From owner-freebsd-doc@freebsd.org Thu Dec 29 04:33:14 2016 Return-Path: Delivered-To: freebsd-doc@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 07FF2C95FA9 for ; Thu, 29 Dec 2016 04:33:14 +0000 (UTC) (envelope-from kaduk@mit.edu) Received: from dmz-mailsec-scanner-8.mit.edu (dmz-mailsec-scanner-8.mit.edu [18.7.68.37]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id B153E1BF9 for ; Thu, 29 Dec 2016 04:33:13 +0000 (UTC) (envelope-from kaduk@mit.edu) X-AuditID: 12074425-52fff70000000139-53-586490cd6563 Received: from mailhub-auth-4.mit.edu ( [18.7.62.39]) (using TLS with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client did not present a certificate) by (Symantec Messaging Gateway) with SMTP id F0.ED.00313.DC094685; Wed, 28 Dec 2016 23:27:58 -0500 (EST) Received: from outgoing.mit.edu (outgoing-auth-1.mit.edu [18.9.28.11]) by mailhub-auth-4.mit.edu (8.13.8/8.9.2) with ESMTP id uBT4RuhD002886; Wed, 28 Dec 2016 23:27:57 -0500 Received: from kduck.kaduk.org (24-107-191-124.dhcp.stls.mo.charter.com [24.107.191.124]) (authenticated bits=56) (User authenticated as kaduk@ATHENA.MIT.EDU) by outgoing.mit.edu (8.13.8/8.12.4) with ESMTP id uBT4RrP0011222 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NOT); Wed, 28 Dec 2016 23:27:56 -0500 Date: Wed, 28 Dec 2016 22:27:53 -0600 From: Benjamin Kaduk To: Michael C Voorhis Cc: freebsd-doc@freebsd.org Subject: Re: FreeBSD Handbook A.3.6 has incorrect (old?) cert-fingerprint info for svn.freebsd.org Message-ID: <20161229042753.GE8460@kduck.kaduk.org> References: <20161227133400.C86B3601EC@cwe.cs.wpi.edu> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20161227133400.C86B3601EC@cwe.cs.wpi.edu> User-Agent: Mutt/1.6.1 (2016-04-27) X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFnrNIsWRmVeSWpSXmKPExsUixG6nrntuQkqEQfc1AYtTZ7pYLSY1bWR3 YPLYfucDs8eMT/NZApiiuGxSUnMyy1KL9O0SuDJurjvBWHCfq6L/0kXGBsbPHF2MnBwSAiYS +66eYO5i5OIQEmhjkjizZRYThLORUeL/ny+sEM5VJonTa6axgLSwCKhKfL8/ixXEZhNQkWjo vswMYosIaEvcufqWHcRmFpCWaDzaClYvLJAi8eb6DCYQm1fAWOLRvKlgNUICZhJTpzcxQsQF JU7OfMIC0aslcePfS6B6DrA5y/+BXcopYC7xaMZvsLWiAsoSDTMeME9gFJiFpHsWku5ZCN0L GJlXMcqm5Fbp5iZm5hSnJusWJyfm5aUW6Vro5WaW6KWmlG5iBIepi+oOxjl/vQ4xCnAwKvHw SsikRAixJpYVV+YeYpTkYFIS5Z3eDhTiS8pPqcxILM6ILyrNSS0+xCjBwawkwisMjA4h3pTE yqrUonyYlDQHi5I476VM9wghgfTEktTs1NSC1CKYrAwHh5IErz5Io2BRanpqRVpmTglCmomD E2Q4D9BwUbDhxQWJucWZ6RD5U4yKUuK8AiAJAZBERmkeXC8ojUhk7695xSgO9Iow7/J+oCoe YAqC634FNJgJaLBaTjLI4JJEhJRUA2OHmM+xI0vK1q5mMolu5Pu8Km2V7vIDp7+faH6xTZ/l jMvdiriUW7+OVi6Zc9lv5vHreiujDp1aWM5ZqNsscmu9+OQj14vm/Ii9IXZh8USmFxzrs/w3 6a3YNnNr7+s55hdDZbXtXt01KD2rei0u/rLvPcUjk5gfJGuUaGuc2DTR6r7ThM/L3Kt+K7EU ZyQaajEXFScCAEksmQX+AgAA X-BeenThere: freebsd-doc@freebsd.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: Documentation project List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 29 Dec 2016 04:33:14 -0000 On Tue, Dec 27, 2016 at 08:34:00AM -0500, Michael C Voorhis wrote: > The FreeBSD handbook section A.3.6, under > > https://www.freebsd.org/doc/en_US.ISO8859-1/books/handbook/svn.html > > lists certificate fingerprints which appear to be outdated. It > appears that the SHA1 fingerprint, listed in the handbook as > > E9:37:73:80:B5:32:1B:93:92:94:98:17:59:F0:FA:A2:5F:1E:DE:B9 > > Should be > > 86:5C:C5:84:F5:2D:40:FA:C6:F9:F0:D9:F5:40:D0:D5:6B:90:CB:CE . > > Similarly, the SHA256 fingerprint listed on the handbook-page is > > D5:27:1C:B6:55:E6:A8:7D:48:D5:0C:F0:DA:9D:51:60:D7:42:6A:F2:05:F1:8A:47:BE:78:A1:3A:72:06:92:60 > > where it should be > > 3D:68:44:40:22:B1:96:B2:D3:0B:DD:1A:C9:AA:FF:CB:EC:89:FE:A2:4B:AF:11:F9:7C:AD:D9:F2:67:B7:35:18 . > > According to my web-browser, the cert has been in place since 14 June > 2016, and will expire on 29 June 2017. The fingerprints you quote are preceded by a note: % Note: The FreeBSD Subversion mirrors previously used self-signed SSL certificates % documented in this chapter. As of July 14, 2015, all mirrors now use an official % SSL certificate that will be recognized by Subversion if the security/ca_root_nss % port is installed. The legacy self-signed certificates and server names are still % available but are deprecated and no longer supported. -Ben