summaryrefslogtreecommitdiff
path: root/certdata.txt
diff options
context:
space:
mode:
authorJacob Hoffman-Andrews <github@hoffman-andrews.com>2017-03-20 12:28:55 -0700
committerMax Rees <maxcrees@me.com>2020-06-02 19:00:05 -0500
commita27f45644970531365ec75fb7958b8613d99ff3c (patch)
treec38d1d14e24b89f7560746cae3b620201f0b3540 /certdata.txt
parent9f002a55738f183a25813a3e324b5b66cf38755c (diff)
downloadca-certificates-a27f45644970531365ec75fb7958b8613d99ff3c.tar.gz
ca-certificates-a27f45644970531365ec75fb7958b8613d99ff3c.tar.bz2
ca-certificates-a27f45644970531365ec75fb7958b8613d99ff3c.tar.xz
ca-certificates-a27f45644970531365ec75fb7958b8613d99ff3c.zip
Remove email-only roots from mozilla trust store
These roots are trusted in the Mozilla program only for S/MIME, so should not be included in ca-certificates, which most applications use to validate TLS certificates. Per https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=721976, the only MUAs that depend on or suggest ca-certificates are Mutt and Sylpheed. Sylpheed doesn't use ca-certificates for S/MIME. Mutt does, but I think it is still safe to remove thes because: (a) S/MIME is relatively uncommon, and (b) The CAs that have both TLS and S/MIME bits will continue to work, and (c) Nearly all of the 12 removed email-only CAs have ceased operation of their email certificate services Verisign Class 1 Public Primary Certification Authority - G3 Verisign Class 2 Public Primary Certification Authority - G3 UTN USERFirst Email Root CA SwissSign Platinum CA - G2 AC Raiz Certicamara S.A. TC TrustCenter Class 3 CA II ComSign CA S-TRUST Universal Root CA Symantec Class 1 Public Primary Certification Authority - G6 Symantec Class 2 Public Primary Certification Authority - G6 Symantec Class 1 Public Primary Certification Authority - G4 Symantec Class 2 Public Primary Certification Authority - G4
Diffstat (limited to 'certdata.txt')
0 files changed, 0 insertions, 0 deletions