On 10/27/14, 2:56 PM, Daniel Stenberg wrote:
> On Mon, 27 Oct 2014, Lamont Granquist wrote:
>
>> The latest http://curl.haxx.se/ca/cacert.pem drops these cert:
>
> ...
>
>> If those are being dropped after being scraped, then someone should
>> probably be made aware that its a cert at the base of Amazon's SSL
>> certs and removing that cert from the ca-bundle breaks
>> https://s3.amazonaws.com and https://amazon.com
>
> I'm pretty sure they are dropped on purpose because of the recently
> introduced RSA-1024 bit requirement as mentioned here:
> http://curl.haxx.se/docs/caextract.html, at least they vanished with
> that specific mozilla bump.
>
> That's also a reason why we point to the last cacert.pem from before
> that change on that same web page.
>
> Of course, it could also be a bug in the mk-ca-bundle script.
>
> See
> https://kuix.de/blog/index.php?entry=Cleanup-of-1024-bit-CA-certificates
>
> At the bottom it lists these certs as "weak" and I suspect it is that
> attribute that makes our script exclude them.
>
Yeah, firefox/mozilla's messaging is that they're weak and "planned to
be removed at a later" time. But www.amazon.com still works as far as
an end user is concerned in 32.0.x and 33.0.x even though those are
marked as weak. They're still in the mozilla bundle and firefox will
still use them. By excluding them from the curl bundle, though, amazon
and aws just broke hard for consumers of that. I'd say that you've
gotten too far ahead in anticipating dropping the 1024-bit RSA certs
since breaking AWS is a total show stopper for a lot of people -- which
is most likely why mozilla marked them as weak and didn't drop them
completely like the other 1024-bit keys that were totally removed.

-------------------------------------------------------------------
List admin: http://cool.haxx.se/list/listinfo/curl-users
FAQ: http://curl.haxx.se/docs/faq.html
Etiquette: http://curl.haxx.se/mail/etiquette.html
Received on 2014-10-27