Update root certs to use NSS 3.53 by AshCripps · Pull Request #33682 · nodejs/node

AshCripps · 2020-06-01T12:37:31Z

Updated the root certs to use NSS 3.53

should fix#33681

Checklist

make -j4 test (UNIX), or vcbuild test (Windows) passes
commit message follows commit guidelines

This is the certdata.txt[0] from NSS 3.53, released on 2020-05-29. This is the version of NSS that will ship in Firefox 78 on 2020-06-30. [0] https://hg.mozilla.org/projects/nss/raw-file/NSS_3_53_RTM/lib/ckfw/builtins/certdata.txt

Update the list of root certificates in src/node_root_certs.h with tools/mk-ca-bundle.pl. Certificates added: Entrust Root Certification Authority - G4 Certificates removed:

sam-github · 2020-06-01T17:17:28Z

cc: @nodejs/security

nodejs-github-bot · 2020-06-01T18:03:10Z

CI: https://ci.nodejs.org/job/node-test-pull-request/31689/

sam-github · 2020-06-01T18:15:07Z

fast-track, to get this in the security release tomorrow?

sam-github · 2020-06-01T18:17:30Z

I'll watch the build status and merge when its green. cc: @targos @BethGriggs

sam-github · 2020-06-01T18:57:32Z

Landed in 41796eb...f1ae7ea

This is the certdata.txt[0] from NSS 3.53, released on 2020-05-29. This is the version of NSS that will ship in Firefox 78 on 2020-06-30. [0] https://hg.mozilla.org/projects/nss/raw-file/NSS_3_53_RTM/lib/ckfw/builtins/certdata.txt PR-URL: #33682 Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Sam Roberts <vieuxtech@gmail.com> Reviewed-By: Beth Griggs <Bethany.Griggs@uk.ibm.com> Reviewed-By: Juan José Arboleda <soyjuanarbol@gmail.com>

Update the list of root certificates in src/node_root_certs.h with tools/mk-ca-bundle.pl. Certificates added: Entrust Root Certification Authority - G4 Certificates removed: PR-URL: #33682 Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Sam Roberts <vieuxtech@gmail.com> Reviewed-By: Beth Griggs <Bethany.Griggs@uk.ibm.com> Reviewed-By: Juan José Arboleda <soyjuanarbol@gmail.com>

sam-github · 2020-06-01T19:04:13Z

I'm not sure if this should land on v10.x, @nodejs/lts

10.x currently has NSS 3.41.

It is missing the master updates to 3.42, 3.45, 3.47, so this PR's update to 3.53 won't land cleanly.

What is the LTS release policy wrt. certificate data updates?

richardlau · 2020-06-01T19:12:01Z

I don't think we have a specific policy for updating the certificates but in my opinion it falls under the security updates category.

This is the certdata.txt[0] from NSS 3.53, released on 2020-05-29. This is the version of NSS that will ship in Firefox 78 on 2020-06-30. [0] https://hg.mozilla.org/projects/nss/raw-file/NSS_3_53_RTM/lib/ckfw/builtins/certdata.txt PR-URL: nodejs/node#33682 Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Sam Roberts <vieuxtech@gmail.com> Reviewed-By: Beth Griggs <Bethany.Griggs@uk.ibm.com> Reviewed-By: Juan José Arboleda <soyjuanarbol@gmail.com>

Update the list of root certificates in src/node_root_certs.h with tools/mk-ca-bundle.pl. Certificates added: Entrust Root Certification Authority - G4 Certificates removed: PR-URL: nodejs/node#33682 Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Sam Roberts <vieuxtech@gmail.com> Reviewed-By: Beth Griggs <Bethany.Griggs@uk.ibm.com> Reviewed-By: Juan José Arboleda <soyjuanarbol@gmail.com>

This is the certdata.txt[0] from NSS 3.53, released on 2020-05-29. This is the version of NSS that will ship in Firefox 78 on 2020-06-30. [0] https://hg.mozilla.org/projects/nss/raw-file/NSS_3_53_RTM/lib/ckfw/builtins/certdata.txt PR-URL: nodejs/node#33682 Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Sam Roberts <vieuxtech@gmail.com> Reviewed-By: Beth Griggs <Bethany.Griggs@uk.ibm.com> Reviewed-By: Juan José Arboleda <soyjuanarbol@gmail.com>

Update the list of root certificates in src/node_root_certs.h with tools/mk-ca-bundle.pl. Certificates added: Entrust Root Certification Authority - G4 Certificates removed: PR-URL: nodejs/node#33682 Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Sam Roberts <vieuxtech@gmail.com> Reviewed-By: Beth Griggs <Bethany.Griggs@uk.ibm.com> Reviewed-By: Juan José Arboleda <soyjuanarbol@gmail.com>

AshCripps added 2 commits June 1, 2020 13:31

tools: update certdata.txt
b55556d
This is the certdata.txt[0] from NSS 3.53, released on 2020-05-29. This is the version of NSS that will ship in Firefox 78 on 2020-06-30. [0] https://hg.mozilla.org/projects/nss/raw-file/NSS_3_53_RTM/lib/ckfw/builtins/certdata.txt

crypto: update root certificates
fe2fcd3
Update the list of root certificates in src/node_root_certs.h with tools/mk-ca-bundle.pl. Certificates added: Entrust Root Certification Authority - G4 Certificates removed:

nodejs-github-bot added c++ Issues and PRs that require attention from people who are familiar with C++. lib / src Issues and PRs related to general changes in the lib or src directory. labels Jun 1, 2020

AshCripps mentioned this pull request Jun 1, 2020
AddTrust SSL CA root cert expired (as bundled with NodeJS) - updated one published #33681
Closed

jasnell approved these changes Jun 1, 2020
View reviewed changes

sam-github approved these changes Jun 1, 2020
View reviewed changes

sam-github added security Issues and PRs related to security. tls Issues and PRs related to the tls subsystem. labels Jun 1, 2020

BethGriggs approved these changes Jun 1, 2020
View reviewed changes

sam-github added the fast-track PRs that do not need to wait for 48 hours to land. label Jun 1, 2020

addaleax added author ready PRs that have at least one approval, no pending requests for changes, and a CI started. crypto Issues and PRs related to the crypto subsystem. and removed lib / src Issues and PRs related to general changes in the lib or src directory. labels Jun 1, 2020

juanarbol approved these changes Jun 1, 2020
View reviewed changes

sam-github closed this Jun 1, 2020

AshCripps deleted the update-root-certs branch June 2, 2020 10:47

nornagon mentioned this pull request Jun 22, 2020
AddTrust CA root cert expiration breaking TLS connections through Node electron/electron#24123
Closed
3 tasks

nornagon added a commit to electron/electron that referenced this pull request Jun 23, 2020
fix: backportnodejs/node#33682
dda3a15

nornagon mentioned this pull request Jun 23, 2020
fix: backport nodejs/node#33682 electron/electron#24266
Merged
3 tasks

nornagon added a commit to electron/electron that referenced this pull request Jun 23, 2020
fix: backportnodejs/node#33682
adf67cb

nornagon mentioned this pull request Jun 23, 2020
fix: backport nodejs/node#33682 electron/electron#24267
Merged
3 tasks

nornagon added a commit to electron/electron that referenced this pull request Jun 23, 2020
fix: backportnodejs/node#33682andnodejs/node#30195
6ac2675

nornagon added a commit to electron/electron that referenced this pull request Jun 23, 2020
fix: backportnodejs/node#33682andnodejs/node#30195
0001ed7

deepak1556 pushed a commit to electron/electron that referenced this pull request Jun 24, 2020
fix: backportnodejs/node#33682(#24266)
fb292c2

deepak1556 pushed a commit to electron/electron that referenced this pull request Jun 24, 2020
fix: backportnodejs/node#33682(#24267)
7835902

deepak1556 pushed a commit to electron/electron that referenced this pull request Jun 24, 2020
fix: backportnodejs/node#33682andnodejs/node#30195(#24268)
9964e3f

deepak1556 pushed a commit to electron/electron that referenced this pull request Jun 24, 2020
fix: backportnodejs/node#33682andnodejs/node#30195(#24269)
092706c

LucaBlackDragon mentioned this pull request Dec 18, 2020
NodeJS bundled SSL root CA cert for AddTrust expired 30th May 2020 (breaks VSTS agent for us) microsoft/azure-pipelines-agent#2993
Closed

Navigation Menu

Uh oh!

Uh oh!

Update root certs to use NSS 3.53 - #33682

Update root certs to use NSS 3.53#33682
AshCripps wants to merge 2 commits into
nodejs:masterfrom
AshCripps:update-root-certs

AshCripps commented Jun 1, 2020

Uh oh!

sam-github commented Jun 1, 2020

Uh oh!

nodejs-github-bot commented Jun 1, 2020

Uh oh!

sam-github commented Jun 1, 2020

Uh oh!

sam-github commented Jun 1, 2020

Uh oh!

sam-github commented Jun 1, 2020•
edited by targos
Loading

Uh oh!

sam-github commented Jun 1, 2020

Uh oh!

richardlau commented Jun 1, 2020

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

8 participants

Uh oh!

Uh oh!

Conversation

AshCripps commented Jun 1, 2020

Checklist

Uh oh!

sam-github commented Jun 1, 2020

Uh oh!

nodejs-github-bot commented Jun 1, 2020

Uh oh!

sam-github commented Jun 1, 2020

Uh oh!

sam-github commented Jun 1, 2020

Uh oh!

sam-github commented Jun 1, 2020• edited by targos Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

sam-github commented Jun 1, 2020

Uh oh!

richardlau commented Jun 1, 2020

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

8 participants

sam-github commented Jun 1, 2020•
edited by targos
Loading