Gecko [ unitednationsplay.com ]

Name	Size	Permission	Date
contributing	[ DIR ]	drwxr-xr-x	2022-01-26 16:43
doc_img	[ DIR ]	drwxr-xr-x	2022-01-26 16:43
adding-new-napi-api.md	2.55 KB	-rw-r--r--	2022-01-10 13:06
backporting-to-release-lines.md	4.38 KB	-rw-r--r--	2022-01-10 13:06
building-node-with-ninja.md	1.42 KB	-rw-r--r--	2022-01-10 13:06
collaborator-guide.md	40.27 KB	-rw-r--r--	2022-01-10 13:06
commit-queue.md	5.4 KB	-rw-r--r--	2022-01-10 13:06
cpp-style-guide.md	12.79 KB	-rw-r--r--	2022-01-10 13:06
diagnostic-tooling-support-tiers.md	8.66 KB	-rw-r--r--	2022-01-10 13:06
doc-style-guide.md	5.72 KB	-rw-r--r--	2022-01-10 13:06
internal-api.md	539 B	-rw-r--r--	2022-01-10 13:06
investigating_native_memory_leak.md	26.95 KB	-rw-r--r--	2022-01-10 13:06
maintaining-V8.md	17.66 KB	-rw-r--r--	2022-01-10 13:06
maintaining-c-ares.md	1.63 KB	-rw-r--r--	2022-01-10 13:06
maintaining-icu.md	8.27 KB	-rw-r--r--	2022-01-10 13:06
maintaining-npm.md	1.2 KB	-rw-r--r--	2022-01-10 13:06
maintaining-openssl.md	3.82 KB	-rw-r--r--	2022-01-10 13:06
maintaining-root-certs.md	3.57 KB	-rw-r--r--	2022-01-10 13:06
maintaining-the-build-files.md	2.39 KB	-rw-r--r--	2022-01-10 13:06
maintaining-zlib.md	892 B	-rw-r--r--	2022-01-10 13:06
node-postmortem-support.md	2.53 KB	-rw-r--r--	2022-01-10 13:06
offboarding.md	727 B	-rw-r--r--	2022-01-10 13:06
releases.md	34.1 KB	-rw-r--r--	2022-01-10 13:06
security-release-process.md	5.99 KB	-rw-r--r--	2022-01-10 13:06
strategic-initiatives.md	2.93 KB	-rw-r--r--	2022-01-10 13:06
technical-values.md	2.77 KB	-rw-r--r--	2022-01-10 13:06
using-internal-errors.md	4.9 KB	-rw-r--r--	2022-01-10 13:06
using-symbols.md	2.31 KB	-rw-r--r--	2022-01-10 13:06
writing-and-running-benchmarks.md	22.76 KB	-rw-r--r--	2022-01-10 13:06
writing-tests.md	15.83 KB	-rw-r--r--	2022-01-10 13:06

Rename

# Maintaining the root certificates

Node.js contains a compiled-in set of root certificates used as trust anchors
for TLS certificate validation.

The certificates come from Mozilla, specifically NSS's `certdata.txt` file.

The PEM encodings of the certificates are converted to C strings, and committed
in `src/node_root_certs.h`.

## When to update

Root certificates should be updated sometime after Mozilla makes an NSS release,
check the [NSS release schedule][].

## Process

Commands assume that the current working directory is the root of a checkout of
the nodejs/node repository.

1. Find NSS metadata for update.

The latest released NSS version, release date, Firefox version, and Firefox
    release date can be found in the [NSS release schedule][].

The tag to fetch `certdata.txt` from is found by looking for the release
    version in the [tag list][].

2. Update `certdata.txt` from the NSS release tag.

Update the tag in the commands below, and run:

```bash
    cd tools/
    ./mk-ca-bundle.pl -v 2>_before
    curl -O https://hg.mozilla.org/projects/nss/raw-file/NSS_3_41_RTM/lib/ckfw/builtins/certdata.txt
    ```

The `_before` file will be used later. Verify that running `mk-ca-bundle`
    made no changes to `src/node_root_certs.h`. If it did, something went wrong
    with the previous update. Seek help!

Update metadata in the message below, and commit `certdata.txt`:

```text
    tools: update certdata.txt

This is the certdata.txt[0] from NSS 3.41, released on 2018-12-03.

This is the version of NSS that will ship in Firefox 65 on
    2018-12-11.

[0] https://hg.mozilla.org/projects/nss/raw-file/NSS_3_41_RTM/lib/ckfw/builtins/certdata.txt
    ```

3. Update `node_root_certs.h` from `certdata.txt`.

Run the command below:

```bash
    ./mk-ca-bundle.pl -v 2>_after
    ```

Confirm that `../src/node_root_certs.h` was updated.

Determine what changes were made by diffing the before and after files:

```console
    % diff _before _after
    11d10
    < Parsing: Visa eCommerce Root
    106d104
    < Parsing: TÜRKTRUST Elektronik Sertifika Hizmet Sağlayıcısı H5
    113,117d110
    < Parsing: Certplus Root CA G1
    < Parsing: Certplus Root CA G2
    < Parsing: OpenTrust Root CA G1
    < Parsing: OpenTrust Root CA G2
    < Parsing: OpenTrust Root CA G3
    134c127,136
    < Done (133 CA certs processed, 20 skipped).
    ---
    > Parsing: GlobalSign Root CA - R6
    > Parsing: OISTE WISeKey Global Root GC CA
    > Parsing: GTS Root R1
    > Parsing: GTS Root R2
    > Parsing: GTS Root R3
    > Parsing: GTS Root R4
    > Parsing: UCA Global G2 Root
    > Parsing: UCA Extended Validation Root
    > Parsing: Certigna Root CA
    > Done (135 CA certs processed, 16 skipped).
    ```

Use the diff to update the message below, and commit `src/node_root_certs.h`:

```text
    crypto: update root certificates

Update the list of root certificates in src/node_root_certs.h with
    tools/mk-ca-bundle.pl.

Certificates added:
    - GlobalSign Root CA - R6
    - OISTE WISeKey Global Root GC CA
    - GTS Root R1
    - GTS Root R2
    - GTS Root R3
    - GTS Root R4
    - UCA Global G2 Root
    - UCA Extended Validation Root
    - Certigna Root CA

Certificates removed:
    - Visa eCommerce Root
    - TÜRKTRUST Elektronik Sertifika Hizmet Sağlayıcısı H5
    - Certplus Root CA G1
    - Certplus Root CA G2
    - OpenTrust Root CA G1
    - OpenTrust Root CA G2
    - OpenTrust Root CA G3
    ```

[NSS release schedule]: https://wiki.mozilla.org/NSS:Release_Versions
[tag list]: https://hg.mozilla.org/projects/nss/tags