Commits on Feb 13, 2023

1. Overhaul/rewrite of certificate handling as follows: …

   Change "ca-certs" references to "ca_certs".
   
   New certificates are written to individual files, with an incrementing
   number as part of their filename, rather than all being placed in a
   single file. This resolves issues caused when certificate files
   containing more than a single certificate are placed in /etc/ssl/certs
   (by utilities such as "update-ca-certificates" run by ca_certs).
   
   Alpine / Debian / Ubuntu:
   
   The current behaviour, whilst it works, is incorrect with regard to
   the design of the underlying OS utilities for managing certificates.
   For "remove_defaults" the system-installed certificate files should not
   be actually deleted (otherwise it becomes problematic if someone wishes
   to later re-enable one or more of them), rather they should be
   deactivated and these OSes already provide the means to do so - this MR
   modifies the certificate entries in the /etc/ca-certificates.conf file
   by prefixing them with "!" - when the update-ca-certificate utility is
   then run it will *not* place such delimited certificates into either the
   /etc/ssl/certs/ directory (via symlinks) nor add them to the
   (re)generated certificates bundle file.
   
   Additionally it is incorrect for added certificates to be placed in the
   /usr/share/ca-certificates directory - this location is intended for
   standard/"official" certificates, the /usr/local/share/ca-certificates
   directory is intended for "local" or "site-specific" certificates and so
   this PR adds them there instead - for certs in
   /usr/local/share/ca-certificates the update-ca-certificates utility will
   automatically use them, there is *no* need to add their filenames to the
   /etc/ca-certificates.conf file.
   
   LP: #1931174

   

   dermotbradley committed Feb 13, 2023
   Configuration menu

   • View commit details
   • Copy full SHA for f780b59
   • Browse repository at this point

   Copy the full SHA

   f780b59 View commit details

   Browse the repository at this point in the history