source: postlfs/security/cacerts.xml@ 30b7db74

<?xml version="1.0" encoding="ISO-8859-1"?>
<!DOCTYPE sect1 PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
   "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
  <!ENTITY % general-entities SYSTEM "../../general.ent">
  %general-entities;

  <!ENTITY make-ca-download      "&sources-anduin-http;/other/make-ca.sh">
  <!ENTITY make-ca-size          "4.1 KB">
  <!ENTITY make-ca-md5sum        "487ca7ce6f7b81b3e46362138f93310c">
  <!ENTITY cacerts-buildsize     "1.4 MB">
  <!ENTITY cacerts-time          "0.1 SBU">
]>

<sect1 id="cacerts" xreflabel="Certificate Authority Certificates">
  <?dbhtml filename="cacerts.html"?>

  <sect1info>
    <othername>$LastChangedBy$</othername>
    <date>$Date$</date>
  </sect1info>

  <title>Certificate Authority Certificates</title>

  <para>The Public Key Infrastructure is used for many security features in a
  Linux system.  In order for a certificate to be trusted, it must be signed by
  a trusted agent called a Certificate Authority (CA). The certificates
  installed in this section are obtained from the Mozilla version control
  system, and reformatted for use by <xref linkend='openssl'/> and
  <xref linkend='gnutls'/>. The certificates can also be used by other
  applications, either directly or indirectly by linking to one of these
  packages.</para>

  &lfs7a_checked;

  <indexterm zone="cacerts">
    <primary sortas="a-cacerts">Certificate Authority Certificates</primary>
  </indexterm>

  <sect2 role="package">
    <title>Introduction to Certificate Authorities</title>

   <bridgehead renderas="sect3">Package Information</bridgehead>
    <itemizedlist spacing="compact">
      <listitem>
        <para>Download (HTTP): <ulink url="&make-ca-download;"/></para>
      </listitem>
      <listitem>
        <para>Download size: &make-ca-size;</para>
      </listitem>
      <listitem>
        <para>Download MD5 Sum: &make-ca-md5sum;</para>
      </listitem>
      <listitem>
        <para>Estimated disk space required: &cacerts-buildsize;</para>
      </listitem>
      <listitem>
        <para>Estimated build time: &cacerts-time;</para>
      </listitem>
    </itemizedlist>

    <bridgehead renderas="sect3">Certificate Authority Certificates Dependencies</bridgehead>

    <bridgehead renderas="sect4">Required</bridgehead>
    <para role="required"><xref linkend="openssl"/> and
    <xref linkend="curl"/></para>

    <para condition="html" role="usernotes">User Notes:
    <ulink url='&blfs-wiki;/cacerts'/></para>
  </sect2>

  <sect2 role="installation">
    <title>Installation of Certificate Authority Certificates</title>

   <para>The <application>make-ca.sh</application> script will download a set
   of certificates from one of five projects (aurora, beta, central, nss, or
   release) in the Mozialla version control system. It defaults to the release
   branch, which is identical to the version that ships with the Mozilla
   products in this book. If you'd like to change the branch that is retrieved,
   edit the file and set <envar>CERTSOURCE</envar> to one of the five values
   above.</para>

   <para>Additionally, any local certificates stored in
   <filename>/etc/ssl/local</filename> will be copied into both the single-file
   <filename>/etc/ssl/ca-bundle.crt</filename> (used by programs that link to
   <application>gnutls</application>), and into the certificate store directory
   <filename>/etc/ssl/certs</filename> (used by programs that link to
   <application>OpenSSL</application>). All certificates will pass a date and
   trust validation, and any existing certificates in
   <filename>/etc/ssl/ca-bundle.crt</filename> or
   <filename>/etc/ssl/certs</filename> will be removed upon successful
   completion of this script.</para>

   <para>Finally, if you've installed <xref linkend="java"/> or <xref
   linkend="openjdk"/>, then it will also update the java cacerts file at
   <filename>/etc/ssl/java/cacerts</filename>.</para>

    <para>First install the above script into the correct location. As the
    <systemitem class="username">root</systemitem> user:</para>

<screen role="root"><userinput>install -vm750 make-ca.sh /usr/sbin</userinput></screen>

   <para>As the <systemitem class="username">root</systemitem> user, create the
   needed directories, and update the certificate store:</para>

<screen role="root"><userinput>install -vdm755 /etc/ssl/{certs,java,local} &amp;&amp;
/usr/sbin/make-ca.sh
</userinput></screen>

    <para>You should periodically run the <application>make-ca.sh</application>
    script (as the <systemitem class="username">root</systemitem> user), or as
    part of a monthly <application>cron</application> job to ensure that you
    have the latest available version of the certificates.</para>

  </sect2>

  <sect2 role="content">
    <title>Contents</title>

    <segmentedlist>
      <segtitle>Installed Programs</segtitle>
      <segtitle>Installed Libraries</segtitle>
      <segtitle>Installed Directories</segtitle>

      <seglistitem>
        <seg>make-ca.sh</seg>
        <seg>None</seg>
        <seg>/etc/ssl/{certs,java,local}</seg>
      </seglistitem>
    </segmentedlist>

   <variablelist>
      <bridgehead renderas="sect3">Short Descriptions</bridgehead>
      <?dbfo list-presentation="list"?>
      <?dbhtml list-presentation="table"?>

      <varlistentry id="make-ca">
        <term><command>make-ca.sh</command></term>
        <listitem>
          <para>is a shell script that downloads a current verion of
          <filename>certdata.txt</filename>, and prepares it for use
          as the system certificate store.</para>
          <indexterm zone="cacerts make-ca">
            <primary sortas="b-make-ca">make-ca</primary>
          </indexterm>
        </listitem>
      </varlistentry>
   </variablelist>

  </sect2>
</sect1>