DomainKey-Signature: a=rsa-sha1; c=nofws; d=sourceware.org; h=list-id
	:list-unsubscribe:list-subscribe:list-archive:list-post
	:list-help:sender:to:from:subject:date:message-id:references
	:mime-version:content-type:content-transfer-encoding
	:in-reply-to; q=dns; s=default; b=uYJRBwHpn8ISHr/l7X0ggZFHctTyd6
	BIspetiQpaX5Pgako++HD7riL3OtacwN6PlYyCPSgx2vMiZ8A6LGYN1oB3w/cXyO
	nAU6JvBMQ9KBdRgfCvP2PPX2cL0GptQQd4QjusUO4Kh+w6gtCMKmcKI6OdlOrK4r
	Pvv15uCvQi/nc=
Mailing-List: contact cygwin-help@cygwin.com; run by ezmlm
Sender: cygwin-owner@cygwin.com
Mail-Followup-To: cygwin@cygwin.com
To: cygwin@cygwin.com
From: =?UTF-8?Q?Ren=c3=a9_Berber?= <rene.berber@gmail.com>
Subject: Re: gpg ca-cert-file=[which file???]
Date: Sun, 16 Jul 2017 14:39:13 -0500
Lines: 45
Message-ID: <okgfdb$n59$1@blaine.gmane.org>
References: <CAD8GWsvT9rgHz+vcdBmX-opfckZS8g06_Px57JCNG_xCT_ku6A@mail.gmail.com> <okef84$e7f$1@blaine.gmane.org> <CAD8GWsuvpZqOmajdyBBSNza20un_BZuJOdRH15XhKFqzx4H3OA@mail.gmail.com> <okesn6$agb$1@blaine.gmane.org> <CAD8GWsuMuda5O2X-1N_q8TpZ_wZQBhEEJpfdA1eQO+x1iDLH5A@mail.gmail.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.19) Gecko/20081209 Lightning/0.9 Thunderbird/2.0.0.19 Mnenhy/0.7.6.0
In-Reply-To: <CAD8GWsuMuda5O2X-1N_q8TpZ_wZQBhEEJpfdA1eQO+x1iDLH5A@mail.gmail.com>

On 7/16/2017 11:38 AM, Lee wrote:

[snip]
>   ok... man update-ca-trust
>   FILES
>      /etc/pki/tls/certs/ca-bundle.trust.crt
>         Classic filename, file contains a list of CA certificates in
> the extended BEGIN/END TRUSTED CERTIFICATE file format,
>         which includes trust (and/or distrust) flags specific to
> certificate usage. This file is a symbolic link that refers
>         to the consolidated output created by the update-ca-trust command.
[snip]
> It looks like there's some certs in
> /etc/pki/ca-trust/extracted/openssl/ca-bundle.trust.crt that I don't
> want to trust.. but how to tell which ones & how to set
> distrust/blacklist trust flags on them?  or maybe I need to copy them
> to /etc/pki/ca-trust/source/blacklist/ ???
> 
> Anyone have any pointers on how to distrust certs in
> ca-bundle.trust.crt (assuming that _is_ the file I should be using) or
> even how to show exactly what's in there?
> $ grep "#" ca-bundle.trust.crt
>  shows lots of comments but
> $ openssl x509  -in ca-bundle.trust.crt -noout -subject -dates
>  just shows me the first cert :(

You should refer to the package announcement, and direct any questions
about the package (not about its use) to its maintainer.

As I understand the package is just a bundle of the files distributed by
Mozilla (which is the maintainer of the root certs).  For questions
about those files, its contents, or its use... refer to Mozilla.

Actually Mozilla distributes one file, which is then processed to create
all the files that you see.

The link you show to Mozilla about the trust on CNNIC also points out
that the exception is made in code (i.e. hard-coded), and if you look
above it clearly states: "The status of whether a root is approved to
issue EV certificates or not is stored in PSM rather than certdata.txt",
this certdata.txt is precisely the file I'm talking about above, so
don't expect any of those Extended Validation changes to be present (and
you can ask Mozilla why they do it in code, instead of in the certs).
-- 
R. Berber


--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple