5

Some distributions of the cURL bundle include a utility mk-ca-bundle.pl which compiles a ca-bundle.crt from Mozilla's root certificate store for use as a list of trusted authorities. The script prints the following warnings:

  1. Using http is subject to man in the middle attack of certdata content
  2. Default to 'release', but more recent updates may be found in other trees
  3. certdata.txt file format may change, lag time to update this script
  4. Generally unwise to blindly trust CAs without manual review & verification
  5. Mozilla apps use additional security checks aren't represented in certdata
  6. Use of this script will make a security engineer grind his teeth and swear at you

Exactly what is the concern referenced by #4 and how can I compile an updated version of ca-bundle.crt securely?

14
  • I'm unsure what you are asking. Are you looking for a replacement for mk-ca-bundle.pl? If so, would you want it to have different functionality or would the old functionality be fine? If different, what would you want to be different. Commented Dec 30, 2015 at 0:48
  • 1
    I just downloaded cURL and the script came in the download package. Why do you say it has been discontinued? Commented Dec 30, 2015 at 0:54
  • 1
    @NeilSmithline I'd want a way to compile a ca-bundle from an authenticated source (mk-ca-bundle just assumes the certdata it gets is authentic). I've updated the question wrt the second question.
    – gary
    Commented Dec 30, 2015 at 2:29
  • Do you have a link to text explaining why it was discontinued? That might be helpful? Commented Dec 30, 2015 at 2:32
  • 2
    Yes. I read the OP. But I downloaded cURL from the definitive site, curl.haxx.se, and it contained the mk-ca-bundle.pl file. So I'm asking where you read that there's a security problem with the script. Commented Dec 30, 2015 at 20:13

1 Answer 1

1

The concern is that each CA included has the organizational power to break your security, and will use that under different and hard to predict circumstance. The "manual review" step is intended as a reminder that you need to have some process or criteria of which CAs you want to include.

What exactly that should include is subject to ongoing debate by experts.

For example, Google's review process has caused them to kick out a subset of Symantec's certificates. (https://googleonlinesecurity.blogspot.ro/2015/12/proactive-measures-in-digital.html). Another example is Tor not trusting CyberRoam (https://blog.torproject.org/category/tags/ca-certificates) Microsoft essentially outsources the decision to a group called the CA Browser Forum.

So there is not a specific list of steps you can take in #4 that will satisfy #6.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .