mirror of
https://git.launchpad.net/ubuntu/+source/ca-certificates
synced 2025-04-13 09:38:26 +00:00
50 lines
2.2 KiB
Text
50 lines
2.2 KiB
Text
The Debian Package “ca-certificates”
|
|
----------------------------------
|
|
|
|
This package includes PEM files of CA certificates to allow SSL-based
|
|
applications to check for the authenticity of SSL connections.
|
|
|
|
Please note that Debian can neither confirm nor deny whether the
|
|
certificate authorities whose certificates are included in this package
|
|
have in any way been audited for trustworthiness or RFC 3647 compliance.
|
|
Full responsibility to assess them belongs to the local system
|
|
administrator.
|
|
|
|
The CA certificates contained in this package are installed into
|
|
“/usr/share/ca-certificates”.
|
|
|
|
The configuration file “/etc/ca-certificates.conf” is seeded with
|
|
trust information through Debconf. Just call “dpkg-reconfigure
|
|
ca-certificates” to adjust the settings.
|
|
|
|
“update-ca-certificates” will then update “/etc/ssl/certs” which may be
|
|
used by the web browsers in Debian. It will also generate the hash
|
|
symlinks and generate a single-file version in
|
|
“/etc/ssl/certs/ca-certificates.crt”.
|
|
|
|
If you want to install local certificate authorities to be implicitly
|
|
trusted, please put the certificate files as single files ending with
|
|
“.crt“ into “/usr/local/share/ca-certificates” and re-run
|
|
“update-ca-certificates”. If you want to prepare a local package
|
|
of your certificates, you should depend on “ca-certificates“, install
|
|
the PEM files into “/usr/local/share/ca-certificates” as above and call
|
|
“update-ca-certificates” in the package's “postinst“.
|
|
|
|
How certificates will be accepted into the ca-certificates package
|
|
------------------------------------------------------------------
|
|
|
|
Option 1:
|
|
- File a *GPG-signed* bug report against ca-certificates with
|
|
*severity normal*. The bug report must include an attached
|
|
copy of the PEM certificates of the CA, a link to and a
|
|
description of the CA, the licence of the CA certificate
|
|
and signed fingerprint and/or hash values of the certificate.
|
|
- Get two or three recommendations from other people to the
|
|
bug report, GPG-signed (preferably from the strong set).
|
|
- CA certificates will not be accepted if requested by only
|
|
one person.
|
|
|
|
Option 2:
|
|
- Get it included into Mozilla's trust store.
|
|
- File a bug against ca-certificates stating this fact.
|
|
|