3 ms·
RE: Linux, You're correct, they're provided through the ca-certificates package[0]: "It includes, among others, certificate authorities used by the Debian infr
by aroch 10y ago
RE: Linux, You're correct, they're provided through the ca-certificates package[0]:
"It includes, among others, certificate authorities used by the Debian infrastructure and those shipped with Mozilla's browsers. "
RE: OSX - If you can get into Mozilla's trust stores, it's the same steps (and pro forma, more or less) [1]
[0] https://packages.debian.org/wheezy/ca-certificates https://packages.debian.org/wheezy/ca-certificates
[1] https://www.apple.com/certificateauthority/ca_program.html https://www.apple.com/certificateauthority/ca_program.html
- gsnedders 10y agoHistorically ca-certificates has included certificates that Mozilla had declined to include due to lack of audits, most notably the SPI root certificate because some Debian infrastructure relied upon it. They've also generally been relatively slow in removing root certificates after they're removed upstream, despite any removal essentially being a security issue. I think as of six months or so ago there is no longer any difference between ca-certificates and upstream.