caroot: Ignore soft distrust of server CA certificates after 398 days

[michaelo]

Summary

Mozilla introduced the field CKA_NSS_SERVER_DISTRUST_AFTER which indicates that
a CA certificate will be distrusted in the future before its NotAfter time.
This means that the CA stops issuing new certificates, but previous ones are
still valid, but at most for 398 days after the distrust date.

See also:

• https://github.com/Lukasa/mkcert/issues/19
• https://gitlab.alpinelinux.org/alpine/ca-certificates/-/merge_requests/16
• https://github.com/curl/curl/commit/448df98d9280b3290ecf63e5fc9452d487f41a7c

[michaelo]

Please add other reviewers as you think appropriate.

[michaelo]

Here it is: https://bugzilla.mozilla.org/show_bug.cgi?id=1465613

[michaelo]

Folks, any objections? I'd like to update the system trust store after that.

[emaste]

What about the approach in https://github.com/Lukasa/mkcert/pull/20/commits/bbd91ec48a8e0d97bc550a310019acfad4480a4a

[michaelo]

In D49075#1122850, @emaste wrote:

What about the approach in https://github.com/Lukasa/mkcert/pull/20/commits/bbd91ec48a8e0d97bc550a310019acfad4480a4a

Yes, this is a rather sophisticated one. I need to figure out how to implement this in perl especially whether it requires additional packages from CPAN or not. Go has the magic built in, Perl has not. I believe that Mozilla will remove the CA beyond that date anyway. I wonder why should bother. If you want to, I can try implement, will take a bit of time. My Perl skills are very rusty (no pun intended).

[michaelo]

Distrust after 398 days as requested by @emaste

[michaelo]

I'd like to MFC it after a week.

Current output:

perl /var/osipovmi/Projekte/freebsd/src/secure/caroot/MAca-bundle.pl -i certdata.txt -o /var/osipovmi/Projekte/freebsd/src/secure/caroot/trusted
line : Entrust.net Premium 2048 Secure Server CA ser #0: distrust 398 days after 2024-11-30T23:59:59Z, now: 2025-03-05T09:58:29Z -> distrust 0
line : Entrust Root Certification Authority ser #0: distrust 398 days after 2024-11-30T23:59:59Z, now: 2025-03-05T09:58:29Z -> distrust 0
line 801: no explicit trust/distrust found for Certum Root CA
line 3062: no explicit trust/distrust found for OISTE WISeKey Global Root GA CA
line 3062: AffirmTrust Commercial ser #0: distrust 398 days after 2024-11-30T23:59:59Z, now: 2025-03-05T09:58:29Z -> distrust 0
line 3062: AffirmTrust Networking ser #0: distrust 398 days after 2024-11-30T23:59:59Z, now: 2025-03-05T09:58:29Z -> distrust 0
line 3062: AffirmTrust Premium ser #0: distrust 398 days after 2024-11-30T23:59:59Z, now: 2025-03-05T09:58:29Z -> distrust 0
line 3062: AffirmTrust Premium ECC ser #0: distrust 398 days after 2024-11-30T23:59:59Z, now: 2025-03-05T09:58:29Z -> distrust 0
line 9537: no explicit trust/distrust found for Staat der Nederlanden Root CA - G3
line 9537: Entrust Root Certification Authority - G2 ser #0: distrust 398 days after 2024-11-30T23:59:59Z, now: 2025-03-05T09:58:29Z -> distrust 0
line 9537: Entrust Root Certification Authority - EC1 ser #0: distrust 398 days after 2024-11-30T23:59:59Z, now: 2025-03-05T09:58:29Z -> distrust 0
line 12109: no explicit trust/distrust found for D-TRUST Root CA 3 2013
line 14743: no explicit trust/distrust found for Entrust Root Certification Authority - G4
line 16230: no explicit trust/distrust found for GlobalSign Secure Mail Root R45
line 16345: no explicit trust/distrust found for GlobalSign Secure Mail Root E45
line 16345: GLOBALTRUST 2020 ser #0: distrust 398 days after 2024-06-30T00:00:00Z, now: 2025-03-05T09:58:29Z -> distrust 0
...

[michaelo]

Fix formatting

[emaste]

I wonder why should bother.

Wasn't sure it was necessary, just looked at the links for more context and thought that was an elegant way to handle it.

$year + 100 makes me sad :(

[michaelo]

In D49075#1123105, @emaste wrote:

$year + 100 makes me sad :(

Why? gmtime/localtime is a offset of 1900 and the certdata.txt uses unfortunately a two-digit year.

[michaelo]

I will leave other a few more days to review.

[emaste]

certdata.txt uses unfortunately a two-digit year

Yeah, that's the sad part

[michaelo]

In D49075#1123116, @emaste wrote:

certdata.txt uses unfortunately a two-digit year

Yeah, that's the sad part

People tend to reinvent the wheel although there is ISO 8601...