-
Notifications
You must be signed in to change notification settings - Fork 493
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Updated cacert.pem #212
Updated cacert.pem #212
Conversation
Codecov Report
@@ Coverage Diff @@
## master #212 +/- ##
=======================================
Coverage 92.22% 92.22%
=======================================
Files 21 21
Lines 1762 1762
=======================================
Hits 1625 1625
Misses 137 137
Continue to review full report at Codecov.
|
It will be grateful to have this PR. I knew that there is |
@dd32 Any chance you could take a look at updating the file? Don't want to break the compatibility things we had to alter last time. |
@rmccue done! |
For compatibility with older versions of cURL, we've had to manually alter the file in the past to reorder certificates. @dd32 handled this last time, so I'm not sure of the exact process for it. |
For the WordPress changes - as per https://core.trac.wordpress.org/log/trunk/src/wp-includes/certificates/ca-bundle.crt
Testing the change isn't easy, I believe I spun up known broken versions (see above) and found URLs which triggered the failure. The above commits may lead back to a site url which was affected at the time, but they've probably changed SSL certs by now. |
I have compiled the three versions of OpenSSL to test the Mozilla CACert.pem from Wed Mar 7 04:12:06 2018 GMT (SHA 0.9.8e (no-asm)
The certificate is no longer at the top in latest bundle.
1.0.1e (no-asm)
I think everyone switched to 2048 by now, couldn't find a host that still gives one. Thoughts?
Any other endpoints or versions I should be testing? P.S. Would be nice to have automated tests for updates to the CA file, I'll work on one I think. |
I've built a quick workbench here https://github.com/soulseekah/libssl-cacert-tests if anyone wants to send in more test certificates (preferably current ones that are encountered in the wild). |
I am curious why this is not yet merged. |
Closing as fixed by #385 |
We are now using an Apr 2016 version instead of a Dec 2012 one.
At least the COMODO RSA Certification Authority was missing.