make-ca-1.16.1

What's Changed

• Update the URL in make-ca.conf.dist to match the one in make-ca. by @renodr in #36

Full Changelog: v1.16...v1.16.1

The bug in make-ca.conf.dist was reported to me privately by Andrew K. from AVS ISP.

make-ca-1.16

• Change the certificate root for Mozilla to Let's Encrypt and adjust the URL to use https://hg-edge.mozilla.org instead of https://hg.mozilla.org. This is required because hg.mozilla.org now permanently redirects to hg-edge.mozilla.org, and the security certificate is now signed by Let's Encrypt. Also of note is that the command used to get the log and certdata.txt had to be adjusted for this change. This should work until 2035, as that is when the root certificate expires. This fixes #34.

make-ca-1.15

• Revert "work around bug in p11-kit trust extract that allows certificates with nss-{email,server}-distrust after attribute to enter downstream": that isn't a bug in fact. The date in the attribute should be compared with the issue date of the downstream certificate provided by the web server or the email sender (that make-ca cannot know), not the system date. SSL implementations like GnuTLS or OpenSSL should handle them, but they seem not doing it properly. However that's not a valid reason to misinterpret the attribute.

make-ca-1.14

• Silence a warning from OpenSSL 3.2.x
• Stop using statically named temporary files
• Prevent translated date in the man page

Note: since this release the official tarball will be the git archive, i.e. https://github.com/lfs-book/make-ca/archive/v1.14/make-ca-1.14.tar.gz for 1.14.

We'll no longer manually create a release tarball and upload it because doing so is not necessary (we don't need any generated files in the tarball) and we can save the editors' time for more useful things, and in case one of us turned evil or hijacked it's more difficult to conduct a "Jia Tan" style attack with the git archive.

make-ca-1.13

This release is needed to update the root certificate from hg.mozilla.org

make-ca-1.12

• Remove extraneos output at end of downloaded certdata.txt file
• Work around bug in p11-kit trust extract that allows certificates with nss-{email,server}-distust after attribute to enter downstream trust bundles where this attribute is not honored.

make-ca-1.11

Changes since make-ca-1.10:

• Ship certificate of the CA root of hg.mozilla.org and use it for verification
• Update CS.txt (and update-mscertsign.sh)

make-ca-1.10

Changes since make-ca-1.9:

• Use --filter=ca-anchors for all stores
• Update CS.txt (no changes since last update)
• Fix installation of systemd timers on non-systemd systems

make-ca-1.9

Changes since make-ca-1.8.1:

• Guard overrides on first run to avoid error message
• Move dist files to /etc/make-ca
• Add distribution script to update CS.txt from CCADB

make-ca-1.8.1

• Rerelease of 1.8 - set default for code signing to off

1.8 Release notes:

• Use get_p11_label for certificate name in output when processing local certificates
• Use "Subject:" line for get_p11_label()
• Use last OU= value for get_p11_label() fallback
• Fix several text issues in get_p11_label - Thanks to Michael Joost
• Omit x-certificate-extension in comparison for copy-local-modifications
• Use X509v3 Key Usage section to determine local trust for anchors added using 'trust anchor --store'
• Add nss-{server,email}-distrust-after values in anchors - requires p11-kit >= 0.23.19
• Use --filter=certificates for all stores
• Fix output of NSSDB and Java PCKS#12 stores
• Correct incorrectly named get_p11_val()
• Use .p11-kit extension for anchors
• Handle getopt style short options in get_args()
• Use Microsoft's trust for code signing with -i | --mscodesign
  Note: this is manually generated, will add CCADB when available
• Backup and restore anchors with PKIX extensions