cloudflare / cfssl_trust Goto Github PK

CFSSL's CA trust store repository

License: BSD 2-Clause "Simplified" License

Go 93.29% Shell 6.71%

cfssl_trust's Introduction

CFSSL TRUST

This is the trust stores Cloudflare uses for CFSSL. It also includes the sources of the trust chain that can be built using the mkbundle utility from CFSSL.

Files:

.
├── ca-bundle.crt
├── ca-bundle.crt.metadata
├── certdata
│   └── trusted_roots
│       ├── froyo.pem
│       ├── gingerbread.pem
│       ├── honeycomb.pem
│       ├── ics.pem
│       ├── ios.pem
│       ├── kitkat.pem
│       ├── nss.pem
│       ├── osx.pem
│       ├── ubuntu.pem
│       └── windows.pem
├── int-bundle.crt
├── README.md

The ca-bundle.crt file contains the trusted roots. CFSSL uses the ca-bundle.crt.metadata when building bundles to assist in building bundles that need to verified in the maximum number of trust stores on different systems. The int-bundle.crt file contains a number of known intermediates; these are preloaded for performance reasons and occasionally updated as CFSSL finds more intermediates. If an intermediate isn't in this bundle, but can be found through following the AIA CA Issuers fields, it will be downloaded and eventually merged into here.

The trusted_roots directory contains the root stores from a number of systems. Currently, we have trust stores from

NSS (Firefox, Chrome)
OS X
Windows
Android 2.2 (Frozen Yogurt)
Android 2.3 (Gingerbread)
Android 3.x (Honeycomb)
Android 4.0 (Ice Cream Sandwich)
Android 4.4 (KitKat)

Release

Prerequisites

$ go get -u github.com/kisom/goutils/cmd/certdump
$ go get -u github.com/cloudflare/cfssl/cmd/...
$ go get -u github.com/cloudflare/cfssl_trust/...

Build

The final bundles (i.e. ca-bundle.crt and int-bundle.crt) may be built as follows:

$ ./release.sh

This command automatically removes expiring certificates, and pushes the changes to a new release branch.

The content of 'ca-bundle.crt.metadata' is crucial to building ubiquitous bundle. Feel free to tune its content. Make sure the paths to individual trust root stores are correctly specified.

Adding new roots or intermediates

New roots and intermediates can be added using the same command, just by providing values for the NEW_ROOTS and NEW_INTERMEDIATES variables:

$ NEW_ROOTS="/path/to/root1 /path/to/root2" NEW_INTERMEDIATES="/path/to/int1 /path/to/int22" ./release.sh

Check for expiring roots or intermediates

To verify that an intermediate or root certificate is expiring or revoked without creating a release, the expiring command can be used from the project root directory.

To check for expiring or revoked intermediate certificates in the database provided in this repo:

$ cfssl-trust -d ./cert.db -b int expiring

To check for expiring or revoked root certificates:

$ cfssl-trust -d ./cert.db -b ca expiring

./cert.db which is specified as the database using the -d flag, contains both intermediate and root certificates. Any certificate database can be used here in place of ./cert.db

These calls to the expiring command will provide an output showing if there are any expiring or revoked certificates.

...
1 certificates expiring.
0 certificates revoked.

cfssl_trust's People

Contributors

Stargazers

Watchers

cfssl_trust's Issues

Update Cybertrust Japan SureServer EV CA G3

There is a new intermediate available:

Field	Content
コモンネーム（CN）	Cybertrust Japan SureServer EV CA G3
組織単位名（OU）	-
組織名（O）	-
国名（C）	JP
有効期間の開始（JST）	2023 年 12 月 13 日 15:28:45
有効期間の終了（JST）	2029 年 5 月 29 日 14:00:39
署名アルゴリズム	sha256RSA
公開鍵長	2048bit
シリアル番号	22b9b1a12d91f181ad7a7b6dbeb38ea7
SHA-1 フィンガープリント	8C 16 16 7A 04 BA 49 92 91 8E B6 C4 44 41 47 C0 FF 84 2D 93
SHA-256 フィンガープリント	B7 23 27 3A 35 06 C6 BE D8 5F 08 3D A5 62 73 4B E0 9F 2C 47 AD E4 73 17 83 1D 63 AA 8B E2 78 A5

ref: https://www.cybertrust.co.jp/info/2023/1208-new-intermediate-certificates.html

Recommended replacement for cmd/format/format.go?

I used to use format.go to create a directory of certificates from a bundle. It looks like the CLI tool has seen some major improvements, but I'm curious what the sanest way to replicate that functionality is. It appears the most naive way would be to dump the release-info and then loop with the dump command, but that feels inefficient compared to the single command.

cannot checkout on windows due to invalid chars in some file names

Originally filed as cloudflare/cfssl#589 but should have been filed here:

git clone https://github.com/cloudflare/cfssl.git cftest
Cloning into 'cftest'...
remote: Counting objects: 6855, done.
remote: Compressing objects: 100% (71/71), done.
Receiving objects: 100% (6855/6855), 8.10 MiB | 423.00 KiB/s, done.1

Resolving deltas: 100% (2913/2913), done.
Checking connectivity... done.
error: unable to create file vendor/github.com/cloudflare/cfssl_trust/ca-bundle/SwissSignCA(RSAIKMay6199918:00:58)_2000-11-26_SHA1WithRSA.crt (Invalid argument)
error: unable to create file vendor/github.com/cloudflare/cfssl_trust/ca-bundle/SwissSignCA(RSAIKMay6199918:00:58)_2000-11-26_SHA1WithRSA_2.crt (Invalid argument)
Checking out files: 100% (3122/3122), done.
fatal: unable to checkout working tree
warning: Clone succeeded, but checkout failed.
You can inspect what was checked out with 'git status'
and retry the checkout with 'git checkout -f HEAD'

Suggestion was made to also change https://github.com/cloudflare/cfssl_trust/blob/master/cmd/format/format.go to work around windows file name restrictions. I could submit a PR if you like to strip out colons for example.

Proposed: delete certdata/{ca_bundle,intermediates}/

This would fix #23 and #26.

We have the certificates imported into the trust database and we're using this to produce the {ca,int}-bundle.crt now. We should be able to remove the individual certificates.

Update the CA bundles

Found a CA (Symantec Class 3 Secure Server CA - G4) that was missing here, but existed in the Chromium CA code.

The PEM bundles in trusted_roots appear to be missing Android versions Lollipop and Marshmallow. NSS is up to v3.22.2. Not sure about the OS bundles, but they probably need updating, too.

re-generate bundles per #21 as windows checkout still broken

Not sure if you want to do this when you do #19 but per #21 you need to re-generate the bundles to support windows.

Add TravisCI Support

After a recent bug that was based on a typo in a json file ( f04b7a9 ) it would be useful to get this set up under TravisCI with some basic tests running.

Break dependency cycle between cfssl and cfssl_trust

cfssl imports from cffsl_trust which imports from cfssl. Fortunately, the cfssl packages imported by cfssl_trust don't depend on cfssl_trust. Otherwise, it wouldn't build. It's still not a great situation to be in, and we should try to sever the dependency of cfssl_trust on cfssl.

The easiest way to do this would be to just merge the two repos. cfssl_trust would still be go gettable as an individual package inside the cfssl repo. We'd have to deprecate the cfssl_trust repo and update the README to point people to the cloudflare/cfssl/trust package.

What do you think?

add integrity check with ubuntu root ca fetching

Also, it will be good to avoid hardcoding package name. We can parse the package name and find the latest one, fetch it along with the dsc file and verify it.

invalid char ':' when trying to resolve dependency

try to resolve dependency with go mod enable
go build ...

the following error appears:

github.com/cloudflare/cfssl_trust/@v/v0.0.0-20160211195630-555f7ac5ef2b.zip: malformed file path "ca-bundle/S-TRUSTAuthenticationandEncryptionRootCA2005:PN_2005-6-22_SHA1WithRSA.crt": invalid char ':'
go: extracting github.com/cloudflare/go-metrics v0.0.0-20151117154305-6a9aea36fb41
go: extracting github.com/cloudflare/redoctober v0.0.0-20160202033125-18b5ac859f0a
{
  "status": "failure",
  "totals": {
    "success": 0,
    "failure": 1
  }
}

Missing file due to recent changes causes build failures on Amazon Linux

Hi, this is a very initial report as we're not yet fully aware of which package is exactly affected.
However, we are getting 404s In our of our bootstrap scripts. If it's possible for you guys to restore the previous directory structure, we can investigate where this comes from without affecting server bootstraps.

Cannot clone this repository on Windows

There is at least one file in this repo which has a colon its filename which means as part of revendoring the docker engine http://GitHub.com/docker/docker (which incorporates part of this repo in its vendor structure), the revendoring process using the vndr tool (https://github.com/LK4D4/vndr) by @LK4D4 fails on Windows (colon is not a valid character in a filename).

Unfortunately git clone attempts to clone the entire repo, and I can't just add the directory to the .gitignore.

Would it be possible to rename this file? (Or others which similarly have invalid Windows characters in their filenames?)

2016/11/06 13:31:49 Errors on clone:
github.com/cloudflare/cfssl: Err: exit status 128, out: Cloning into 'E:\go\src\github.com\docker\docker\vendor\github.com\cloudflare\cfssl'...
error: unable to create file vendor/github.com/cloudflare/cfssl_trust/ca-bundle/SwissSignCA(RSAIKMay6199918:00:58)_2000-11-26_SHA1WithRSA.crt: Invalid argument
error: unable to create file vendor/github.com/cloudflare/cfssl_trust/ca-bundle/SwissSignCA(RSAIKMay6199918:00:58)_2000-11-26_SHA1WithRSA_2.crt: Invalid argument

Cfssl_trust

Can't checkout with Windows

trying to check this out on windows and it appears to fail:

C:\Users\klauer\Downloads> git clone [email protected]:cloudflare/cfssl_trust.git
Cloning into 'cfssl_trust'...
remote: Counting objects: 6496, done.
remote: Total 6496 (delta 0), reused 0 (delta 0), pack-reused 6496R
Receiving objects: 100% (6496/6496), 29.76 MiB | 8.40 MiB/s, done.
Resolving deltas: 100% (1217/1217), done.
error: unable to create file vendor/github.com/cloudflare/cfssl/vendor/github.com/cloudflare/cfssl_trust/ca-bundle/SwissSignCA(RSAIKMay6199918:00:58)_2000-11-26_SHA1WithRSA.crt: Invalid argument
error: unable to create file vendor/github.com/cloudflare/cfssl/vendor/github.com/cloudflare/cfssl_trust/ca-bundle/SwissSignCA(RSAIKMay6199918:00:58)_2000-11-26_SHA1WithRSA_2.crt: Invalid argument
Checking out files: 100% (6524/6524), done.
fatal: unable to checkout working tree
warning: Clone succeeded, but checkout failed.
You can inspect what was checked out with 'git status'
and retry the checkout with 'git checkout -f HEAD'

Add SSL.com's Root CAs to Nimbus accepted roots

We would like to add SSL.com's 4 Roots to the Nimbus accepted roots. All roots are currently trusted by Mozilla and Microsoft.
The certificates for the aforementioned roots can be found at:
https://www.ssl.com/repository/SSLcomRootCertificationAuthorityRSA.pem
https://www.ssl.com/repository/SSLcom-RootCA-EV-RSA-4096-R2.pem
https://www.ssl.com/repository/SSLcomRootCertificationAuthorityECC.pem
https://www.ssl.com/repository/SSLcomEVRootCertificationAuthorityECC.pem

Thank you.

Re-vendor cfssl

After landing cloudflare/cfssl#812, please re-vendor that. Currently this repo can't be checked out on filesystems that disallow the colon (:) character in names.

(Separately I have to wonder why there is a circular dependency between these two repositories.)