Thunderbird/2.0.0.19 Mnenhy/0.7.6.0
In-Reply-To:	<CAD8GWsuMuda5O2X-1N_q8TpZ_wZQBhEEJpfdA1eQO+x1iDLH5A@mail.gmail.com>
X-IsSubscribed:	yes

On 7/16/2017 11:38 AM, Lee wrote:

[snip]
>   ok... man update-ca-trust
>   FILES
>      /etc/pki/tls/certs/ca-bundle.trust.crt
>         Classic filename, file contains a list of CA certificates in
> the extended BEGIN/END TRUSTED CERTIFICATE file format,
>         which includes trust (and/or distrust) flags specific to
> certificate usage. This file is a symbolic link that refers
>         to the consolidated output created by the update-ca-trust command.
[snip]
> It looks like there's some certs in
> /etc/pki/ca-trust/extracted/openssl/ca-bundle.trust.crt that I don't
> want to trust.. but how to tell which ones & how to set
> distrust/blacklist trust flags on them?  or maybe I need to copy them
> to /etc/pki/ca-trust/source/blacklist/ ???
> 
> Anyone have any pointers on how to distrust certs in
> ca-bundle.trust.crt (assuming that _is_ the file I should be using) or
> even how to show exactly what's in there?
> $ grep "#" ca-bundle.trust.crt
>  shows lots of comments but
> $ openssl x509  -in ca-bundle.trust.crt -noout -subject -dates
>  just shows me the first cert :(

You should refer to the package announcement, and direct any questions
about the package (not about its use) to its maintainer.

As I understand the package is just a bundle of the files distributed by
Mozilla (which is the maintainer of the root certs).  For questions
about those files, its contents, or its use... refer to Mozilla.

Actually Mozilla distributes one file, which is then processed to create
all the files that you see.

The link you show to Mozilla about the trust on CNNIC also points out
that the exception is made in code (i.e. hard-coded), and if you look
above it clearly states: "The status of whether a root is approved to
issue EV certificates or not is stored in PSM rather than certdata.txt",
this certdata.txt is precisely the file I'm talking about above, so
don't expect any of those Extended Validation changes to be present (and
you can ask Mozilla why they do it in code, instead of in the certs).
-- 
R. Berber


--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple

- Raw text -