The Certificate Authority Program is designed to make it easier for Netscape customers to get certificates. For more information on getting a personal certificate, check out the Certificate Authorities that are currently offering client and server certificate services.
The Certificate Authority program is open to Certificate Authorities that meet an established set of criteria. Certificate Authorities may participate at the Premier, Distinguished, and Basic levels, though the Premier level is closed at this time.
Our SSL CA certificate database is basically a subset of Windows' and Mac OS X's, so our users are probably more likely to encounter certificate error pages unnecessarily.
Around early September 2014, Mozilla removed the trust bits from the certs in their CA bundle that were still using RSA 1024 bit keys. This may lead to TLS libraries having a hard time to verify some sites if the library in question doesn't properly support "path discovery" as per RFC 4158. (That includes OpenSSL and GnuTLS.)
以下7種類の認証局に対応したルート証明書(以下、端末側ルート証明書)が、SSL対応機種にそれぞれ搭載されています。
ルート証明書
下記8社31種類のCAが発行したサーバ証明書に対応しています。
/etc/ssl/certs/ あたりに
/etc/ssl/certs/ca-certificates.crt /etc/ssl/certs /etc/pki/tls/certs /etc/pki/tls/certs/ca-bundle.crt /etc/ssl/ca-bundle.pem /etc/pki/tls/cacert.pem /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem /etc/ssl/cert.pem /system/etc/security/cacerts /usr/local/share/certs /etc/openssl/certs /var/ssl/certs /etc/ssl/certs
に
/etc/ssl/certs/ca-certificates.crt
があるほかに
c8763593.0
みたいな
VeriSign_Class_3_Public_Primary_Certification_Authority_-_G4.pem
みたいなファイルとかいろいろあります。
/etc/ssl/private
という
.0,
.1
のような数値の
.pemファイル
cert.pem
certs
SSL_CERT_FILE,
SSL_CERT_DIR
が指定された場合、それぞれ
AnyEvent::TLS
は
ca_file として ca_path として ca_cert
としてPERL_ANYEVENT_CA_FILE,
PERL_ANYEVENT_CA_PATH
も用意されています。
ca_cert
もとても便利な機能です。
AnyEvent::TLS
はいちいちSSL_CERT_FILE,
SSL_CERT_DIR
で使用する
AnyEvent::TLS
にはcert_file、
それに対応するkey_file、
それをcert,
key
を指定できます。
--cacert, --capath
とCURL_CA_BUNDLE
があります。
また
curl.exe,
PATH
の
curl-ca-bundle.crt
という名前のファイルを探します。
--key,
--cert,
-E
があります。
--proxy-cacert,
--proxy-capath,
--proxy-key,
--proxy-cert
があります。
--ca-certificate,
--ca-directory,
--certificate,
--private-key、
設定ファイルの項目
ca_certificate,
ca_directory,
certificate,
private_key
があります。
--http-ssl-cert,
--http-ssl-cert-crt-key
があります。
mysql (--ssl-ca,
--ssl-capath,
--ssl-cert,
--ssl-key,
--ssl-crl,
--ssl-crlpath
があります。
update-ca-certificates
Mozilla::CA
があります .pemファイル.pemファイル
Mozilla::CATo enable certificate chain validation, Chrome has access to two stores of trust anchors: certificates that are empowered as issuers. One trust anchor store is the system or public trust anchor store, and the other other is the local or private trust anchor store. The public store is provided as part of the operating system, and intended to authenticate public internet servers. The private store contains certificates installed by the user or the administrator of the client machine. Private intranet servers should authenticate themselves with certificates issued by a private trust anchor.
Chrome’s key pinning feature is a strong form of web site authentication that requires a web server’s certificate chain not only to be valid and to chain to a known-good trust anchor, but also that at least one of the public keys in the certificate chain is known to be valid for the particular site the user is visiting. This is a good defense against the risk that any trust anchor can authenticate any web site, even if not intended by the site owner: if an otherwise-valid chain does not include a known pinned key (“pin”), Chrome will reject it because it was not issued in accordance with the site operator’s expectations.