Updated cacert.pem

[lombo]

We are now using an Apr 2016 version instead of a Dec 2012 one.

At least the COMODO RSA Certification Authority was missing.

[codecov-io]

Codecov Report

Merging #212 into master will not change coverage.
The diff coverage is n/a.

@@           Coverage Diff           @@
##           master     #212   +/-   ##
=======================================
  Coverage   92.22%   92.22%           
=======================================
  Files          21       21           
  Lines        1762     1762           
=======================================
  Hits         1625     1625           
  Misses        137      137

Impacted Files	Coverage Δ
library/Requests/Transport/fsockopen.php	94.11% <0%> (-0.59%)	⬇️
library/Requests/SSL.php	100% <0%> (+2.27%)	⬆️

---

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 1b5ffd8...f14aeee. Read the comment docs.

[haruair]

It will be grateful to have this PR. I knew that there is $options['verify'] but just for the convenience. Could you consider this, @rmccue? Thanks!

[rmccue]

@dd32 Any chance you could take a look at updating the file? Don't want to break the compatibility things we had to alter last time.

[lombo]

@rmccue done!

[rmccue]

For compatibility with older versions of cURL, we've had to manually alter the file in the past to reorder certificates. @dd32 handled this last time, so I'm not sure of the exact process for it.

[dd32]

For the WordPress changes - as per https://core.trac.wordpress.org/log/trunk/src/wp-includes/certificates/ca-bundle.crt

• We include the legacy 1024bit certificates which have been removed, as required by OpenSSL 1.0.1g and lower https://core.trac.wordpress.org/changeset/35919/trunk/src/wp-includes/certificates/ca-bundle.crt
• We moved a certificate around in the file to allow an older OpenSSL to parse the file (It was 0.9.8e at the time) https://core.trac.wordpress.org/changeset/36570/trunk/src/wp-includes/certificates/ca-bundle.crt

Testing the change isn't easy, I believe I spun up known broken versions (see above) and found URLs which triggered the failure. The above commits may lead back to a site url which was affected at the time, but they've probably changed SSL certs by now.
Unfortunately I can't spend any time on verifying any of the above at this point.

[soulseekah]

I have compiled the three versions of OpenSSL to test the Mozilla CACert.pem from Wed Mar 7 04:12:06 2018 GMT (SHA 704f02707ec6b4c4a7597a8c6039b020def11e64f3ef0605a9c3543d48038a57)

0.9.8e (no-asm)

We moved a certificate around in the file to allow an older OpenSSL to parse the file

The certificate is no longer at the top in latest bundle.

> openssl version  
OpenSSL 0.9.8e 23 Feb 2007

[ok] openssl s_client -CAfile ../cacert.pem -CApath /dev/null -host wordpress.org -port 443
[ok] openssl s_client -CAfile ../cacert.pem -CApath /dev/null -host www.id.ee -port 443
[ok] openssl s_client -CAfile ../cacert.pem -CApath /dev/null -host letencrypt.org -port 443
[ok] openssl s_client -CAfile ../cacert.pem -CApath /dev/null -host mozilla.org -port 443
[ok] openssl s_client -CAfile ../cacert.pem -CApath /dev/null -host api.mailchimp.com -port 443

1.0.1e (no-asm)

We include the legacy 1024bit certificates which have been removed

I think everyone switched to 2048 by now, couldn't find a host that still gives one. Thoughts?

> openssl version  
OpenSSL 1.0.1e 11 Feb 2013

[ok] openssl s_client -CAfile ../cacert.pem -CApath /dev/null -host wordpress.org -port 443
[ok] openssl s_client -CAfile ../cacert.pem -CApath /dev/null -host www.id.ee -port 443
[ok] openssl s_client -CAfile ../cacert.pem -CApath /dev/null -host letencrypt.org -port 443
[ok] openssl s_client -CAfile ../cacert.pem -CApath /dev/null -host mozilla.org -port 443
[ok] openssl s_client -CAfile ../cacert.pem -CApath /dev/null -host api.mailchimp.com -port 443
[ok] openssl s_client -CAfile ../cacert.pem -CApath /dev/null -host paypal.com -port 443

Any other endpoints or versions I should be testing?

P.S. Would be nice to have automated tests for updates to the CA file, I'll work on one I think.

[soulseekah]

I've built a quick workbench here https://github.com/soulseekah/libssl-cacert-tests if anyone wants to send in more test certificates (preferably current ones that are encountered in the wild).

[JC5]

I am curious why this is not yet merged.

[jrfnl]

Closing as fixed by #385