Skip to content
Snippets Groups Projects
Unverified Commit 5c5ccfd1 authored by trop[bot]'s avatar trop[bot] Committed by GitHub
Browse files

fix: remove expired DST Root CA X3 (#31269)

* Revert "fix: Enable X509_V_FLAG_TRUSTED_FIRST flag in BoringSSL (#31215)"

This reverts commit 3bb36a62

.

* fix: remove expired DST Root CA X3

Co-authored-by: default avatardeepak1556 <hop2deep@gmail.com>
parent e395cd39
No related merge requests found
expose_ripemd160.patch
expose_aes-cfb.patch
expose_des-ede3.patch
enable_x509_v_flag_trusted_first_flag.patch
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
From: Juan Cruz Viotti <jv@jviotti.com>
Date: Thu, 30 Sep 2021 13:39:23 -0400
Subject: Enable X509_V_FLAG_TRUSTED_FIRST flag
Signed-off-by: Juan Cruz Viotti <jv@jviotti.com>
diff --git a/crypto/x509/x509_vpm.c b/crypto/x509/x509_vpm.c
index d8d1efe883321510e4da1aab2cd78378e395c2b2..a371d611dbb2ea7a287a3cb117c3e3d0e1a925b6 100644
--- a/crypto/x509/x509_vpm.c
+++ b/crypto/x509/x509_vpm.c
@@ -548,7 +548,7 @@ static const X509_VERIFY_PARAM default_table[] = {
(char *)"default", /* X509 default parameters */
0, /* Check time */
0, /* internal flags */
- 0, /* flags */
+ X509_V_FLAG_TRUSTED_FIRST, /* flags */
0, /* purpose */
0, /* trust */
100, /* depth */
......@@ -34,3 +34,4 @@ fix_parallel_test-crypto-ecdh-convert-key_to_use_compatible_group.patch
src_inline_asynccleanuphookhandle_in_headers.patch
node-api_faster_threadsafe_function.patch
src_add_missing_context_scopes.patch
fix_remove_expired_dst_root_ca_x3.patch
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
From: deepak1556 <hop2deep@gmail.com>
Date: Fri, 1 Oct 2021 08:03:08 +0900
Subject: fix: remove expired DST Root CA X3
The alternative ISRG Root X1 trusted certificate is
already available in this bundle.
https://letsencrypt.org/docs/certificate-compatibility/
https://www.openssl.org/blog/blog/2021/09/13/LetsEncryptRootCertExpire/
diff --git a/src/node_root_certs.h b/src/node_root_certs.h
index 47beb730f4b853f1bf248a7fd1b1cd7d726bdf7e..94ac882ec7e4e2eb61d1f0094f79fb6f603d978c 100644
--- a/src/node_root_certs.h
+++ b/src/node_root_certs.h
@@ -525,26 +525,6 @@
"yx5DaMkHJ8HSXPfqIbloEpw8nL+e/IBcm2PN7EeqJSdnoDfzAIJ9VNep+OkuE6N36B9K\n"
"-----END CERTIFICATE-----",
-/* DST Root CA X3 */
-"-----BEGIN CERTIFICATE-----\n"
-"MIIDSjCCAjKgAwIBAgIQRK+wgNajJ7qJMDmGLvhAazANBgkqhkiG9w0BAQUFADA/MSQwIgYD\n"
-"VQQKExtEaWdpdGFsIFNpZ25hdHVyZSBUcnVzdCBDby4xFzAVBgNVBAMTDkRTVCBSb290IENB\n"
-"IFgzMB4XDTAwMDkzMDIxMTIxOVoXDTIxMDkzMDE0MDExNVowPzEkMCIGA1UEChMbRGlnaXRh\n"
-"bCBTaWduYXR1cmUgVHJ1c3QgQ28uMRcwFQYDVQQDEw5EU1QgUm9vdCBDQSBYMzCCASIwDQYJ\n"
-"KoZIhvcNAQEBBQADggEPADCCAQoCggEBAN+v6ZdQCINXtMxiZfaQguzH0yxrMMpb7NnDfcdA\n"
-"wRgUi+DoM3ZJKuM/IUmTrE4Orz5Iy2Xu/NMhD2XSKtkyj4zl93ewEnu1lcCJo6m67XMuegwG\n"
-"MoOifooUMM0RoOEqOLl5CjH9UL2AZd+3UWODyOKIYepLYYHsUmu5ouJLGiifSKOeDNoJjj4X\n"
-"Lh7dIN9bxiqKqy69cK3FCxolkHRyxXtqqzTWMIn/5WgTe1QLyNau7Fqckh49ZLOMxt+/yUFw\n"
-"7BZy1SbsOFU5Q9D8/RhcQPGX69Wam40dutolucbY38EVAjqr2m7xPi71XAicPNaDaeQQmxkq\n"
-"tilX4+U9m5/wAl0CAwEAAaNCMEAwDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMCAQYw\n"
-"HQYDVR0OBBYEFMSnsaR7LHH62+FLkHX/xBVghYkQMA0GCSqGSIb3DQEBBQUAA4IBAQCjGiyb\n"
-"FwBcqR7uKGY3Or+Dxz9LwwmglSBd49lZRNI+DT69ikugdB/OEIKcdBodfpga3csTS7MgROSR\n"
-"6cz8faXbauX+5v3gTt23ADq1cEmv8uXrAvHRAosZy5Q6XkjEGB5YGV8eAlrwDPGxrancWYaL\n"
-"bumR9YbK+rlmM6pZW87ipxZzR8srzJmwN0jP41ZL9c8PDHIyh8bwRLtTcm1D9SZImlJnt1ir\n"
-"/md2cXjbDaJWFBM5JDGFoqgCWjBH4d1QB7wCCZAA62RjYJsWvIjJEubSfZGL+T0yjWW06Xyx\n"
-"V3bqxbYoOb8VZRzI9neWagqNdwvYkQsEjgfbKbYK7p2CNTUQ\n"
-"-----END CERTIFICATE-----",
-
/* SwissSign Gold CA - G2 */
"-----BEGIN CERTIFICATE-----\n"
"MIIFujCCA6KgAwIBAgIJALtAHEP1Xk+wMA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNVBAYTAkNI\n"
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment