mirrors/nodejs
mirrors/nodejs
0
0
Fork 0
mirror of https://github.com/nodejs/node.git synced 2024-12-01 16:10:02 +01:00
Code Issues Releases Activity
ac6739d96d
nodejs/doc/guides/maintaining-root-certs.md

126 lines
3.6 KiB
Markdown
Raw Normal View History

doc: improve doc/markdown file organization coherence * Updated cpp style guide file name and location and fixed links to this file. * Updated collaborator guide file name and location and fixed links to this file. * Updated documentation style guide file name and location and updated links referencing the file. * Moved files to appropriate location and updated naming style for some of them. Fixes: https://github.com/nodejs/node/issues/31741 PR-URL: https://github.com/nodejs/node/pull/31792 Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Sam Roberts <vieuxtech@gmail.com>
2020-02-14 13:54:11 +01:00
# Maintaining the Root Certificates
doc: describe root cert update process PR-URL: https://github.com/nodejs/node/pull/25113 Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl> Reviewed-By: Ruben Bridgewater <ruben@bridgewater.de>
2018-12-18 20:27:58 +01:00
Node.js contains a compiled-in set of root certificates used as trust anchors
for TLS certificate validation.
The certificates come from Mozilla, specifically NSS's `certdata.txt` file.
The PEM encodings of the certificates are converted to C strings, and committed
in `src/node_root_certs.h`.
## When to update
Root certificates should be updated sometime after Mozilla makes an NSS release,
check the [NSS release schedule][].
## Process
Commands assume that the current working directory is the root of a checkout of
the nodejs/node repository.
1. Find NSS metadata for update.
doc: indent ordered list child content Markdownlint flags this with MD029 rule. Markdown renders will usually use list continuation number if it can. Explicitly adding it to the list item child scope makes it clearer. PR-URL: https://github.com/nodejs/node/pull/29332 Reviewed-By: Rich Trott <rtrott@gmail.com> Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
2019-09-01 00:42:48 +02:00
The latest released NSS version, release date, Firefox version, and Firefox
release date can be found in the [NSS release schedule][].
doc: describe root cert update process PR-URL: https://github.com/nodejs/node/pull/25113 Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl> Reviewed-By: Ruben Bridgewater <ruben@bridgewater.de>
2018-12-18 20:27:58 +01:00
doc: indent ordered list child content Markdownlint flags this with MD029 rule. Markdown renders will usually use list continuation number if it can. Explicitly adding it to the list item child scope makes it clearer. PR-URL: https://github.com/nodejs/node/pull/29332 Reviewed-By: Rich Trott <rtrott@gmail.com> Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
2019-09-01 00:42:48 +02:00
The tag to fetch `certdata.txt` from is found by looking for the release
version in the [tag list][].
doc: describe root cert update process PR-URL: https://github.com/nodejs/node/pull/25113 Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl> Reviewed-By: Ruben Bridgewater <ruben@bridgewater.de>
2018-12-18 20:27:58 +01:00
2. Update `certdata.txt` from the NSS release tag.
doc: indent ordered list child content Markdownlint flags this with MD029 rule. Markdown renders will usually use list continuation number if it can. Explicitly adding it to the list item child scope makes it clearer. PR-URL: https://github.com/nodejs/node/pull/29332 Reviewed-By: Rich Trott <rtrott@gmail.com> Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
2019-09-01 00:42:48 +02:00
Update the tag in the commands below, and run:
doc: add blanks around code fences Addresses Markdownlint MD031 rule warnings PR-URL: https://github.com/nodejs/node/pull/29366 Reviewed-By: Rich Trott <rtrott@gmail.com> Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Jeremiah Senkpiel <fishrock123@rocketmail.com> Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com> Reviewed-By: Gus Caplan <me@gus.host> Reviewed-By: David Carlier <devnexen@gmail.com>
2019-08-29 15:28:03 +02:00
doc: normalize shell code block info strings Prior to this commit, shell fenced code blocks in Markdown files had inconsistent info strings. This has been corrected to standarize on the one with the highest frequency in the doc/api/ dir. Stats: > 'console' => 54, > 'shell' => 2, PR-URL: https://github.com/nodejs/node/pull/33486 Reviewed-By: Luigi Pinca <luigipinca@gmail.com> Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Ruben Bridgewater <ruben@bridgewater.de>
2020-05-20 17:10:22 +02:00
```bash
doc: indent ordered list child content Markdownlint flags this with MD029 rule. Markdown renders will usually use list continuation number if it can. Explicitly adding it to the list item child scope makes it clearer. PR-URL: https://github.com/nodejs/node/pull/29332 Reviewed-By: Rich Trott <rtrott@gmail.com> Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
2019-09-01 00:42:48 +02:00
cd tools/
./mk-ca-bundle.pl -v 2>_before
curl -O https://hg.mozilla.org/projects/nss/raw-file/NSS_3_41_RTM/lib/ckfw/builtins/certdata.txt
```
doc: describe root cert update process PR-URL: https://github.com/nodejs/node/pull/25113 Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl> Reviewed-By: Ruben Bridgewater <ruben@bridgewater.de>
2018-12-18 20:27:58 +01:00
doc: indent ordered list child content Markdownlint flags this with MD029 rule. Markdown renders will usually use list continuation number if it can. Explicitly adding it to the list item child scope makes it clearer. PR-URL: https://github.com/nodejs/node/pull/29332 Reviewed-By: Rich Trott <rtrott@gmail.com> Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
2019-09-01 00:42:48 +02:00
The `_before` file will be used later. Verify that running `mk-ca-bundle`
made no changes to `src/node_root_certs.h`. If it did, something went wrong
with the previous update. Seek help!
doc: describe root cert update process PR-URL: https://github.com/nodejs/node/pull/25113 Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl> Reviewed-By: Ruben Bridgewater <ruben@bridgewater.de>
2018-12-18 20:27:58 +01:00
doc: indent ordered list child content Markdownlint flags this with MD029 rule. Markdown renders will usually use list continuation number if it can. Explicitly adding it to the list item child scope makes it clearer. PR-URL: https://github.com/nodejs/node/pull/29332 Reviewed-By: Rich Trott <rtrott@gmail.com> Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
2019-09-01 00:42:48 +02:00
Update metadata in the message below, and commit `certdata.txt`:
doc: describe root cert update process PR-URL: https://github.com/nodejs/node/pull/25113 Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl> Reviewed-By: Ruben Bridgewater <ruben@bridgewater.de>
2018-12-18 20:27:58 +01:00
doc: indent ordered list child content Markdownlint flags this with MD029 rule. Markdown renders will usually use list continuation number if it can. Explicitly adding it to the list item child scope makes it clearer. PR-URL: https://github.com/nodejs/node/pull/29332 Reviewed-By: Rich Trott <rtrott@gmail.com> Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
2019-09-01 00:42:48 +02:00
```text
tools: update certdata.txt
doc: describe root cert update process PR-URL: https://github.com/nodejs/node/pull/25113 Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl> Reviewed-By: Ruben Bridgewater <ruben@bridgewater.de>
2018-12-18 20:27:58 +01:00
doc: indent ordered list child content Markdownlint flags this with MD029 rule. Markdown renders will usually use list continuation number if it can. Explicitly adding it to the list item child scope makes it clearer. PR-URL: https://github.com/nodejs/node/pull/29332 Reviewed-By: Rich Trott <rtrott@gmail.com> Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
2019-09-01 00:42:48 +02:00
This is the certdata.txt[0] from NSS 3.41, released on 2018-12-03.
doc: describe root cert update process PR-URL: https://github.com/nodejs/node/pull/25113 Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl> Reviewed-By: Ruben Bridgewater <ruben@bridgewater.de>
2018-12-18 20:27:58 +01:00
doc: indent ordered list child content Markdownlint flags this with MD029 rule. Markdown renders will usually use list continuation number if it can. Explicitly adding it to the list item child scope makes it clearer. PR-URL: https://github.com/nodejs/node/pull/29332 Reviewed-By: Rich Trott <rtrott@gmail.com> Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
2019-09-01 00:42:48 +02:00
This is the version of NSS that will ship in Firefox 65 on
2018-12-11.
doc: describe root cert update process PR-URL: https://github.com/nodejs/node/pull/25113 Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl> Reviewed-By: Ruben Bridgewater <ruben@bridgewater.de>
2018-12-18 20:27:58 +01:00
doc: indent ordered list child content Markdownlint flags this with MD029 rule. Markdown renders will usually use list continuation number if it can. Explicitly adding it to the list item child scope makes it clearer. PR-URL: https://github.com/nodejs/node/pull/29332 Reviewed-By: Rich Trott <rtrott@gmail.com> Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
2019-09-01 00:42:48 +02:00
[0] https://hg.mozilla.org/projects/nss/raw-file/NSS_3_41_RTM/lib/ckfw/builtins/certdata.txt
```
doc: describe root cert update process PR-URL: https://github.com/nodejs/node/pull/25113 Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl> Reviewed-By: Ruben Bridgewater <ruben@bridgewater.de>
2018-12-18 20:27:58 +01:00
3. Update `node_root_certs.h` from `certdata.txt`.
doc: indent ordered list child content Markdownlint flags this with MD029 rule. Markdown renders will usually use list continuation number if it can. Explicitly adding it to the list item child scope makes it clearer. PR-URL: https://github.com/nodejs/node/pull/29332 Reviewed-By: Rich Trott <rtrott@gmail.com> Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
2019-09-01 00:42:48 +02:00
Run the command below:
doc: normalize shell code block info strings Prior to this commit, shell fenced code blocks in Markdown files had inconsistent info strings. This has been corrected to standarize on the one with the highest frequency in the doc/api/ dir. Stats: > 'console' => 54, > 'shell' => 2, PR-URL: https://github.com/nodejs/node/pull/33486 Reviewed-By: Luigi Pinca <luigipinca@gmail.com> Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Ruben Bridgewater <ruben@bridgewater.de>
2020-05-20 17:10:22 +02:00
```bash
doc: indent ordered list child content Markdownlint flags this with MD029 rule. Markdown renders will usually use list continuation number if it can. Explicitly adding it to the list item child scope makes it clearer. PR-URL: https://github.com/nodejs/node/pull/29332 Reviewed-By: Rich Trott <rtrott@gmail.com> Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
2019-09-01 00:42:48 +02:00
./mk-ca-bundle.pl -v 2>_after
```
Confirm that `../src/node_root_certs.h` was updated.
Determine what changes were made by diffing the before and after files:
doc: normalize shell code block info strings Prior to this commit, shell fenced code blocks in Markdown files had inconsistent info strings. This has been corrected to standarize on the one with the highest frequency in the doc/api/ dir. Stats: > 'console' => 54, > 'shell' => 2, PR-URL: https://github.com/nodejs/node/pull/33486 Reviewed-By: Luigi Pinca <luigipinca@gmail.com> Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Ruben Bridgewater <ruben@bridgewater.de>
2020-05-20 17:10:22 +02:00
```console
doc: indent ordered list child content Markdownlint flags this with MD029 rule. Markdown renders will usually use list continuation number if it can. Explicitly adding it to the list item child scope makes it clearer. PR-URL: https://github.com/nodejs/node/pull/29332 Reviewed-By: Rich Trott <rtrott@gmail.com> Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
2019-09-01 00:42:48 +02:00
% diff _before _after
11d10
< Parsing: Visa eCommerce Root
106d104
< Parsing: TÜRKTRUST Elektronik Sertifika Hizmet Sağlayıcısı H5
113,117d110
< Parsing: Certplus Root CA G1
< Parsing: Certplus Root CA G2
< Parsing: OpenTrust Root CA G1
< Parsing: OpenTrust Root CA G2
< Parsing: OpenTrust Root CA G3
134c127,136
< Done (133 CA certs processed, 20 skipped).
---
> Parsing: GlobalSign Root CA - R6
> Parsing: OISTE WISeKey Global Root GC CA
> Parsing: GTS Root R1
> Parsing: GTS Root R2
> Parsing: GTS Root R3
> Parsing: GTS Root R4
> Parsing: UCA Global G2 Root
> Parsing: UCA Extended Validation Root
> Parsing: Certigna Root CA
> Done (135 CA certs processed, 16 skipped).
```
Use the diff to update the message below, and commit `src/node_root_certs.h`:
```text
crypto: update root certificates
Update the list of root certificates in src/node_root_certs.h with
tools/mk-ca-bundle.pl.
Certificates added:
- GlobalSign Root CA - R6
- OISTE WISeKey Global Root GC CA
- GTS Root R1
- GTS Root R2
- GTS Root R3
- GTS Root R4
- UCA Global G2 Root
- UCA Extended Validation Root
- Certigna Root CA
Certificates removed:
- Visa eCommerce Root
- TÜRKTRUST Elektronik Sertifika Hizmet Sağlayıcısı H5
- Certplus Root CA G1
- Certplus Root CA G2
- OpenTrust Root CA G1
- OpenTrust Root CA G2
- OpenTrust Root CA G3
```
doc: describe root cert update process PR-URL: https://github.com/nodejs/node/pull/25113 Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl> Reviewed-By: Ruben Bridgewater <ruben@bridgewater.de>
2018-12-18 20:27:58 +01:00
[NSS release schedule]: https://wiki.mozilla.org/NSS:Release_Versions
[tag list]: https://hg.mozilla.org/projects/nss/tags
Copy Permalink