Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

crypto: update root certificates #19322

Closed
wants to merge 4 commits into from
Closed

crypto: update root certificates #19322

wants to merge 4 commits into from

Conversation

bnoordhuis
Copy link
Member

@bnoordhuis bnoordhuis commented Mar 13, 2018 •
edited
Loading

Update the list of root certificates in src/node_root_certs.h with
tools/mk-ca-bundle.pl.

Certificates added:

  • GDCA TrustAUTH R5 ROOT
  • SSL.com EV Root Certification Authority ECC
  • SSL.com EV Root Certification Authority RSA R2
  • SSL.com Root Certification Authority ECC
  • SSL.com Root Certification Authority RSA
  • TrustCor ECA-1
  • TrustCor RootCert CA-1
  • TrustCor RootCert CA-2

Certificates removed:

  • ACEDICOM Root
  • AddTrust Low-Value Services Root
  • AddTrust Public Services Root
  • AddTrust ualified Certificates Root
  • CA Disig Root R1
  • Camerfirma Chambers of Commerce Root
  • Camerfirma Global Chambersign Root
  • CA WoSign ECC Root
  • Certification Authority of WoSign G2
  • Certinomis - Autorité Racine
  • Certum Root CA
  • China Internet Network Information Center EV Certificates Root
  • CNNIC ROOT
  • Comodo Secure Services root
  • Comodo Trusted Services root
  • DST ACES CA X6
  • GeoTrust Global CA 2
  • PSCProcert
  • Security Communication EV RootCA1
  • StartCom Certification Authority
  • StartCom Certification Authority
  • StartCom Certification Authority G2
  • Swisscom Root CA 1
  • Swisscom Root CA 2
  • Swisscom Root EV CA 2
  • TUBITAK UEKAE Kok Sertifika Hizmet Saglayicisi - Surum 3
  • TURKTRUST Certificate Services Provider Root 2007
  • UTN USERFirst Hardware Root CA
  • WoSign
  • WoSign China

Needs a decision on how to backport. I've pulled apart the CNNIC and StartCom removals; do we want to backport those (and if so, to what release branches) or apply only in Node.js 10?

cc @nodejs/crypto - this needs your input.

edit: discussion in #9434 is relevant.

@bnoordhuis
tools: update certdata.txt
0df2cf6 
This is the certdata.txt[0] from NSS 3.36, released on 2018-03-05.

This is the version of NSS that will ship in Firefox 60 on 2018-05-01.

[0] https://hg.mozilla.org/projects/nss/raw-file/NSS_3_36_RTM/lib/ckfw/builtins/certdata.txt
@bnoordhuis
crypto: update root certificates
ed07975 
Update the list of root certificates in src/node_root_certs.h with
tools/mk-ca-bundle.pl.

Certificates added:
- GDCA TrustAUTH R5 ROOT
- SSL.com EV Root Certification Authority ECC
- SSL.com EV Root Certification Authority RSA R2
- SSL.com Root Certification Authority ECC
- SSL.com Root Certification Authority RSA
- TrustCor ECA-1
- TrustCor RootCert CA-1
- TrustCor RootCert CA-2

Certificates removed:
- ACEDICOM Root
- AddTrust Low-Value Services Root
- AddTrust Public Services Root
- AddTrust ualified Certificates Root
- CA Disig Root R1
- Camerfirma Chambers of Commerce Root
- Camerfirma Global Chambersign Root
- CA WoSign ECC Root
- Certification Authority of WoSign G2
- Certinomis - Autorité Racine
- Certum Root CA
- China Internet Network Information Center EV Certificates Root
- CNNIC ROOT
- Comodo Secure Services root
- Comodo Trusted Services root
- DST ACES CA X6
- GeoTrust Global CA 2
- PSCProcert
- Security Communication EV RootCA1
- StartCom Certification Authority
- StartCom Certification Authority
- StartCom Certification Authority G2
- Swisscom Root CA 1
- Swisscom Root CA 2
- Swisscom Root EV CA 2
- TUBITAK UEKAE Kok Sertifika Hizmet Saglayicisi - Surum 3
- TURKTRUST Certificate Services Provider Root 2007
- UTN USERFirst Hardware Root CA
- WoSign
- WoSign China
@bnoordhuis
fixup! revert CNNIC root removals
d5bc08b 
The previous commit removed the CNNIC root certificates and makes
the test/parallel/test-tls-cnnic-whitelist.js test fail with an
UNABLE_TO_VERIFY_LEAF_SIGNATURE error instead of the "expected"
CERT_REVOKED error.

"Expected" between scare quotes because of course the new error
is not unexpected.
@bnoordhuis
src: drop CNNIC+StartCom certificate whitelisting
4deccc4 
Remove the CNNIC certificates again and remove the whitelist from commit
3beb880 ("crypto: add cert check to CNNIC Whitelist") from June 2015.
@nodejs-github-bot nodejs-github-bot added c++ Issues and PRs that require attention from people who are familiar with C++. lib / src Issues and PRs related to general changes in the lib or src directory. labels Mar 13, 2018
indutny
indutny approved these changes Mar 13, 2018
View reviewed changes
Copy link
Member

@indutny indutny left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@bnoordhuis bnoordhuis mentioned this pull request Mar 13, 2018
Closed
@indutny
Copy link
Member

indutny commented Mar 13, 2018

Just a tip for past and future @nodejs/collaborators, when reviewing CA update PR - please run the aforementioned tools and verify that the data matches.

@joyeecheung
Copy link
Member

@indutny Do you mind writing something down in doc/guides?

@indutny
Copy link
Member

indutny commented Mar 15, 2018

I probably won't be able to get to this soon, sorry.

jasnell
jasnell approved these changes Mar 16, 2018
View reviewed changes
Copy link
Member

@jasnell jasnell left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

FWIW, I'm good with backporting the entire change to 8.x and 6.x.

@richardlau
Copy link
Member

richardlau commented Mar 21, 2018 •
edited
Loading

Does this address #14537 or are we still waiting for upstream?

@bnoordhuis
Copy link
Member Author

No, it doesn't address #14537. I believe NSS/Firefox plans to drop the Symantec certificates later this year.

@bnoordhuis
Copy link
Member Author

https://ci.nodejs.org/job/node-test-pull-request/13876/

@MylesBorins
Copy link
Contributor

CI looks good... only issue is linter which is infra related

MylesBorins pushed a commit that referenced this pull request Mar 26, 2018
@bnoordhuis @MylesBorins
tools: update certdata.txt
d88d6d6 
This is the certdata.txt[0] from NSS 3.36, released on 2018-03-05.

This is the version of NSS that will ship in Firefox 60 on 2018-05-01.

[0] https://hg.mozilla.org/projects/nss/raw-file/NSS_3_36_RTM/lib/ckfw/builtins/certdata.txt

PR-URL: #19322
Reviewed-By: Fedor Indutny <[email protected]>
Reviewed-By: Colin Ihrig <[email protected]>
Reviewed-By: Daniel Bevenius <[email protected]>
Reviewed-By: James M Snell <[email protected]>
MylesBorins pushed a commit that referenced this pull request Mar 26, 2018
@bnoordhuis @MylesBorins
crypto: update root certificates
79fa372 
Update the list of root certificates in src/node_root_certs.h with
tools/mk-ca-bundle.pl.

Certificates added:
- GDCA TrustAUTH R5 ROOT
- SSL.com EV Root Certification Authority ECC
- SSL.com EV Root Certification Authority RSA R2
- SSL.com Root Certification Authority ECC
- SSL.com Root Certification Authority RSA
- TrustCor ECA-1
- TrustCor RootCert CA-1
- TrustCor RootCert CA-2

Certificates removed:
- ACEDICOM Root
- AddTrust Low-Value Services Root
- AddTrust Public Services Root
- AddTrust ualified Certificates Root
- CA Disig Root R1
- Camerfirma Chambers of Commerce Root
- Camerfirma Global Chambersign Root
- CA WoSign ECC Root
- Certification Authority of WoSign G2
- Certinomis - Autorité Racine
- Certum Root CA
- China Internet Network Information Center EV Certificates Root
- CNNIC ROOT
- Comodo Secure Services root
- Comodo Trusted Services root
- DST ACES CA X6
- GeoTrust Global CA 2
- PSCProcert
- Security Communication EV RootCA1
- StartCom Certification Authority
- StartCom Certification Authority
- StartCom Certification Authority G2
- Swisscom Root CA 1
- Swisscom Root CA 2
- Swisscom Root EV CA 2
- TUBITAK UEKAE Kok Sertifika Hizmet Saglayicisi - Surum 3
- TURKTRUST Certificate Services Provider Root 2007
- UTN USERFirst Hardware Root CA
- WoSign
- WoSign China

PR-URL: #19322
Reviewed-By: Fedor Indutny <[email protected]>
Reviewed-By: Colin Ihrig <[email protected]>
Reviewed-By: Daniel Bevenius <[email protected]>
Reviewed-By: James M Snell <[email protected]>
MylesBorins pushed a commit that referenced this pull request Mar 26, 2018
@bnoordhuis @MylesBorins
src: drop CNNIC+StartCom certificate whitelisting
dc87543 
Remove the CNNIC certificates again and remove the whitelist from commit
3beb880 ("crypto: add cert check to CNNIC Whitelist") from June 2015.

PR-URL: #19322
Reviewed-By: Fedor Indutny <[email protected]>
Reviewed-By: Colin Ihrig <[email protected]>
Reviewed-By: Daniel Bevenius <[email protected]>
Reviewed-By: James M Snell <[email protected]>
@MylesBorins
Copy link
Contributor

MylesBorins commented Mar 26, 2018 •
edited
Loading

landed in eac4c65...dc87543

@bnoordhuis this doesn't seem to land cleanly on any release lines... specifically dc87543 is conflicting on all release lines

edit:

79fa372 is also conflicting on v4.x

bnoordhuis added a commit to bnoordhuis/io.js that referenced this pull request Mar 27, 2018
@bnoordhuis
tools: update certdata.txt
20682d2 
This is the certdata.txt[0] from NSS 3.36, released on 2018-03-05.

This is the version of NSS that will ship in Firefox 60 on 2018-05-01.

[0] https://hg.mozilla.org/projects/nss/raw-file/NSS_3_36_RTM/lib/ckfw/builtins/certdata.txt

PR-URL: nodejs#19322
Reviewed-By: Fedor Indutny <[email protected]>
Reviewed-By: Colin Ihrig <[email protected]>
Reviewed-By: Daniel Bevenius <[email protected]>
Reviewed-By: James M Snell <[email protected]>
bnoordhuis added a commit to bnoordhuis/io.js that referenced this pull request Mar 27, 2018
@bnoordhuis
crypto: update root certificates
b0e234a 
Update the list of root certificates in src/node_root_certs.h with
tools/mk-ca-bundle.pl.

Certificates added:
- GDCA TrustAUTH R5 ROOT
- SSL.com EV Root Certification Authority ECC
- SSL.com EV Root Certification Authority RSA R2
- SSL.com Root Certification Authority ECC
- SSL.com Root Certification Authority RSA
- TrustCor ECA-1
- TrustCor RootCert CA-1
- TrustCor RootCert CA-2

Certificates removed:
- ACEDICOM Root
- AddTrust Low-Value Services Root
- AddTrust Public Services Root
- AddTrust ualified Certificates Root
- CA Disig Root R1
- Camerfirma Chambers of Commerce Root
- Camerfirma Global Chambersign Root
- CA WoSign ECC Root
- Certification Authority of WoSign G2
- Certinomis - Autorité Racine
- Certum Root CA
- China Internet Network Information Center EV Certificates Root
- CNNIC ROOT
- Comodo Secure Services root
- Comodo Trusted Services root
- DST ACES CA X6
- GeoTrust Global CA 2
- PSCProcert
- Security Communication EV RootCA1
- StartCom Certification Authority
- StartCom Certification Authority
- StartCom Certification Authority G2
- Swisscom Root CA 1
- Swisscom Root CA 2
- Swisscom Root EV CA 2
- TUBITAK UEKAE Kok Sertifika Hizmet Saglayicisi - Surum 3
- TURKTRUST Certificate Services Provider Root 2007
- UTN USERFirst Hardware Root CA
- WoSign
- WoSign China

PR-URL: nodejs#19322
Reviewed-By: Fedor Indutny <[email protected]>
Reviewed-By: Colin Ihrig <[email protected]>
Reviewed-By: Daniel Bevenius <[email protected]>
Reviewed-By: James M Snell <[email protected]>
bnoordhuis added a commit to bnoordhuis/io.js that referenced this pull request Mar 27, 2018
@bnoordhuis
src: drop CNNIC+StartCom certificate whitelisting
0d5e48b 
Remove the CNNIC certificates again and remove the whitelist from commit
3beb880 ("crypto: add cert check to CNNIC Whitelist") from June 2015.

PR-URL: nodejs#19322
Reviewed-By: Fedor Indutny <[email protected]>
Reviewed-By: Colin Ihrig <[email protected]>
Reviewed-By: Daniel Bevenius <[email protected]>
Reviewed-By: James M Snell <[email protected]>
bnoordhuis added a commit to bnoordhuis/io.js that referenced this pull request Mar 27, 2018
@bnoordhuis
src: drop CNNIC+StartCom certificate whitelisting
f58b512 
Remove the CNNIC certificates again and remove the whitelist from commit
3beb880 ("crypto: add cert check to CNNIC Whitelist") from June 2015.

PR-URL: nodejs#19322
Reviewed-By: Fedor Indutny <[email protected]>
Reviewed-By: Colin Ihrig <[email protected]>
Reviewed-By: Daniel Bevenius <[email protected]>
Reviewed-By: James M Snell <[email protected]>
bnoordhuis added a commit to bnoordhuis/io.js that referenced this pull request Mar 27, 2018
@bnoordhuis
tools: update certdata.txt
cd47b37 
This is the certdata.txt[0] from NSS 3.36, released on 2018-03-05.

This is the version of NSS that will ship in Firefox 60 on 2018-05-01.

[0] https://hg.mozilla.org/projects/nss/raw-file/NSS_3_36_RTM/lib/ckfw/builtins/certdata.txt

PR-URL: nodejs#19322
Reviewed-By: Fedor Indutny <[email protected]>
Reviewed-By: Colin Ihrig <[email protected]>
Reviewed-By: Daniel Bevenius <[email protected]>
Reviewed-By: James M Snell <[email protected]>
bnoordhuis added a commit to bnoordhuis/io.js that referenced this pull request Mar 27, 2018
@bnoordhuis
crypto: update root certificates
2af46cc 
Update the list of root certificates in src/node_root_certs.h with
tools/mk-ca-bundle.pl.

Certificates added:
- GDCA TrustAUTH R5 ROOT
- SSL.com EV Root Certification Authority ECC
- SSL.com EV Root Certification Authority RSA R2
- SSL.com Root Certification Authority ECC
- SSL.com Root Certification Authority RSA
- TrustCor ECA-1
- TrustCor RootCert CA-1
- TrustCor RootCert CA-2

Certificates removed:
- ACEDICOM Root
- AddTrust Low-Value Services Root
- AddTrust Public Services Root
- AddTrust ualified Certificates Root
- CA Disig Root R1
- Camerfirma Chambers of Commerce Root
- Camerfirma Global Chambersign Root
- CA WoSign ECC Root
- Certification Authority of WoSign G2
- Certinomis - Autorité Racine
- Certum Root CA
- China Internet Network Information Center EV Certificates Root
- CNNIC ROOT
- Comodo Secure Services root
- Comodo Trusted Services root
- DST ACES CA X6
- GeoTrust Global CA 2
- PSCProcert
- Security Communication EV RootCA1
- StartCom Certification Authority
- StartCom Certification Authority
- StartCom Certification Authority G2
- Swisscom Root CA 1
- Swisscom Root CA 2
- Swisscom Root EV CA 2
- TUBITAK UEKAE Kok Sertifika Hizmet Saglayicisi - Surum 3
- TURKTRUST Certificate Services Provider Root 2007
- UTN USERFirst Hardware Root CA
- WoSign
- WoSign China

PR-URL: nodejs#19322
Reviewed-By: Fedor Indutny <[email protected]>
Reviewed-By: Colin Ihrig <[email protected]>
Reviewed-By: Daniel Bevenius <[email protected]>
Reviewed-By: James M Snell <[email protected]>
bnoordhuis added a commit to bnoordhuis/io.js that referenced this pull request Mar 27, 2018
@bnoordhuis
src: drop CNNIC+StartCom certificate whitelisting
81dfcac 
Remove the CNNIC certificates again and remove the whitelist from commit
3beb880 ("crypto: add cert check to CNNIC Whitelist") from June 2015.

PR-URL: nodejs#19322
Reviewed-By: Fedor Indutny <[email protected]>
Reviewed-By: Colin Ihrig <[email protected]>
Reviewed-By: Daniel Bevenius <[email protected]>
Reviewed-By: James M Snell <[email protected]>
bnoordhuis added a commit to bnoordhuis/io.js that referenced this pull request Mar 27, 2018
@bnoordhuis
tools: update certdata.txt
616238c 
This is the certdata.txt[0] from NSS 3.36, released on 2018-03-05.

This is the version of NSS that will ship in Firefox 60 on 2018-05-01.

[0] https://hg.mozilla.org/projects/nss/raw-file/NSS_3_36_RTM/lib/ckfw/builtins/certdata.txt

PR-URL: nodejs#19322
Reviewed-By: Fedor Indutny <[email protected]>
Reviewed-By: Colin Ihrig <[email protected]>
Reviewed-By: Daniel Bevenius <[email protected]>
Reviewed-By: James M Snell <[email protected]>
bnoordhuis added a commit to bnoordhuis/io.js that referenced this pull request Mar 27, 2018
@bnoordhuis
crypto: update root certificates
ea7eff4 
Update the list of root certificates in src/node_root_certs.h with
tools/mk-ca-bundle.pl.

Certificates added:
- GDCA TrustAUTH R5 ROOT
- SSL.com EV Root Certification Authority ECC
- SSL.com EV Root Certification Authority RSA R2
- SSL.com Root Certification Authority ECC
- SSL.com Root Certification Authority RSA
- TrustCor ECA-1
- TrustCor RootCert CA-1
- TrustCor RootCert CA-2

Certificates removed:
- ACEDICOM Root
- AddTrust Low-Value Services Root
- AddTrust Public Services Root
- AddTrust ualified Certificates Root
- CA Disig Root R1
- Camerfirma Chambers of Commerce Root
- Camerfirma Global Chambersign Root
- CA WoSign ECC Root
- Certification Authority of WoSign G2
- Certinomis - Autorité Racine
- Certum Root CA
- China Internet Network Information Center EV Certificates Root
- CNNIC ROOT
- Comodo Secure Services root
- Comodo Trusted Services root
- DST ACES CA X6
- GeoTrust Global CA 2
- PSCProcert
- Security Communication EV RootCA1
- StartCom Certification Authority
- StartCom Certification Authority
- StartCom Certification Authority G2
- Swisscom Root CA 1
- Swisscom Root CA 2
- Swisscom Root EV CA 2
- TUBITAK UEKAE Kok Sertifika Hizmet Saglayicisi - Surum 3
- TURKTRUST Certificate Services Provider Root 2007
- UTN USERFirst Hardware Root CA
- WoSign
- WoSign China

PR-URL: nodejs#19322
Reviewed-By: Fedor Indutny <[email protected]>
Reviewed-By: Colin Ihrig <[email protected]>
Reviewed-By: Daniel Bevenius <[email protected]>
Reviewed-By: James M Snell <[email protected]>
bnoordhuis added a commit to bnoordhuis/io.js that referenced this pull request Mar 27, 2018
@bnoordhuis
src: drop CNNIC+StartCom certificate whitelisting
6fd5835 
Remove the CNNIC certificates again and remove the whitelist from commit
3beb880 ("crypto: add cert check to CNNIC Whitelist") from June 2015.

PR-URL: nodejs#19322
Reviewed-By: Fedor Indutny <[email protected]>
Reviewed-By: Colin Ihrig <[email protected]>
Reviewed-By: Daniel Bevenius <[email protected]>
Reviewed-By: James M Snell <[email protected]>
This was referenced Mar 27, 2018
Closed
Closed
Closed
Closed
MylesBorins pushed a commit that referenced this pull request Mar 28, 2018
@bnoordhuis @MylesBorins
tools: update certdata.txt
b1f9f1d 
This is the certdata.txt[0] from NSS 3.36, released on 2018-03-05.

This is the version of NSS that will ship in Firefox 60 on 2018-05-01.

[0] https://hg.mozilla.org/projects/nss/raw-file/NSS_3_36_RTM/lib/ckfw/builtins/certdata.txt

Backport-PR-URL: #19631
PR-URL: #19322
Reviewed-By: Fedor Indutny <[email protected]>
Reviewed-By: Colin Ihrig <[email protected]>
Reviewed-By: Daniel Bevenius <[email protected]>
Reviewed-By: James M Snell <[email protected]>
MylesBorins pushed a commit that referenced this pull request Mar 28, 2018
@bnoordhuis @MylesBorins
crypto: update root certificates
93e295a 
Update the list of root certificates in src/node_root_certs.h with
tools/mk-ca-bundle.pl.

Certificates added:
- GDCA TrustAUTH R5 ROOT
- SSL.com EV Root Certification Authority ECC
- SSL.com EV Root Certification Authority RSA R2
- SSL.com Root Certification Authority ECC
- SSL.com Root Certification Authority RSA
- TrustCor ECA-1
- TrustCor RootCert CA-1
- TrustCor RootCert CA-2

Certificates removed:
- ACEDICOM Root
- AddTrust Low-Value Services Root
- AddTrust Public Services Root
- AddTrust ualified Certificates Root
- CA Disig Root R1
- Camerfirma Chambers of Commerce Root
- Camerfirma Global Chambersign Root
- CA WoSign ECC Root
- Certification Authority of WoSign G2
- Certinomis - Autorité Racine
- Certum Root CA
- China Internet Network Information Center EV Certificates Root
- CNNIC ROOT
- Comodo Secure Services root
- Comodo Trusted Services root
- DST ACES CA X6
- GeoTrust Global CA 2
- PSCProcert
- Security Communication EV RootCA1
- StartCom Certification Authority
- StartCom Certification Authority
- StartCom Certification Authority G2
- Swisscom Root CA 1
- Swisscom Root CA 2
- Swisscom Root EV CA 2
- TUBITAK UEKAE Kok Sertifika Hizmet Saglayicisi - Surum 3
- TURKTRUST Certificate Services Provider Root 2007
- UTN USERFirst Hardware Root CA
- WoSign
- WoSign China

Backport-PR-URL: #19631
PR-URL: #19322
Reviewed-By: Fedor Indutny <[email protected]>
Reviewed-By: Colin Ihrig <[email protected]>
Reviewed-By: Daniel Bevenius <[email protected]>
Reviewed-By: James M Snell <[email protected]>
MylesBorins pushed a commit that referenced this pull request Mar 28, 2018
@bnoordhuis @MylesBorins
src: drop CNNIC+StartCom certificate whitelisting
ac0747f 
Remove the CNNIC certificates again and remove the whitelist from commit
3beb880 ("crypto: add cert check to CNNIC Whitelist") from June 2015.

Backport-PR-URL: #19631
PR-URL: #19322
Reviewed-By: Fedor Indutny <[email protected]>
Reviewed-By: Colin Ihrig <[email protected]>
Reviewed-By: Daniel Bevenius <[email protected]>
Reviewed-By: James M Snell <[email protected]>
MylesBorins pushed a commit that referenced this pull request Mar 28, 2018
@bnoordhuis @MylesBorins
tools: update certdata.txt
7264538 
This is the certdata.txt[0] from NSS 3.36, released on 2018-03-05.

This is the version of NSS that will ship in Firefox 60 on 2018-05-01.

[0] https://hg.mozilla.org/projects/nss/raw-file/NSS_3_36_RTM/lib/ckfw/builtins/certdata.txt

Backport-PR-URL: #19634
PR-URL: #19322
Reviewed-By: Fedor Indutny <[email protected]>
Reviewed-By: Colin Ihrig <[email protected]>
Reviewed-By: Daniel Bevenius <[email protected]>
Reviewed-By: James M Snell <[email protected]>
MylesBorins pushed a commit that referenced this pull request Mar 28, 2018
@bnoordhuis @MylesBorins
crypto: update root certificates
85d1fa8 
Update the list of root certificates in src/node_root_certs.h with
tools/mk-ca-bundle.pl.

Certificates added:
- GDCA TrustAUTH R5 ROOT
- SSL.com EV Root Certification Authority ECC
- SSL.com EV Root Certification Authority RSA R2
- SSL.com Root Certification Authority ECC
- SSL.com Root Certification Authority RSA
- TrustCor ECA-1
- TrustCor RootCert CA-1
- TrustCor RootCert CA-2

Certificates removed:
- ACEDICOM Root
- AddTrust Low-Value Services Root
- AddTrust Public Services Root
- AddTrust ualified Certificates Root
- CA Disig Root R1
- Camerfirma Chambers of Commerce Root
- Camerfirma Global Chambersign Root
- CA WoSign ECC Root
- Certification Authority of WoSign G2
- Certinomis - Autorité Racine
- Certum Root CA
- China Internet Network Information Center EV Certificates Root
- CNNIC ROOT
- Comodo Secure Services root
- Comodo Trusted Services root
- DST ACES CA X6
- GeoTrust Global CA 2
- PSCProcert
- Security Communication EV RootCA1
- StartCom Certification Authority
- StartCom Certification Authority
- StartCom Certification Authority G2
- Swisscom Root CA 1
- Swisscom Root CA 2
- Swisscom Root EV CA 2
- TUBITAK UEKAE Kok Sertifika Hizmet Saglayicisi - Surum 3
- TURKTRUST Certificate Services Provider Root 2007
- UTN USERFirst Hardware Root CA
- WoSign
- WoSign China

Backport-PR-URL: #19634
PR-URL: #19322
Reviewed-By: Fedor Indutny <[email protected]>
Reviewed-By: Colin Ihrig <[email protected]>
Reviewed-By: Daniel Bevenius <[email protected]>
Reviewed-By: James M Snell <[email protected]>
MylesBorins pushed a commit that referenced this pull request Mar 28, 2018
@bnoordhuis @MylesBorins
src: drop CNNIC+StartCom certificate whitelisting
305fe4c 
Remove the CNNIC certificates again and remove the whitelist from commit
3beb880 ("crypto: add cert check to CNNIC Whitelist") from June 2015.

Backport-PR-URL: #19634
PR-URL: #19322
Reviewed-By: Fedor Indutny <[email protected]>
Reviewed-By: Colin Ihrig <[email protected]>
Reviewed-By: Daniel Bevenius <[email protected]>
Reviewed-By: James M Snell <[email protected]>
MylesBorins pushed a commit that referenced this pull request Mar 28, 2018
@bnoordhuis @MylesBorins
tools: update certdata.txt
7d9e981 
This is the certdata.txt[0] from NSS 3.36, released on 2018-03-05.

This is the version of NSS that will ship in Firefox 60 on 2018-05-01.

[0] https://hg.mozilla.org/projects/nss/raw-file/NSS_3_36_RTM/lib/ckfw/builtins/certdata.txt

Backport-PR-URL: #19632
PR-URL: #19322
Reviewed-By: Fedor Indutny <[email protected]>
Reviewed-By: Colin Ihrig <[email protected]>
Reviewed-By: Daniel Bevenius <[email protected]>
Reviewed-By: James M Snell <[email protected]>
MylesBorins pushed a commit that referenced this pull request Mar 28, 2018
@bnoordhuis @MylesBorins
crypto: update root certificates
fac8a63 
Update the list of root certificates in src/node_root_certs.h with
tools/mk-ca-bundle.pl.

Certificates added:
- GDCA TrustAUTH R5 ROOT
- SSL.com EV Root Certification Authority ECC
- SSL.com EV Root Certification Authority RSA R2
- SSL.com Root Certification Authority ECC
- SSL.com Root Certification Authority RSA
- TrustCor ECA-1
- TrustCor RootCert CA-1
- TrustCor RootCert CA-2

Certificates removed:
- ACEDICOM Root
- AddTrust Low-Value Services Root
- AddTrust Public Services Root
- AddTrust ualified Certificates Root
- CA Disig Root R1
- Camerfirma Chambers of Commerce Root
- Camerfirma Global Chambersign Root
- CA WoSign ECC Root
- Certification Authority of WoSign G2
- Certinomis - Autorité Racine
- Certum Root CA
- China Internet Network Information Center EV Certificates Root
- CNNIC ROOT
- Comodo Secure Services root
- Comodo Trusted Services root
- DST ACES CA X6
- GeoTrust Global CA 2
- PSCProcert
- Security Communication EV RootCA1
- StartCom Certification Authority
- StartCom Certification Authority
- StartCom Certification Authority G2
- Swisscom Root CA 1
- Swisscom Root CA 2
- Swisscom Root EV CA 2
- TUBITAK UEKAE Kok Sertifika Hizmet Saglayicisi - Surum 3
- TURKTRUST Certificate Services Provider Root 2007
- UTN USERFirst Hardware Root CA
- WoSign
- WoSign China

Backport-PR-URL: #19632
PR-URL: #19322
Reviewed-By: Fedor Indutny <[email protected]>
Reviewed-By: Colin Ihrig <[email protected]>
Reviewed-By: Daniel Bevenius <[email protected]>
Reviewed-By: James M Snell <[email protected]>
MylesBorins pushed a commit that referenced this pull request Mar 28, 2018
@bnoordhuis @MylesBorins
src: drop CNNIC+StartCom certificate whitelisting
9ef5bc4 
Remove the CNNIC certificates again and remove the whitelist from commit
3beb880 ("crypto: add cert check to CNNIC Whitelist") from June 2015.

Backport-PR-URL: #19632
PR-URL: #19322
Reviewed-By: Fedor Indutny <[email protected]>
Reviewed-By: Colin Ihrig <[email protected]>
Reviewed-By: Daniel Bevenius <[email protected]>
Reviewed-By: James M Snell <[email protected]>
MylesBorins pushed a commit that referenced this pull request Mar 28, 2018
@bnoordhuis @MylesBorins
tools: update certdata.txt
fb085bb 
This is the certdata.txt[0] from NSS 3.36, released on 2018-03-05.

This is the version of NSS that will ship in Firefox 60 on 2018-05-01.

[0] https://hg.mozilla.org/projects/nss/raw-file/NSS_3_36_RTM/lib/ckfw/builtins/certdata.txt

Backport-PR-URL: #19633
PR-URL: #19322
Reviewed-By: Fedor Indutny <[email protected]>
Reviewed-By: Colin Ihrig <[email protected]>
Reviewed-By: Daniel Bevenius <[email protected]>
Reviewed-By: James M Snell <[email protected]>
MylesBorins pushed a commit that referenced this pull request Mar 28, 2018
@bnoordhuis @MylesBorins
crypto: update root certificates
15650b0 
Update the list of root certificates in src/node_root_certs.h with
tools/mk-ca-bundle.pl.

Certificates added:
- GDCA TrustAUTH R5 ROOT
- SSL.com EV Root Certification Authority ECC
- SSL.com EV Root Certification Authority RSA R2
- SSL.com Root Certification Authority ECC
- SSL.com Root Certification Authority RSA
- TrustCor ECA-1
- TrustCor RootCert CA-1
- TrustCor RootCert CA-2

Certificates removed:
- ACEDICOM Root
- AddTrust Low-Value Services Root
- AddTrust Public Services Root
- AddTrust ualified Certificates Root
- CA Disig Root R1
- Camerfirma Chambers of Commerce Root
- Camerfirma Global Chambersign Root
- CA WoSign ECC Root
- Certification Authority of WoSign G2
- Certinomis - Autorité Racine
- Certum Root CA
- China Internet Network Information Center EV Certificates Root
- CNNIC ROOT
- Comodo Secure Services root
- Comodo Trusted Services root
- DST ACES CA X6
- GeoTrust Global CA 2
- PSCProcert
- Security Communication EV RootCA1
- StartCom Certification Authority
- StartCom Certification Authority
- StartCom Certification Authority G2
- Swisscom Root CA 1
- Swisscom Root CA 2
- Swisscom Root EV CA 2
- TUBITAK UEKAE Kok Sertifika Hizmet Saglayicisi - Surum 3
- TURKTRUST Certificate Services Provider Root 2007
- UTN USERFirst Hardware Root CA
- WoSign
- WoSign China

Backport-PR-URL: #19633
PR-URL: #19322
Reviewed-By: Fedor Indutny <[email protected]>
Reviewed-By: Colin Ihrig <[email protected]>
Reviewed-By: Daniel Bevenius <[email protected]>
Reviewed-By: James M Snell <[email protected]>
MylesBorins pushed a commit that referenced this pull request Mar 28, 2018
@bnoordhuis @MylesBorins
src: drop CNNIC+StartCom certificate whitelisting
9b76921 
Remove the CNNIC certificates again and remove the whitelist from commit
3beb880 ("crypto: add cert check to CNNIC Whitelist") from June 2015.

Backport-PR-URL: #19633
PR-URL: #19322
Reviewed-By: Fedor Indutny <[email protected]>
Reviewed-By: Colin Ihrig <[email protected]>
Reviewed-By: Daniel Bevenius <[email protected]>
Reviewed-By: James M Snell <[email protected]>
@bnoordhuis bnoordhuis deleted the update-root-certs branch March 29, 2018 07:11
@ryzokuken
Copy link
Contributor

This seems to be a tough nut to crack. Should this be backported to v8.x at all?

@richardlau
Copy link
Member

This seems to be a tough nut to crack. Should this be backported to v8.x at all?

Wasn't it already backported in #19633?

@ryzokuken
Copy link
Contributor

Cool. That's reassuring (I thought this was a tough nut because most of the commits came back empty 😛 ). Someone must've forgotten to remove the labels. I will now.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@cjihrig cjihrig cjihrig approved these changes

@jasnell jasnell jasnell approved these changes

@danbev danbev danbev approved these changes

@indutny indutny indutny approved these changes

Assignees
No one assigned
Labels
c++ Issues and PRs that require attention from people who are familiar with C++. lib / src Issues and PRs related to general changes in the lib or src directory.
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
10 participants
@bnoordhuis @indutny @joyeecheung @richardlau @MylesBorins @ryzokuken @danbev @jasnell @cjihrig @nodejs-github-bot