Date: Wed, 15 Dec 2021 20:03:50 -0600 From: Kyle Evans <kevans@freebsd.org> To: Andrea Venturoli <ml@netfence.it> Cc: FreeBSD Mailing List <freebsd-questions@freebsd.org> Subject: Re: How to populate /etc/ssl/certs Message-ID: <CACNAnaH1GkZn0RkVEdLTLdnc82O1h=c-Vvh6=aApGMDfAWBvbg@mail.gmail.com> In-Reply-To: <aeb690a3-00bd-1edc-5e36-7b94d63e2730@netfence.it> References: <aeb690a3-00bd-1edc-5e36-7b94d63e2730@netfence.it>
next in thread | previous in thread | raw e-mail | index | archive | help
On Wed, Dec 15, 2021 at 4:20 PM Andrea Venturoli <ml@netfence.it> wrote: > > > Hello. > > I've searched for this, but I didn't find an answer. > > How is /etc/ssl/certs populated? > > Does "make installworld" create the links for certificates in > /usr/share/certs/trusted? > Or should etcupdate? > Both; installworld rehashes once and the DESTDIR becomes populated with whatever's present at the time for the purposes of populating an image root or what-have-you. etcupdate will do it again, operating under the theory that it's running on the live system, which may have more roots present to grab than we did previously. > What about /usr/local/share/certs/? > I see on some of my machines a link to > /usr/local/share/certs/ca-root-nss.crt: the latter is installed by > security/ca_root_nss, but it doesn't seem to be the port that creates > the link... > > Also, I'm using ezjail and older jails have /etc/ssl/certs empty! > Newer jails' /etc/ssl/certs is almost identical to base's, although some > certs are missing (I suspect it was correctly created, but doesn't get > updated). > installworld has done it more or less since introduction, freebsd-update will do it as of more recent versions if that's how you're updating jails. 11.x didn't end up with any certs installed, we started with 12.2 (IIRC). Thanks, Kyle Evans
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?CACNAnaH1GkZn0RkVEdLTLdnc82O1h=c-Vvh6=aApGMDfAWBvbg>