bagder / ca-bundle

The Mozilla CA bundle extracted and converted to PEM. This repository functions as a backup to the automated service on the curl web site.

Backup only

This repository serves only as a backup to https://curl.se/docs/caextract.html. That's the primary resource and site.

ca-bundle

The Mozilla CA bundle extracted and converted to PEM at regular intervals. See the PEM file itself for the actual date of the latest Mozilla source change that is included in converted file.

license

The converted file is licensed under the same license as the Mozilla source file: MPL 2.0

conversion

We use mk-ca-bundle.pl from curl:

https://github.com/curl/curl/blob/master/lib/mk-ca-bundle.pl

ca-bundle's Issues

Repo does have a purpose

I think you should continue to have a repo for this so we can track changes to the certificates

Feature request

Can you add releases/tags to this repo for every new version of the bundle?
My use case is to consume the bundle in our project.
A github versioned resource is better than wgetting from the curl website since wgetting places an unnecessary burden on the curl website.

License out of date

Quoting README: "The converted file is licensed under the same licenses as the Mozilla source file: MPL 1.1, GPL v2.0 or LGPL 2.1"

I think nowadays the license is (only) MPL-2.0.

Cert file out of date

As of Feb. 13, 2015, the cert data from Thu Sep 4 06:31:22 2014 is obsolete. Verisign's current Class 3 root cert (Serial 18:DA:D1:9E:26:7D:E8:BB:4A:21:58:CD:CC:6B:3B:4A) is missing, for example, although it is present in http://mxr.mozilla.org/mozilla-central/source/security/nss/lib/ckfw/builtins/certdata.txt

sha1 of real file does not match that printing in the file

I download(also just copy&paste) the ca-bundle.crt|, and then sha1sum it. Find out that sha1 of real file is ecf8b8f6b31edf0e376b7e3b3a95f2d4e7b41c2d, but sha1 value display in this file is ed3c0bbfb7912bcc00cd2033b0cb85c98d10559c. Is anything wrong?

cert file out of date

paging @bagder for an update