Date: Fri, 1 Apr 2011 10:16:33 -0500 From: Brooks Davis <brooks@freebsd.org> To: Robert Simmons <rsimmons0@gmail.com> Cc: freebsd-security <freebsd-security@freebsd.org>, Istv?n <leccine@gmail.com> Subject: Re: SSL is broken on FreeBSD Message-ID: <20110401151633.GK63248@lor.one-eyed-alien.net> In-Reply-To: <AANLkTimBcxTGj_Fx-s3=k6eGn3DPihHSgQEOidtjQ%2BwN@mail.gmail.com> References: <AANLkTin_zZgHRg7QtEwH2V8WOd=nvBcKdYvJkshGCt-R@mail.gmail.com> <AANLkTimBcxTGj_Fx-s3=k6eGn3DPihHSgQEOidtjQ%2BwN@mail.gmail.com>
next in thread | previous in thread | raw e-mail | index | archive | help
--QnBU6tTI9sljzm9u Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Fri, Apr 01, 2011 at 12:33:30PM -0400, Robert Simmons wrote: > Now, you are also not satisfied with the CA bundle in the ports > collection because it does not contain the CA that you need. I'm not > sure which one it is that you need. But a good place to start is > here: > http://www.mail-archive.com/modssl-users@modssl.org/msg16980.html >=20 > That contains a perl script for extracting the CA bundle from > Mozilla's CVS. At first glance, it may frustrate you, because it may > not be obvoius where it connects to (that info is obscured). However, > look at the following help file. It has all the connection details > for mozilla's cvsroot that you will need. Just substitute the > "anonymous@cvs-mirror.mozilla.org" for "[EMAIL PROTECTED]" in the > script. > https://developer.mozilla.org/en/Mozilla_Source_Code_Via_CVS The point of security/ca_root_nss is that it is exactly the set of certs trusted by Mozilla (via the nss library) via the mechanism described above. The FreeBSD Project makes no warranty that it is a good set to trust. It just happens to be a set that is widely trusted. > If you are not satisfied with Mozilla's bundle, you can find google > Chrome's list here somewhere: > http://src.chromium.org/viewvc/chrome/ We might actually want to maintain a port of those as well if they differ in any meaningful way. -- Brooks --QnBU6tTI9sljzm9u Content-Type: application/pgp-signature -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (FreeBSD) iD8DBQFNlexRXY6L6fI4GtQRAhCBAJ4jVef5atjnoa5gHgDGkc58BlbmYgCgzQeO BAPjVronqoFJ0TGLjluq+p4= =LPuT -----END PGP SIGNATURE----- --QnBU6tTI9sljzm9u--
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20110401151633.GK63248>