diff --git a/security/nss/automation/abi-check/expected-report-libnss3.so.txt b/security/nss/automation/abi-check/expected-report-libnss3.so.txt index e69de29bb2..e60ded534a 100644 --- a/security/nss/automation/abi-check/expected-report-libnss3.so.txt +++ b/security/nss/automation/abi-check/expected-report-libnss3.so.txt @@ -0,0 +1,8 @@ + +4 Added functions: + + 'function SECStatus CERT_FilterCertListByCertList(CERTCertList*, const CERTCertList*)' {CERT_FilterCertListByCertList@@NSS_3.77} + 'function SECStatus CERT_FilterCertListByNickname(CERTCertList*, char*, void*)' {CERT_FilterCertListByNickname@@NSS_3.77} + 'function PRBool CERT_IsInList(const CERTCertificate*, const CERTCertList*)' {CERT_IsInList@@NSS_3.77} + 'function CK_OBJECT_HANDLE PK11_FindObjectForCert(CERTCertificate*, void*, PK11SlotInfo**)' {PK11_FindObjectForCert@@NSS_3.77} + diff --git a/security/nss/automation/abi-check/expected-report-libssl3.so.txt b/security/nss/automation/abi-check/expected-report-libssl3.so.txt index bf902d170f..8c5ba15936 100644 --- a/security/nss/automation/abi-check/expected-report-libssl3.so.txt +++ b/security/nss/automation/abi-check/expected-report-libssl3.so.txt @@ -11,3 +11,7 @@ 'PRUint32 SSLPreliminaryChannelInfoStr::authKeyBits', at offset 224 (in bits) at sslt.h:419:1 'SSLSignatureScheme SSLPreliminaryChannelInfoStr::signatureScheme', at offset 256 (in bits) at sslt.h:420:1 +2 Added functions: + + 'function PRBool SSL_CertIsUsable(PRFileDesc*, CERTCertificate*)' {SSL_CertIsUsable@@NSS_3.77} + 'function SECStatus SSL_FilterClientCertListBySocket(PRFileDesc*, CERTCertList*)' {SSL_FilterClientCertListBySocket@@NSS_3.77} diff --git a/security/nss/gtests/base_gtest/Makefile b/security/nss/gtests/base_gtest/Makefile new file mode 100644 index 0000000000..0d547e0803 --- /dev/null +++ b/security/nss/gtests/base_gtest/Makefile @@ -0,0 +1,43 @@ +#! gmake +# +# This Source Code Form is subject to the terms of the Mozilla Public +# License, v. 2.0. If a copy of the MPL was not distributed with this +# file, You can obtain one at http://mozilla.org/MPL/2.0/. + +####################################################################### +# (1) Include initial platform-independent assignments (MANDATORY). # +####################################################################### + +include manifest.mn + +####################################################################### +# (2) Include "global" configuration information. (OPTIONAL) # +####################################################################### + +include $(CORE_DEPTH)/coreconf/config.mk + +####################################################################### +# (3) Include "component" configuration information. (OPTIONAL) # +####################################################################### + + +####################################################################### +# (4) Include "local" platform-dependent assignments (OPTIONAL). # +####################################################################### + +include ../common/gtest.mk + +####################################################################### +# (5) Execute "global" rules. (OPTIONAL) # +####################################################################### + +include $(CORE_DEPTH)/coreconf/rules.mk + +####################################################################### +# (6) Execute "component" rules. (OPTIONAL) # +####################################################################### + + +####################################################################### +# (7) Execute "local" rules. (OPTIONAL). # +####################################################################### diff --git a/security/nss/gtests/base_gtest/base_gtest.gyp b/security/nss/gtests/base_gtest/base_gtest.gyp new file mode 100644 index 0000000000..408908f976 --- /dev/null +++ b/security/nss/gtests/base_gtest/base_gtest.gyp @@ -0,0 +1,31 @@ +# This Source Code Form is subject to the terms of the Mozilla Public +# License, v. 2.0. If a copy of the MPL was not distributed with this +# file, You can obtain one at http://mozilla.org/MPL/2.0/. +{ + 'includes': [ + '../../coreconf/config.gypi', + '../common/gtest.gypi', + ], + 'targets': [ + { + 'target_name': 'base_gtest', + 'type': 'executable', + 'sources': [ + 'utf8_unittest.cc', + '<(DEPTH)/gtests/common/gtests.cc' + ], + 'dependencies': [ + '<(DEPTH)/exports.gyp:nss_exports', + '<(DEPTH)/gtests/google_test/google_test.gyp:gtest', + '<(DEPTH)/lib/util/util.gyp:nssutil3', + '<(DEPTH)/lib/ssl/ssl.gyp:ssl3', + '<(DEPTH)/lib/nss/nss.gyp:nss3', + '<(DEPTH)/lib/smime/smime.gyp:smime3', + '<(DEPTH)/lib/base/base.gyp:nssb', + ] + } + ], + 'variables': { + 'module': 'nss' + } +} diff --git a/security/nss/gtests/base_gtest/manifest.mn b/security/nss/gtests/base_gtest/manifest.mn new file mode 100644 index 0000000000..07506c96c0 --- /dev/null +++ b/security/nss/gtests/base_gtest/manifest.mn @@ -0,0 +1,23 @@ +# +# This Source Code Form is subject to the terms of the Mozilla Public +# License, v. 2.0. If a copy of the MPL was not distributed with this +# file, You can obtain one at http://mozilla.org/MPL/2.0/. +CORE_DEPTH = ../.. +DEPTH = ../.. +MODULE = nss + +CPPSRCS = \ + utf8_unittest.cc \ + $(NULL) + +INCLUDES += -I$(CORE_DEPTH)/gtests/google_test/gtest/include \ + -I$(CORE_DEPTH)/gtests/common \ + -I$(CORE_DEPTH)/cpputil + +REQUIRES = nspr nss libdbm gtest + +PROGRAM = base_gtest + +EXTRA_LIBS = $(DIST)/lib/$(LIB_PREFIX)gtest.$(LIB_SUFFIX) $(EXTRA_OBJS) \ + $(DIST)/lib/$(LIB_PREFIX)nssb.$(LIB_SUFFIX) \ + $(DIST)/lib/$(LIB_PREFIX)gtestutil.$(LIB_SUFFIX) diff --git a/security/nss/gtests/base_gtest/utf8_unittest.cc b/security/nss/gtests/base_gtest/utf8_unittest.cc new file mode 100644 index 0000000000..16e01cdab9 --- /dev/null +++ b/security/nss/gtests/base_gtest/utf8_unittest.cc @@ -0,0 +1,150 @@ +/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */ +/* vim: set ts=2 et sw=2 tw=80: */ +/* This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this file, + * You can obtain one at http://mozilla.org/MPL/2.0/. */ + +#include "gtest/gtest.h" + +#include "nss.h" +#include "base.h" +#include "secerr.h" + +namespace nss_test { + +class Utf8Test : public ::testing::Test {}; + +// Tests nssUTF8_Length rejects overlong forms, surrogates, etc. +TEST_F(Utf8Test, Utf8Length) { + PRStatus status; + + EXPECT_EQ(0u, nssUTF8_Length("", &status)); + EXPECT_EQ(PR_SUCCESS, status); + + // U+0000..U+007F + EXPECT_EQ(1u, nssUTF8_Length("\x01", &status)); + EXPECT_EQ(PR_SUCCESS, status); + EXPECT_EQ(1u, nssUTF8_Length("\x7F", &status)); + EXPECT_EQ(PR_SUCCESS, status); + + // lone trailing byte + EXPECT_EQ(0u, nssUTF8_Length("\x80", &status)); + EXPECT_EQ(PR_FAILURE, status); + EXPECT_EQ(NSS_ERROR_INVALID_STRING, NSS_GetError()); + EXPECT_EQ(0u, nssUTF8_Length("\xBF", &status)); + EXPECT_EQ(PR_FAILURE, status); + EXPECT_EQ(NSS_ERROR_INVALID_STRING, NSS_GetError()); + + // overlong U+0000..U+007F + EXPECT_EQ(0u, nssUTF8_Length("\xC0\x80", &status)); + EXPECT_EQ(PR_FAILURE, status); + EXPECT_EQ(NSS_ERROR_INVALID_STRING, NSS_GetError()); + EXPECT_EQ(0u, nssUTF8_Length("\xC1\xBF", &status)); + EXPECT_EQ(PR_FAILURE, status); + EXPECT_EQ(NSS_ERROR_INVALID_STRING, NSS_GetError()); + + // U+0080..U+07FF + EXPECT_EQ(2u, nssUTF8_Length("\xC2\x80", &status)); + EXPECT_EQ(PR_SUCCESS, status); + EXPECT_EQ(2u, nssUTF8_Length("\xDF\xBF", &status)); + EXPECT_EQ(PR_SUCCESS, status); + + // overlong U+0000..U+07FF + EXPECT_EQ(0u, nssUTF8_Length("\xE0\x80\x80", &status)); + EXPECT_EQ(PR_FAILURE, status); + EXPECT_EQ(NSS_ERROR_INVALID_STRING, NSS_GetError()); + EXPECT_EQ(0u, nssUTF8_Length("\xE0\x9F\xBF", &status)); + EXPECT_EQ(PR_FAILURE, status); + EXPECT_EQ(NSS_ERROR_INVALID_STRING, NSS_GetError()); + + // U+0800..U+D7FF + EXPECT_EQ(3u, nssUTF8_Length("\xE0\xA0\x80", &status)); + EXPECT_EQ(PR_SUCCESS, status); + EXPECT_EQ(3u, nssUTF8_Length("\xE0\xBF\xBF", &status)); + EXPECT_EQ(PR_SUCCESS, status); + EXPECT_EQ(3u, nssUTF8_Length("\xE1\x80\x80", &status)); + EXPECT_EQ(PR_SUCCESS, status); + EXPECT_EQ(3u, nssUTF8_Length("\xEC\xBF\xBF", &status)); + EXPECT_EQ(PR_SUCCESS, status); + EXPECT_EQ(3u, nssUTF8_Length("\xED\x80\x80", &status)); + EXPECT_EQ(PR_SUCCESS, status); + EXPECT_EQ(3u, nssUTF8_Length("\xED\x9F\xBF", &status)); + EXPECT_EQ(PR_SUCCESS, status); + + // lone surrogate + EXPECT_EQ(0u, nssUTF8_Length("\xED\xA0\x80", &status)); + EXPECT_EQ(PR_FAILURE, status); + EXPECT_EQ(NSS_ERROR_INVALID_STRING, NSS_GetError()); + EXPECT_EQ(0u, nssUTF8_Length("\xED\xBF\xBF", &status)); + EXPECT_EQ(PR_FAILURE, status); + EXPECT_EQ(NSS_ERROR_INVALID_STRING, NSS_GetError()); + + // U+E000..U+FFFF + EXPECT_EQ(3u, nssUTF8_Length("\xEE\x80\x80", &status)); + EXPECT_EQ(PR_SUCCESS, status); + EXPECT_EQ(3u, nssUTF8_Length("\xEF\xBF\xBF", &status)); + EXPECT_EQ(PR_SUCCESS, status); + + // overlong U+0000..U+FFFF + EXPECT_EQ(0u, nssUTF8_Length("\xF0\x80\x80\x80", &status)); + EXPECT_EQ(PR_FAILURE, status); + EXPECT_EQ(NSS_ERROR_INVALID_STRING, NSS_GetError()); + EXPECT_EQ(0u, nssUTF8_Length("\xF0\x8F\xBF\xBF", &status)); + EXPECT_EQ(PR_FAILURE, status); + EXPECT_EQ(NSS_ERROR_INVALID_STRING, NSS_GetError()); + + // U+10000..U+10FFFF + EXPECT_EQ(4u, nssUTF8_Length("\xF0\x90\x80\x80", &status)); + EXPECT_EQ(PR_SUCCESS, status); + EXPECT_EQ(4u, nssUTF8_Length("\xF0\xBF\xBF\xBF", &status)); + EXPECT_EQ(PR_SUCCESS, status); + EXPECT_EQ(4u, nssUTF8_Length("\xF1\x80\x80\x80", &status)); + EXPECT_EQ(PR_SUCCESS, status); + EXPECT_EQ(4u, nssUTF8_Length("\xF3\xBF\xBF\xBF", &status)); + EXPECT_EQ(PR_SUCCESS, status); + EXPECT_EQ(4u, nssUTF8_Length("\xF4\x80\x80\x80", &status)); + EXPECT_EQ(PR_SUCCESS, status); + EXPECT_EQ(4u, nssUTF8_Length("\xF4\x8F\xBF\xBF", &status)); + EXPECT_EQ(PR_SUCCESS, status); + + // out of Unicode range + EXPECT_EQ(0u, nssUTF8_Length("\xF4\x90\x80\x80", &status)); + EXPECT_EQ(PR_FAILURE, status); + EXPECT_EQ(NSS_ERROR_INVALID_STRING, NSS_GetError()); + EXPECT_EQ(0u, nssUTF8_Length("\xF4\xBF\xBF\xBF", &status)); + EXPECT_EQ(PR_FAILURE, status); + EXPECT_EQ(NSS_ERROR_INVALID_STRING, NSS_GetError()); + EXPECT_EQ(0u, nssUTF8_Length("\xF5\x80\x80\x80", &status)); + EXPECT_EQ(PR_FAILURE, status); + EXPECT_EQ(NSS_ERROR_INVALID_STRING, NSS_GetError()); + EXPECT_EQ(0u, nssUTF8_Length("\xF7\xBF\xBF\xBF", &status)); + EXPECT_EQ(PR_FAILURE, status); + EXPECT_EQ(NSS_ERROR_INVALID_STRING, NSS_GetError()); + + // former 5-byte sequence + EXPECT_EQ(0u, nssUTF8_Length("\xF8\x80\x80\x80\x80", &status)); + EXPECT_EQ(PR_FAILURE, status); + EXPECT_EQ(NSS_ERROR_INVALID_STRING, NSS_GetError()); + EXPECT_EQ(0u, nssUTF8_Length("\xFB\xBF\xBF\xBF\xBF", &status)); + EXPECT_EQ(PR_FAILURE, status); + EXPECT_EQ(NSS_ERROR_INVALID_STRING, NSS_GetError()); + + // former 6-byte sequence + EXPECT_EQ(0u, nssUTF8_Length("\xFC\x80\x80\x80\x80\x80", &status)); + EXPECT_EQ(PR_FAILURE, status); + EXPECT_EQ(NSS_ERROR_INVALID_STRING, NSS_GetError()); + EXPECT_EQ(0u, nssUTF8_Length("\xFD\xBF\xBF\xBF\xBF\xBF", &status)); + EXPECT_EQ(PR_FAILURE, status); + EXPECT_EQ(NSS_ERROR_INVALID_STRING, NSS_GetError()); + + // invalid lead byte + EXPECT_EQ(0u, nssUTF8_Length("\xFE", &status)); + EXPECT_EQ(PR_FAILURE, status); + EXPECT_EQ(NSS_ERROR_INVALID_STRING, NSS_GetError()); + EXPECT_EQ(0u, nssUTF8_Length("\xFF", &status)); + EXPECT_EQ(PR_FAILURE, status); + EXPECT_EQ(NSS_ERROR_INVALID_STRING, NSS_GetError()); + + nss_DestroyErrorStack(); +} +} diff --git a/security/nss/gtests/manifest.mn b/security/nss/gtests/manifest.mn index 1d97da3ddb..6ed094b944 100644 --- a/security/nss/gtests/manifest.mn +++ b/security/nss/gtests/manifest.mn @@ -19,6 +19,7 @@ endif ifneq ($(NSS_BUILD_SOFTOKEN_ONLY),1) ifneq ($(NSS_BUILD_UTIL_ONLY),1) NSS_SRCDIRS = \ + base_gtest \ certdb_gtest \ certhigh_gtest \ cryptohi_gtest \ diff --git a/security/nss/gtests/ssl_gtest/ssl_auth_unittest.cc b/security/nss/gtests/ssl_gtest/ssl_auth_unittest.cc index 0454db8cdd..4b3f82a469 100644 --- a/security/nss/gtests/ssl_gtest/ssl_auth_unittest.cc +++ b/security/nss/gtests/ssl_gtest/ssl_auth_unittest.cc @@ -268,6 +268,126 @@ static SECStatus GetClientAuthDataHook(void* self, PRFileDesc* fd, return SECSuccess; } +typedef struct AutoClientTestStr { + SECStatus result; + const std::string cert; +} AutoClientTest; + +typedef struct AutoClientResultsStr { + AutoClientTest isRsa2048; + AutoClientTest isClient; + AutoClientTest isNull; + bool hookCalled; +} AutoClientResults; + +void VerifyClientCertMatch(CERTCertificate* clientCert, + const std::string expectedName) { + const char* name = clientCert->nickname; + std::cout << "Match name=\"" << name << "\" expected=\"" << expectedName + << "\"" << std::endl; + EXPECT_TRUE(PORT_Strcmp(name, expectedName.c_str()) == 0) + << " Certmismatch: \"" << name << "\" != \"" << expectedName << "\""; +} + +static SECStatus GetAutoClientAuthDataHook(void* expectResults, PRFileDesc* fd, + CERTDistNames* caNames, + CERTCertificate** clientCert, + SECKEYPrivateKey** clientKey) { + AutoClientResults& results = *(AutoClientResults*)expectResults; + SECStatus rv; + + results.hookCalled = true; + *clientCert = NULL; + *clientKey = NULL; + rv = NSS_GetClientAuthData((void*)TlsAgent::kRsa2048.c_str(), fd, caNames, + clientCert, clientKey); + if (rv == SECSuccess) { + VerifyClientCertMatch(*clientCert, results.isRsa2048.cert); + CERT_DestroyCertificate(*clientCert); + SECKEY_DestroyPrivateKey(*clientKey); + *clientCert = NULL; + *clientKey = NULL; + } + EXPECT_EQ(results.isRsa2048.result, rv); + + rv = NSS_GetClientAuthData((void*)TlsAgent::kClient.c_str(), fd, caNames, + clientCert, clientKey); + if (rv == SECSuccess) { + VerifyClientCertMatch(*clientCert, results.isClient.cert); + CERT_DestroyCertificate(*clientCert); + SECKEY_DestroyPrivateKey(*clientKey); + *clientCert = NULL; + *clientKey = NULL; + } + EXPECT_EQ(results.isClient.result, rv); + EXPECT_EQ(*clientCert, nullptr); + EXPECT_EQ(*clientKey, nullptr); + rv = NSS_GetClientAuthData(NULL, fd, caNames, clientCert, clientKey); + if (rv == SECSuccess) { + VerifyClientCertMatch(*clientCert, results.isNull.cert); + // return this result + } + EXPECT_EQ(results.isNull.result, rv); + return rv; +} + +// while I would have liked to use a new INSTANTIATE macro the +// generates the following three tests, figuring out how to make that +// work on top of the existing TlsConnect* plumbing hurts my head. +TEST_P(TlsConnectTls12, AutoClientSelectRsaPss) { + AutoClientResults rsa = {{SECSuccess, TlsAgent::kRsa2048}, + {SECSuccess, TlsAgent::kClient}, + {SECSuccess, TlsAgent::kDelegatorRsaPss2048}, + false}; + static const SSLSignatureScheme kSchemes[] = {ssl_sig_rsa_pss_pss_sha256, + ssl_sig_rsa_pkcs1_sha256, + ssl_sig_rsa_pkcs1_sha1}; + Reset("rsa_pss_noparam"); + client_->SetupClientAuth(); + server_->RequestClientAuth(true); + EXPECT_EQ(SECSuccess, + SSL_GetClientAuthDataHook(client_->ssl_fd(), + GetAutoClientAuthDataHook, (void*)&rsa)); + server_->SetSignatureSchemes(kSchemes, PR_ARRAY_SIZE(kSchemes)); + client_->SetSignatureSchemes(kSchemes, PR_ARRAY_SIZE(kSchemes)); + Connect(); + EXPECT_TRUE(rsa.hookCalled); +} + +TEST_P(TlsConnectTls12, AutoClientSelectEcc) { + AutoClientResults ecc = {{SECFailure, TlsAgent::kClient}, + {SECFailure, TlsAgent::kClient}, + {SECSuccess, TlsAgent::kDelegatorEcdsa256}, + false}; + static const SSLSignatureScheme kSchemes[] = {ssl_sig_ecdsa_secp256r1_sha256}; + client_->SetupClientAuth(); + server_->RequestClientAuth(true); + EXPECT_EQ(SECSuccess, + SSL_GetClientAuthDataHook(client_->ssl_fd(), + GetAutoClientAuthDataHook, (void*)&ecc)); + server_->SetSignatureSchemes(kSchemes, PR_ARRAY_SIZE(kSchemes)); + client_->SetSignatureSchemes(kSchemes, PR_ARRAY_SIZE(kSchemes)); + Connect(); + EXPECT_TRUE(ecc.hookCalled); +} + +TEST_P(TlsConnectTls12, AutoClientSelectDsa) { + AutoClientResults dsa = {{SECFailure, TlsAgent::kClient}, + {SECFailure, TlsAgent::kClient}, + {SECSuccess, TlsAgent::kServerDsa}, + false}; + static const SSLSignatureScheme kSchemes[] = {ssl_sig_dsa_sha256}; + client_->SetupClientAuth(); + server_->RequestClientAuth(true); + EXPECT_EQ(SECSuccess, + SSL_GetClientAuthDataHook(client_->ssl_fd(), + GetAutoClientAuthDataHook, (void*)&dsa)); + server_->SetSignatureSchemes(kSchemes, PR_ARRAY_SIZE(kSchemes)); + client_->SetSignatureSchemes(kSchemes, PR_ARRAY_SIZE(kSchemes)); + Connect(); + EXPECT_TRUE(dsa.hookCalled); +} + TEST_F(TlsConnectStreamTls13, PostHandshakeAuthMultiple) { client_->SetupClientAuth(); EXPECT_EQ(SECSuccess, SSL_OptionSet(client_->ssl_fd(), diff --git a/security/nss/gtests/ssl_gtest/ssl_version_unittest.cc b/security/nss/gtests/ssl_gtest/ssl_version_unittest.cc index 48ae6e93a6..e30d92aba3 100644 --- a/security/nss/gtests/ssl_gtest/ssl_version_unittest.cc +++ b/security/nss/gtests/ssl_gtest/ssl_version_unittest.cc @@ -327,13 +327,24 @@ TEST_F(TlsConnectStreamTls13, Tls14ClientHelloWithSupportedVersions) { ASSERT_LT(static_cast(SSL_LIBRARY_VERSION_TLS_1_2), version); } -// Offer 1.3 but with ClientHello.legacy_version == SSL 3.0. This +// Offer 1.3 but with Server/ClientHello.legacy_version == SSL 3.0. This // causes a protocol version alert. See RFC 8446 Appendix D.5. TEST_F(TlsConnectStreamTls13, Ssl30ClientHelloWithSupportedVersions) { MakeTlsFilter(client_, SSL_LIBRARY_VERSION_3_0); ConnectExpectAlert(server_, kTlsAlertProtocolVersion); } +TEST_F(TlsConnectStreamTls13, Ssl30ServerHelloWithSupportedVersions) { + MakeTlsFilter(server_, SSL_LIBRARY_VERSION_3_0); + StartConnect(); + client_->ExpectSendAlert(kTlsAlertProtocolVersion); + /* Since the handshake is not finished the client will send an unencrypted + * alert. The server is expected to close the connection with a unexpected + * message alert. */ + server_->ExpectSendAlert(kTlsAlertUnexpectedMessage); + Handshake(); +} + INSTANTIATE_TEST_CASE_P( TlsDowngradeSentinelTest, TlsDowngradeTest, ::testing::Combine(TlsConnectTestBase::kTlsVariantsStream, diff --git a/security/nss/gtests/ssl_gtest/tls_filter.cc b/security/nss/gtests/ssl_gtest/tls_filter.cc index 8be2a70b76..9729c960f1 100644 --- a/security/nss/gtests/ssl_gtest/tls_filter.cc +++ b/security/nss/gtests/ssl_gtest/tls_filter.cc @@ -1060,6 +1060,14 @@ PacketFilter::Action TlsClientHelloVersionSetter::FilterHandshake( return CHANGE; } +PacketFilter::Action TlsServerHelloVersionSetter::FilterHandshake( + const HandshakeHeader& header, const DataBuffer& input, + DataBuffer* output) { + *output = input; + output->Write(0, version_, 2); + return CHANGE; +} + PacketFilter::Action SelectedCipherSuiteReplacer::FilterHandshake( const HandshakeHeader& header, const DataBuffer& input, DataBuffer* output) { diff --git a/security/nss/gtests/ssl_gtest/tls_filter.h b/security/nss/gtests/ssl_gtest/tls_filter.h index 93e5bad024..26d2fe885b 100644 --- a/security/nss/gtests/ssl_gtest/tls_filter.h +++ b/security/nss/gtests/ssl_gtest/tls_filter.h @@ -669,6 +669,21 @@ class TlsClientHelloVersionSetter : public TlsHandshakeFilter { uint16_t version_; }; +// Set the version number in the ServerHello. +class TlsServerHelloVersionSetter : public TlsHandshakeFilter { + public: + TlsServerHelloVersionSetter(const std::shared_ptr& a, + uint16_t version) + : TlsHandshakeFilter(a, {kTlsHandshakeServerHello}), version_(version) {} + + virtual PacketFilter::Action FilterHandshake(const HandshakeHeader& header, + const DataBuffer& input, + DataBuffer* output); + + private: + uint16_t version_; +}; + // Damages the last byte of a handshake message. class TlsLastByteDamager : public TlsHandshakeFilter { public: diff --git a/security/nss/lib/base/utf8.c b/security/nss/lib/base/utf8.c index 6d7b6a0155..9fe3780107 100644 --- a/security/nss/lib/base/utf8.c +++ b/security/nss/lib/base/utf8.c @@ -307,31 +307,54 @@ nssUTF8_Length(const NSSUTF8 *s, PRStatus *statusOpt) #endif /* NSSDEBUG */ /* - * From RFC 2044: + * From RFC 3629: * - * UCS-4 range (hex.) UTF-8 octet sequence (binary) - * 0000 0000-0000 007F 0xxxxxxx - * 0000 0080-0000 07FF 110xxxxx 10xxxxxx - * 0000 0800-0000 FFFF 1110xxxx 10xxxxxx 10xxxxxx - * 0001 0000-001F FFFF 11110xxx 10xxxxxx 10xxxxxx 10xxxxxx - * 0020 0000-03FF FFFF 111110xx 10xxxxxx 10xxxxxx 10xxxxxx 10xxxxxx - * 0400 0000-7FFF FFFF 1111110x 10xxxxxx ... 10xxxxxx + * UTF8-octets = *( UTF8-char ) + * UTF8-char = UTF8-1 / UTF8-2 / UTF8-3 / UTF8-4 + * UTF8-1 = %x00-7F + * UTF8-2 = %xC2-DF UTF8-tail + * UTF8-3 = %xE0 %xA0-BF UTF8-tail / %xE1-EC 2( UTF8-tail ) / + * %xED %x80-9F UTF8-tail / %xEE-EF 2( UTF8-tail ) + * UTF8-4 = %xF0 %x90-BF 2( UTF8-tail ) / %xF1-F3 3( UTF8-tail ) / + * %xF4 %x80-8F 2( UTF8-tail ) + * UTF8-tail = %x80-BF */ while (0 != *c) { PRUint32 incr; - if ((*c & 0x80) == 0) { + if (*c < 0x80) { incr = 1; - } else if ((*c & 0xE0) == 0xC0) { + } else if (*c < 0xC2) { + nss_SetError(NSS_ERROR_INVALID_STRING); + goto loser; + } else if (*c < 0xE0) { incr = 2; - } else if ((*c & 0xF0) == 0xE0) { + } else if (*c == 0xE0) { + if (c[1] < 0xA0) { + nss_SetError(NSS_ERROR_INVALID_STRING); + goto loser; + } incr = 3; - } else if ((*c & 0xF8) == 0xF0) { + } else if (*c < 0xF0) { + if (*c == 0xED && c[1] > 0x9F) { + nss_SetError(NSS_ERROR_INVALID_STRING); + goto loser; + } + incr = 3; + } else if (*c == 0xF0) { + if (c[1] < 0x90) { + nss_SetError(NSS_ERROR_INVALID_STRING); + goto loser; + } + incr = 4; + } else if (*c < 0xF4) { + incr = 4; + } else if (*c == 0xF4) { + if (c[1] > 0x8F) { + nss_SetError(NSS_ERROR_INVALID_STRING); + goto loser; + } incr = 4; - } else if ((*c & 0xFC) == 0xF8) { - incr = 5; - } else if ((*c & 0xFE) == 0xFC) { - incr = 6; } else { nss_SetError(NSS_ERROR_INVALID_STRING); goto loser; @@ -345,17 +368,17 @@ nssUTF8_Length(const NSSUTF8 *s, PRStatus *statusOpt) nss_SetError(NSS_ERROR_VALUE_TOO_LARGE); goto loser; } +#endif /* PEDANTIC */ { - PRUint8 *d; + const PRUint8 *d; for (d = &c[1]; d < &c[incr]; d++) { - if ((*d & 0xC0) != 0xF0) { + if ((*d & 0xC0) != 0x80) { nss_SetError(NSS_ERROR_INVALID_STRING); goto loser; } } } -#endif /* PEDANTIC */ c += incr; } diff --git a/security/nss/lib/certdb/cert.h b/security/nss/lib/certdb/cert.h index 1981b8f549..33d37b39a0 100644 --- a/security/nss/lib/certdb/cert.h +++ b/security/nss/lib/certdb/cert.h @@ -1314,6 +1314,21 @@ SECStatus CERT_FilterCertListByCANames(CERTCertList *certList, int nCANames, */ SECStatus CERT_FilterCertListForUserCerts(CERTCertList *certList); +/* + * Filter a list of certificates, removing those certs that don't match the + * nickname. + */ +SECStatus CERT_FilterCertListByNickname(CERTCertList *certList, char *nickname, + void *pwarg); + +/* return true if cert is in cert list */ +PRBool CERT_IsInList(const CERTCertificate *cert, const CERTCertList *certList); + +/* returned certList is the intersection of the certs on certList and the + * certs on filterList */ +SECStatus CERT_FilterCertListByCertList(CERTCertList *certList, + const CERTCertList *filterList); + /* * Collect the nicknames from all certs in a CertList. If the cert is not * valid, append a string to that nickname. diff --git a/security/nss/lib/certdb/certdb.c b/security/nss/lib/certdb/certdb.c index 4a713b6d7f..e9acbb28d7 100644 --- a/security/nss/lib/certdb/certdb.c +++ b/security/nss/lib/certdb/certdb.c @@ -2552,6 +2552,10 @@ CERT_DestroyCertList(CERTCertList *certs) { PRCList *node; + if (!certs) { + return; + } + while (!PR_CLIST_IS_EMPTY(&certs->list)) { node = PR_LIST_HEAD(&certs->list); CERT_DestroyCertificate(((CERTCertListNode *)node)->cert); @@ -2866,6 +2870,86 @@ CERT_FilterCertListForUserCerts(CERTCertList *certList) return (SECSuccess); } +/* return true if cert is in the list */ +PRBool +CERT_IsInList(const CERTCertificate *cert, const CERTCertList *certList) +{ + CERTCertListNode *node; + for (node = CERT_LIST_HEAD(certList); !CERT_LIST_END(node, certList); + node = CERT_LIST_NEXT(node)) { + if (node->cert == cert) { + return PR_TRUE; + } + } + return PR_FALSE; +} + +/* returned certList is the intersection of the certs on certList and the + * certs on filterList */ +SECStatus +CERT_FilterCertListByCertList(CERTCertList *certList, + const CERTCertList *filterList) +{ + CERTCertListNode *node, *freenode; + CERTCertificate *cert; + + if (!certList) { + return SECFailure; + } + + if (!filterList || CERT_LIST_EMPTY(certList)) { + /* if the filterList is empty, just clear out certList and return */ + for (node = CERT_LIST_HEAD(certList); !CERT_LIST_END(node, certList);) { + freenode = node; + node = CERT_LIST_NEXT(node); + CERT_RemoveCertListNode(freenode); + } + return SECSuccess; + } + + node = CERT_LIST_HEAD(certList); + + while (!CERT_LIST_END(node, certList)) { + cert = node->cert; + if (!CERT_IsInList(cert, filterList)) { + // no matching cert on filter list, remove it from certlist */ + freenode = node; + node = CERT_LIST_NEXT(node); + CERT_RemoveCertListNode(freenode); + } else { + /* matching cert, keep it around */ + node = CERT_LIST_NEXT(node); + } + } + + return (SECSuccess); +} + +SECStatus +CERT_FilterCertListByNickname(CERTCertList *certList, char *nickname, + void *pwarg) +{ + CERTCertList *nameList; + SECStatus rv; + + if (!certList) { + return SECFailure; + } + + /* we could try to match the nickname to the individual cert, + * but nickname parsing is quite complicated, so it's best just + * to use the existing code and get a list of certs that match the + * nickname. We can then compare that list with our input cert list + * and return only those certs that are on both. */ + nameList = PK11_FindCertsFromNickname(nickname, pwarg); + + /* namelist could be NULL, this will force certList to become empty */ + rv = CERT_FilterCertListByCertList(certList, nameList); + /* CERT_DestroyCertList can now accept a NULL pointer */ + CERT_DestroyCertList(nameList); + return rv; +} + static PZLock *certRefCountLock = NULL; /* diff --git a/security/nss/lib/ckfw/builtins/certdata.txt b/security/nss/lib/ckfw/builtins/certdata.txt index 8083d28299..4645042ba9 100644 --- a/security/nss/lib/ckfw/builtins/certdata.txt +++ b/security/nss/lib/ckfw/builtins/certdata.txt @@ -79,7 +79,7 @@ CKA_LABEL UTF8 "Mozilla Builtin Roots" # Subject: CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE # Not Valid Before: Tue Sep 01 12:00:00 1998 # Not Valid After : Fri Jan 28 12:00:00 2028 -# Fingerprint (MD5): 3E:45:52:15:09:51:92:E1:B7:5D:37:9F:B1:87:29:8A +# Fingerprint (SHA-256): EB:D4:10:40:E4:BB:3E:C7:42:C9:E3:81:D3:1E:F2:A4:1A:48:B6:68:5C:96:E7:CE:F3:C1:DF:6C:D4:33:1C:99 # Fingerprint (SHA1): B1:BC:96:8B:D4:F4:9D:62:2A:A8:9A:81:F2:15:01:52:A4:1D:82:9C CKA_CLASS CK_OBJECT_CLASS CKO_CERTIFICATE CKA_TOKEN CK_BBOOL CK_TRUE @@ -169,13 +169,13 @@ CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE -# Trust for Certificate "GlobalSign Root CA" +# Trust for "GlobalSign Root CA" # Issuer: CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE # Serial Number:04:00:00:00:00:01:15:4b:5a:c3:94 # Subject: CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE # Not Valid Before: Tue Sep 01 12:00:00 1998 # Not Valid After : Fri Jan 28 12:00:00 2028 -# Fingerprint (MD5): 3E:45:52:15:09:51:92:E1:B7:5D:37:9F:B1:87:29:8A +# Fingerprint (SHA-256): EB:D4:10:40:E4:BB:3E:C7:42:C9:E3:81:D3:1E:F2:A4:1A:48:B6:68:5C:96:E7:CE:F3:C1:DF:6C:D4:33:1C:99 # Fingerprint (SHA1): B1:BC:96:8B:D4:F4:9D:62:2A:A8:9A:81:F2:15:01:52:A4:1D:82:9C CKA_CLASS CK_OBJECT_CLASS CKO_NSS_TRUST CKA_TOKEN CK_BBOOL CK_TRUE @@ -213,7 +213,7 @@ CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE # Subject: CN=VeriSign Class 1 Public Primary Certification Authority - G3,OU="(c) 1999 VeriSign, Inc. - For authorized use only",OU=VeriSign Trust Network,O="VeriSign, Inc.",C=US # Not Valid Before: Fri Oct 01 00:00:00 1999 # Not Valid After : Wed Jul 16 23:59:59 2036 -# Fingerprint (MD5): B1:47:BC:18:57:D1:18:A0:78:2D:EC:71:E8:2A:95:73 +# Fingerprint (SHA-256): CB:B5:AF:18:5E:94:2A:24:02:F9:EA:CB:C0:ED:5B:B8:76:EE:A3:C1:22:36:23:D0:04:47:E4:F3:BA:55:4B:65 # Fingerprint (SHA1): 20:42:85:DC:F7:EB:76:41:95:57:8E:13:6B:D4:B7:D1:E9:8E:46:A5 CKA_CLASS CK_OBJECT_CLASS CKO_CERTIFICATE CKA_TOKEN CK_BBOOL CK_TRUE @@ -331,13 +331,13 @@ CKA_NSS_EMAIL_DISTRUST_AFTER MULTILINE_OCTAL \062\062\060\070\063\061\060\060\060\060\060\060\132 END -# Trust for Certificate "Verisign Class 1 Public Primary Certification Authority - G3" +# Trust for "Verisign Class 1 Public Primary Certification Authority - G3" # Issuer: CN=VeriSign Class 1 Public Primary Certification Authority - G3,OU="(c) 1999 VeriSign, Inc. - For authorized use only",OU=VeriSign Trust Network,O="VeriSign, Inc.",C=US # Serial Number:00:8b:5b:75:56:84:54:85:0b:00:cf:af:38:48:ce:b1:a4 # Subject: CN=VeriSign Class 1 Public Primary Certification Authority - G3,OU="(c) 1999 VeriSign, Inc. - For authorized use only",OU=VeriSign Trust Network,O="VeriSign, Inc.",C=US # Not Valid Before: Fri Oct 01 00:00:00 1999 # Not Valid After : Wed Jul 16 23:59:59 2036 -# Fingerprint (MD5): B1:47:BC:18:57:D1:18:A0:78:2D:EC:71:E8:2A:95:73 +# Fingerprint (SHA-256): CB:B5:AF:18:5E:94:2A:24:02:F9:EA:CB:C0:ED:5B:B8:76:EE:A3:C1:22:36:23:D0:04:47:E4:F3:BA:55:4B:65 # Fingerprint (SHA1): 20:42:85:DC:F7:EB:76:41:95:57:8E:13:6B:D4:B7:D1:E9:8E:46:A5 CKA_CLASS CK_OBJECT_CLASS CKO_NSS_TRUST CKA_TOKEN CK_BBOOL CK_TRUE @@ -383,7 +383,7 @@ CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE # Subject: CN=VeriSign Class 2 Public Primary Certification Authority - G3,OU="(c) 1999 VeriSign, Inc. - For authorized use only",OU=VeriSign Trust Network,O="VeriSign, Inc.",C=US # Not Valid Before: Fri Oct 01 00:00:00 1999 # Not Valid After : Wed Jul 16 23:59:59 2036 -# Fingerprint (MD5): F8:BE:C4:63:22:C9:A8:46:74:8B:B8:1D:1E:4A:2B:F6 +# Fingerprint (SHA-256): 92:A9:D9:83:3F:E1:94:4D:B3:66:E8:BF:AE:7A:95:B6:48:0C:2D:6C:6C:2A:1B:E6:5D:42:36:B6:08:FC:A1:BB # Fingerprint (SHA1): 61:EF:43:D7:7F:CA:D4:61:51:BC:98:E0:C3:59:12:AF:9F:EB:63:11 CKA_CLASS CK_OBJECT_CLASS CKO_CERTIFICATE CKA_TOKEN CK_BBOOL CK_TRUE @@ -501,13 +501,13 @@ CKA_NSS_EMAIL_DISTRUST_AFTER MULTILINE_OCTAL \062\062\060\070\063\061\060\060\060\060\060\060\132 END -# Trust for Certificate "Verisign Class 2 Public Primary Certification Authority - G3" +# Trust for "Verisign Class 2 Public Primary Certification Authority - G3" # Issuer: CN=VeriSign Class 2 Public Primary Certification Authority - G3,OU="(c) 1999 VeriSign, Inc. - For authorized use only",OU=VeriSign Trust Network,O="VeriSign, Inc.",C=US # Serial Number:61:70:cb:49:8c:5f:98:45:29:e7:b0:a6:d9:50:5b:7a # Subject: CN=VeriSign Class 2 Public Primary Certification Authority - G3,OU="(c) 1999 VeriSign, Inc. - For authorized use only",OU=VeriSign Trust Network,O="VeriSign, Inc.",C=US # Not Valid Before: Fri Oct 01 00:00:00 1999 # Not Valid After : Wed Jul 16 23:59:59 2036 -# Fingerprint (MD5): F8:BE:C4:63:22:C9:A8:46:74:8B:B8:1D:1E:4A:2B:F6 +# Fingerprint (SHA-256): 92:A9:D9:83:3F:E1:94:4D:B3:66:E8:BF:AE:7A:95:B6:48:0C:2D:6C:6C:2A:1B:E6:5D:42:36:B6:08:FC:A1:BB # Fingerprint (SHA1): 61:EF:43:D7:7F:CA:D4:61:51:BC:98:E0:C3:59:12:AF:9F:EB:63:11 CKA_CLASS CK_OBJECT_CLASS CKO_NSS_TRUST CKA_TOKEN CK_BBOOL CK_TRUE @@ -553,7 +553,7 @@ CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE # Subject: CN=Entrust.net Certification Authority (2048),OU=(c) 1999 Entrust.net Limited,OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.),O=Entrust.net # Not Valid Before: Fri Dec 24 17:50:51 1999 # Not Valid After : Tue Jul 24 14:15:12 2029 -# Fingerprint (MD5): EE:29:31:BC:32:7E:9A:E6:E8:B5:F7:51:B4:34:71:90 +# Fingerprint (SHA-256): 6D:C4:71:72:E0:1C:BC:B0:BF:62:58:0D:89:5F:E2:B8:AC:9A:D4:F8:73:80:1E:0C:10:B9:C8:37:D2:1E:B1:77 # Fingerprint (SHA1): 50:30:06:09:1D:97:D4:F5:AE:39:F7:CB:E7:92:7D:7D:65:2D:34:31 CKA_CLASS CK_OBJECT_CLASS CKO_CERTIFICATE CKA_TOKEN CK_BBOOL CK_TRUE @@ -672,7 +672,7 @@ CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE # Subject: CN=Entrust.net Certification Authority (2048),OU=(c) 1999 Entrust.net Limited,OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.),O=Entrust.net # Not Valid Before: Fri Dec 24 17:50:51 1999 # Not Valid After : Tue Jul 24 14:15:12 2029 -# Fingerprint (MD5): EE:29:31:BC:32:7E:9A:E6:E8:B5:F7:51:B4:34:71:90 +# Fingerprint (SHA-256): 6D:C4:71:72:E0:1C:BC:B0:BF:62:58:0D:89:5F:E2:B8:AC:9A:D4:F8:73:80:1E:0C:10:B9:C8:37:D2:1E:B1:77 # Fingerprint (SHA1): 50:30:06:09:1D:97:D4:F5:AE:39:F7:CB:E7:92:7D:7D:65:2D:34:31 CKA_CLASS CK_OBJECT_CLASS CKO_NSS_TRUST CKA_TOKEN CK_BBOOL CK_TRUE @@ -716,7 +716,7 @@ CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE # Subject: CN=Baltimore CyberTrust Root,OU=CyberTrust,O=Baltimore,C=IE # Not Valid Before: Fri May 12 18:46:00 2000 # Not Valid After : Mon May 12 23:59:00 2025 -# Fingerprint (MD5): AC:B6:94:A5:9C:17:E0:D7:91:52:9B:B1:97:06:A6:E4 +# Fingerprint (SHA-256): 16:AF:57:A9:F6:76:B0:AB:12:60:95:AA:5E:BA:DE:F2:2A:B3:11:19:D6:44:AC:95:CD:4B:93:DB:F3:F2:6A:EB # Fingerprint (SHA1): D4:DE:20:D0:5E:66:FC:53:FE:1A:50:88:2C:78:DB:28:52:CA:E4:74 CKA_CLASS CK_OBJECT_CLASS CKO_CERTIFICATE CKA_TOKEN CK_BBOOL CK_TRUE @@ -806,13 +806,13 @@ CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE -# Trust for Certificate "Baltimore CyberTrust Root" +# Trust for "Baltimore CyberTrust Root" # Issuer: CN=Baltimore CyberTrust Root,OU=CyberTrust,O=Baltimore,C=IE # Serial Number: 33554617 (0x20000b9) # Subject: CN=Baltimore CyberTrust Root,OU=CyberTrust,O=Baltimore,C=IE # Not Valid Before: Fri May 12 18:46:00 2000 # Not Valid After : Mon May 12 23:59:00 2025 -# Fingerprint (MD5): AC:B6:94:A5:9C:17:E0:D7:91:52:9B:B1:97:06:A6:E4 +# Fingerprint (SHA-256): 16:AF:57:A9:F6:76:B0:AB:12:60:95:AA:5E:BA:DE:F2:2A:B3:11:19:D6:44:AC:95:CD:4B:93:DB:F3:F2:6A:EB # Fingerprint (SHA1): D4:DE:20:D0:5E:66:FC:53:FE:1A:50:88:2C:78:DB:28:52:CA:E4:74 CKA_CLASS CK_OBJECT_CLASS CKO_NSS_TRUST CKA_TOKEN CK_BBOOL CK_TRUE @@ -850,7 +850,7 @@ CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE # Subject: CN=Entrust Root Certification Authority,OU="(c) 2006 Entrust, Inc.",OU=www.entrust.net/CPS is incorporated by reference,O="Entrust, Inc.",C=US # Not Valid Before: Mon Nov 27 20:23:42 2006 # Not Valid After : Fri Nov 27 20:53:42 2026 -# Fingerprint (MD5): D6:A5:C3:ED:5D:DD:3E:00:C1:3D:87:92:1F:1D:3F:E4 +# Fingerprint (SHA-256): 73:C1:76:43:4F:1B:C6:D5:AD:F4:5B:0E:76:E7:27:28:7C:8D:E5:76:16:C1:E6:E6:14:1A:2B:2C:BC:7D:8E:4C # Fingerprint (SHA1): B3:1E:B1:B7:40:E3:6C:84:02:DA:DC:37:D4:4D:F5:D4:67:49:52:F9 CKA_CLASS CK_OBJECT_CLASS CKO_CERTIFICATE CKA_TOKEN CK_BBOOL CK_TRUE @@ -970,13 +970,13 @@ CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE -# Trust for Certificate "Entrust Root Certification Authority" +# Trust for "Entrust Root Certification Authority" # Issuer: CN=Entrust Root Certification Authority,OU="(c) 2006 Entrust, Inc.",OU=www.entrust.net/CPS is incorporated by reference,O="Entrust, Inc.",C=US # Serial Number: 1164660820 (0x456b5054) # Subject: CN=Entrust Root Certification Authority,OU="(c) 2006 Entrust, Inc.",OU=www.entrust.net/CPS is incorporated by reference,O="Entrust, Inc.",C=US # Not Valid Before: Mon Nov 27 20:23:42 2006 # Not Valid After : Fri Nov 27 20:53:42 2026 -# Fingerprint (MD5): D6:A5:C3:ED:5D:DD:3E:00:C1:3D:87:92:1F:1D:3F:E4 +# Fingerprint (SHA-256): 73:C1:76:43:4F:1B:C6:D5:AD:F4:5B:0E:76:E7:27:28:7C:8D:E5:76:16:C1:E6:E6:14:1A:2B:2C:BC:7D:8E:4C # Fingerprint (SHA1): B3:1E:B1:B7:40:E3:6C:84:02:DA:DC:37:D4:4D:F5:D4:67:49:52:F9 CKA_CLASS CK_OBJECT_CLASS CKO_NSS_TRUST CKA_TOKEN CK_BBOOL CK_TRUE @@ -1020,7 +1020,7 @@ CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE # Subject: CN=Certum CA,O=Unizeto Sp. z o.o.,C=PL # Not Valid Before: Tue Jun 11 10:46:39 2002 # Not Valid After : Fri Jun 11 10:46:39 2027 -# Fingerprint (MD5): 2C:8F:9F:66:1D:18:90:B1:47:26:9D:8E:86:82:8C:A9 +# Fingerprint (SHA-256): D8:E0:FE:BC:1D:B2:E3:8D:00:94:0F:37:D2:7D:41:34:4D:99:3E:73:4B:99:D5:65:6D:97:78:D4:D8:14:36:24 # Fingerprint (SHA1): 62:52:DC:40:F7:11:43:A2:2F:DE:9E:F7:34:8E:06:42:51:B1:81:18 CKA_CLASS CK_OBJECT_CLASS CKO_CERTIFICATE CKA_TOKEN CK_BBOOL CK_TRUE @@ -1099,13 +1099,13 @@ CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE -# Trust for Certificate "Certum Root CA" +# Trust for "Certum Root CA" # Issuer: CN=Certum CA,O=Unizeto Sp. z o.o.,C=PL # Serial Number: 65568 (0x10020) # Subject: CN=Certum CA,O=Unizeto Sp. z o.o.,C=PL # Not Valid Before: Tue Jun 11 10:46:39 2002 # Not Valid After : Fri Jun 11 10:46:39 2027 -# Fingerprint (MD5): 2C:8F:9F:66:1D:18:90:B1:47:26:9D:8E:86:82:8C:A9 +# Fingerprint (SHA-256): D8:E0:FE:BC:1D:B2:E3:8D:00:94:0F:37:D2:7D:41:34:4D:99:3E:73:4B:99:D5:65:6D:97:78:D4:D8:14:36:24 # Fingerprint (SHA1): 62:52:DC:40:F7:11:43:A2:2F:DE:9E:F7:34:8E:06:42:51:B1:81:18 CKA_CLASS CK_OBJECT_CLASS CKO_NSS_TRUST CKA_TOKEN CK_BBOOL CK_TRUE @@ -1141,7 +1141,7 @@ CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE # Subject: CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB # Not Valid Before: Thu Jan 01 00:00:00 2004 # Not Valid After : Sun Dec 31 23:59:59 2028 -# Fingerprint (MD5): 49:79:04:B0:EB:87:19:AC:47:B0:BC:11:51:9B:74:D0 +# Fingerprint (SHA-256): D7:A7:A0:FB:5D:7E:27:31:D7:71:E9:48:4E:BC:DE:F7:1D:5F:0C:3E:0A:29:48:78:2B:C8:3E:E0:EA:69:9E:F4 # Fingerprint (SHA1): D1:EB:23:A4:6D:17:D6:8F:D9:25:64:C2:F1:F1:60:17:64:D8:E3:49 CKA_CLASS CK_OBJECT_CLASS CKO_CERTIFICATE CKA_TOKEN CK_BBOOL CK_TRUE @@ -1247,13 +1247,13 @@ CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE -# Trust for Certificate "Comodo AAA Services root" +# Trust for "Comodo AAA Services root" # Issuer: CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB # Serial Number: 1 (0x1) # Subject: CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB # Not Valid Before: Thu Jan 01 00:00:00 2004 # Not Valid After : Sun Dec 31 23:59:59 2028 -# Fingerprint (MD5): 49:79:04:B0:EB:87:19:AC:47:B0:BC:11:51:9B:74:D0 +# Fingerprint (SHA-256): D7:A7:A0:FB:5D:7E:27:31:D7:71:E9:48:4E:BC:DE:F7:1D:5F:0C:3E:0A:29:48:78:2B:C8:3E:E0:EA:69:9E:F4 # Fingerprint (SHA1): D1:EB:23:A4:6D:17:D6:8F:D9:25:64:C2:F1:F1:60:17:64:D8:E3:49 CKA_CLASS CK_OBJECT_CLASS CKO_NSS_TRUST CKA_TOKEN CK_BBOOL CK_TRUE @@ -1293,7 +1293,7 @@ CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE # Subject: CN=QuoVadis Root CA 2,O=QuoVadis Limited,C=BM # Not Valid Before: Fri Nov 24 18:27:00 2006 # Not Valid After : Mon Nov 24 18:23:33 2031 -# Fingerprint (MD5): 5E:39:7B:DD:F8:BA:EC:82:E9:AC:62:BA:0C:54:00:2B +# Fingerprint (SHA-256): 85:A0:DD:7D:D7:20:AD:B7:FF:05:F8:3D:54:2B:20:9D:C7:FF:45:28:F7:D6:77:B1:83:89:FE:A5:E5:C4:9E:86 # Fingerprint (SHA1): CA:3A:FB:CF:12:40:36:4B:44:B2:16:20:88:80:48:39:19:93:7C:F7 CKA_CLASS CK_OBJECT_CLASS CKO_CERTIFICATE CKA_TOKEN CK_BBOOL CK_TRUE @@ -1417,13 +1417,13 @@ CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE -# Trust for Certificate "QuoVadis Root CA 2" +# Trust for "QuoVadis Root CA 2" # Issuer: CN=QuoVadis Root CA 2,O=QuoVadis Limited,C=BM # Serial Number: 1289 (0x509) # Subject: CN=QuoVadis Root CA 2,O=QuoVadis Limited,C=BM # Not Valid Before: Fri Nov 24 18:27:00 2006 # Not Valid After : Mon Nov 24 18:23:33 2031 -# Fingerprint (MD5): 5E:39:7B:DD:F8:BA:EC:82:E9:AC:62:BA:0C:54:00:2B +# Fingerprint (SHA-256): 85:A0:DD:7D:D7:20:AD:B7:FF:05:F8:3D:54:2B:20:9D:C7:FF:45:28:F7:D6:77:B1:83:89:FE:A5:E5:C4:9E:86 # Fingerprint (SHA1): CA:3A:FB:CF:12:40:36:4B:44:B2:16:20:88:80:48:39:19:93:7C:F7 CKA_CLASS CK_OBJECT_CLASS CKO_NSS_TRUST CKA_TOKEN CK_BBOOL CK_TRUE @@ -1460,7 +1460,7 @@ CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE # Subject: CN=QuoVadis Root CA 3,O=QuoVadis Limited,C=BM # Not Valid Before: Fri Nov 24 19:11:23 2006 # Not Valid After : Mon Nov 24 19:06:44 2031 -# Fingerprint (MD5): 31:85:3C:62:94:97:63:B9:AA:FD:89:4E:AF:6F:E0:CF +# Fingerprint (SHA-256): 18:F1:FC:7F:20:5D:F8:AD:DD:EB:7F:E0:07:DD:57:E3:AF:37:5A:9C:4D:8D:73:54:6B:F4:F1:FE:D1:E1:8D:35 # Fingerprint (SHA1): 1F:49:14:F7:D8:74:95:1D:DD:AE:02:C0:BE:FD:3A:2D:82:75:51:85 CKA_CLASS CK_OBJECT_CLASS CKO_CERTIFICATE CKA_TOKEN CK_BBOOL CK_TRUE @@ -1599,13 +1599,13 @@ CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE -# Trust for Certificate "QuoVadis Root CA 3" +# Trust for "QuoVadis Root CA 3" # Issuer: CN=QuoVadis Root CA 3,O=QuoVadis Limited,C=BM # Serial Number: 1478 (0x5c6) # Subject: CN=QuoVadis Root CA 3,O=QuoVadis Limited,C=BM # Not Valid Before: Fri Nov 24 19:11:23 2006 # Not Valid After : Mon Nov 24 19:06:44 2031 -# Fingerprint (MD5): 31:85:3C:62:94:97:63:B9:AA:FD:89:4E:AF:6F:E0:CF +# Fingerprint (SHA-256): 18:F1:FC:7F:20:5D:F8:AD:DD:EB:7F:E0:07:DD:57:E3:AF:37:5A:9C:4D:8D:73:54:6B:F4:F1:FE:D1:E1:8D:35 # Fingerprint (SHA1): 1F:49:14:F7:D8:74:95:1D:DD:AE:02:C0:BE:FD:3A:2D:82:75:51:85 CKA_CLASS CK_OBJECT_CLASS CKO_NSS_TRUST CKA_TOKEN CK_BBOOL CK_TRUE @@ -1642,7 +1642,7 @@ CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE # Subject: OU=Security Communication RootCA1,O=SECOM Trust.net,C=JP # Not Valid Before: Tue Sep 30 04:20:49 2003 # Not Valid After : Sat Sep 30 04:20:49 2023 -# Fingerprint (MD5): F1:BC:63:6A:54:E0:B5:27:F5:CD:E7:1A:E3:4D:6E:4A +# Fingerprint (SHA-256): E7:5E:72:ED:9F:56:0E:EC:6E:B4:80:00:73:A4:3F:C3:AD:19:19:5A:39:22:82:01:78:95:97:4A:99:02:6B:6C # Fingerprint (SHA1): 36:B1:2B:49:F9:81:9E:D7:4C:9E:BC:38:0F:C6:56:8F:5D:AC:B2:F7 CKA_CLASS CK_OBJECT_CLASS CKO_CERTIFICATE CKA_TOKEN CK_BBOOL CK_TRUE @@ -1730,13 +1730,13 @@ CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE -# Trust for Certificate "Security Communication Root CA" +# Trust for "Security Communication Root CA" # Issuer: OU=Security Communication RootCA1,O=SECOM Trust.net,C=JP # Serial Number: 0 (0x0) # Subject: OU=Security Communication RootCA1,O=SECOM Trust.net,C=JP # Not Valid Before: Tue Sep 30 04:20:49 2003 # Not Valid After : Sat Sep 30 04:20:49 2023 -# Fingerprint (MD5): F1:BC:63:6A:54:E0:B5:27:F5:CD:E7:1A:E3:4D:6E:4A +# Fingerprint (SHA-256): E7:5E:72:ED:9F:56:0E:EC:6E:B4:80:00:73:A4:3F:C3:AD:19:19:5A:39:22:82:01:78:95:97:4A:99:02:6B:6C # Fingerprint (SHA1): 36:B1:2B:49:F9:81:9E:D7:4C:9E:BC:38:0F:C6:56:8F:5D:AC:B2:F7 CKA_CLASS CK_OBJECT_CLASS CKO_NSS_TRUST CKA_TOKEN CK_BBOOL CK_TRUE @@ -1774,7 +1774,7 @@ CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE # Subject: CN=Chambers of Commerce Root,OU=http://www.chambersign.org,O=AC Camerfirma SA CIF A82743287,C=EU # Not Valid Before: Tue Sep 30 16:13:43 2003 # Not Valid After : Wed Sep 30 16:13:44 2037 -# Fingerprint (MD5): B0:01:EE:14:D9:AF:29:18:94:76:8E:F1:69:33:2A:84 +# Fingerprint (SHA-256): 0C:25:8A:12:A5:67:4A:EF:25:F2:8B:A7:DC:FA:EC:EE:A3:48:E5:41:E6:F5:CC:4E:E6:3B:71:B3:61:60:6A:C3 # Fingerprint (SHA1): 6E:3A:55:A4:19:0C:19:5C:93:84:3C:C0:DB:72:2E:31:30:61:F0:B1 CKA_CLASS CK_OBJECT_CLASS CKO_CERTIFICATE CKA_TOKEN CK_BBOOL CK_TRUE @@ -1894,13 +1894,13 @@ CKA_NSS_EMAIL_DISTRUST_AFTER MULTILINE_OCTAL \062\061\060\063\060\061\060\060\060\060\060\060\132 END -# Trust for Certificate "Camerfirma Chambers of Commerce Root" +# Trust for "Camerfirma Chambers of Commerce Root" # Issuer: CN=Chambers of Commerce Root,OU=http://www.chambersign.org,O=AC Camerfirma SA CIF A82743287,C=EU # Serial Number: 0 (0x0) # Subject: CN=Chambers of Commerce Root,OU=http://www.chambersign.org,O=AC Camerfirma SA CIF A82743287,C=EU # Not Valid Before: Tue Sep 30 16:13:43 2003 # Not Valid After : Wed Sep 30 16:13:44 2037 -# Fingerprint (MD5): B0:01:EE:14:D9:AF:29:18:94:76:8E:F1:69:33:2A:84 +# Fingerprint (SHA-256): 0C:25:8A:12:A5:67:4A:EF:25:F2:8B:A7:DC:FA:EC:EE:A3:48:E5:41:E6:F5:CC:4E:E6:3B:71:B3:61:60:6A:C3 # Fingerprint (SHA1): 6E:3A:55:A4:19:0C:19:5C:93:84:3C:C0:DB:72:2E:31:30:61:F0:B1 CKA_CLASS CK_OBJECT_CLASS CKO_NSS_TRUST CKA_TOKEN CK_BBOOL CK_TRUE @@ -1941,7 +1941,7 @@ CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE # Subject: CN=Global Chambersign Root,OU=http://www.chambersign.org,O=AC Camerfirma SA CIF A82743287,C=EU # Not Valid Before: Tue Sep 30 16:14:18 2003 # Not Valid After : Wed Sep 30 16:14:18 2037 -# Fingerprint (MD5): C5:E6:7B:BF:06:D0:4F:43:ED:C4:7A:65:8A:FB:6B:19 +# Fingerprint (SHA-256): EF:3C:B4:17:FC:8E:BF:6F:97:87:6C:9E:4E:CE:39:DE:1E:A5:FE:64:91:41:D1:02:8B:7D:11:C0:B2:29:8C:ED # Fingerprint (SHA1): 33:9B:6B:14:50:24:9B:55:7A:01:87:72:84:D9:E0:2F:C3:D2:D8:E9 CKA_CLASS CK_OBJECT_CLASS CKO_CERTIFICATE CKA_TOKEN CK_BBOOL CK_TRUE @@ -2059,13 +2059,13 @@ CKA_NSS_EMAIL_DISTRUST_AFTER MULTILINE_OCTAL \062\061\060\063\060\061\060\060\060\060\060\060\132 END -# Trust for Certificate "Camerfirma Global Chambersign Root" +# Trust for "Camerfirma Global Chambersign Root" # Issuer: CN=Global Chambersign Root,OU=http://www.chambersign.org,O=AC Camerfirma SA CIF A82743287,C=EU # Serial Number: 0 (0x0) # Subject: CN=Global Chambersign Root,OU=http://www.chambersign.org,O=AC Camerfirma SA CIF A82743287,C=EU # Not Valid Before: Tue Sep 30 16:14:18 2003 # Not Valid After : Wed Sep 30 16:14:18 2037 -# Fingerprint (MD5): C5:E6:7B:BF:06:D0:4F:43:ED:C4:7A:65:8A:FB:6B:19 +# Fingerprint (SHA-256): EF:3C:B4:17:FC:8E:BF:6F:97:87:6C:9E:4E:CE:39:DE:1E:A5:FE:64:91:41:D1:02:8B:7D:11:C0:B2:29:8C:ED # Fingerprint (SHA1): 33:9B:6B:14:50:24:9B:55:7A:01:87:72:84:D9:E0:2F:C3:D2:D8:E9 CKA_CLASS CK_OBJECT_CLASS CKO_NSS_TRUST CKA_TOKEN CK_BBOOL CK_TRUE @@ -2105,7 +2105,7 @@ CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE # Subject: CN=XRamp Global Certification Authority,O=XRamp Security Services Inc,OU=www.xrampsecurity.com,C=US # Not Valid Before: Mon Nov 01 17:14:04 2004 # Not Valid After : Mon Jan 01 05:37:19 2035 -# Fingerprint (MD5): A1:0B:44:B3:CA:10:D8:00:6E:9D:0F:D8:0F:92:0A:D1 +# Fingerprint (SHA-256): CE:CD:DC:90:50:99:D8:DA:DF:C5:B1:D2:09:B7:37:CB:E2:C1:8C:FB:2C:10:C0:FF:0B:CF:0D:32:86:FC:1A:A2 # Fingerprint (SHA1): B8:01:86:D1:EB:9C:86:A5:41:04:CF:30:54:F3:4C:52:B7:E5:58:C6 CKA_CLASS CK_OBJECT_CLASS CKO_CERTIFICATE CKA_TOKEN CK_BBOOL CK_TRUE @@ -2214,13 +2214,13 @@ CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE -# Trust for Certificate "XRamp Global CA Root" +# Trust for "XRamp Global CA Root" # Issuer: CN=XRamp Global Certification Authority,O=XRamp Security Services Inc,OU=www.xrampsecurity.com,C=US # Serial Number:50:94:6c:ec:18:ea:d5:9c:4d:d5:97:ef:75:8f:a0:ad # Subject: CN=XRamp Global Certification Authority,O=XRamp Security Services Inc,OU=www.xrampsecurity.com,C=US # Not Valid Before: Mon Nov 01 17:14:04 2004 # Not Valid After : Mon Jan 01 05:37:19 2035 -# Fingerprint (MD5): A1:0B:44:B3:CA:10:D8:00:6E:9D:0F:D8:0F:92:0A:D1 +# Fingerprint (SHA-256): CE:CD:DC:90:50:99:D8:DA:DF:C5:B1:D2:09:B7:37:CB:E2:C1:8C:FB:2C:10:C0:FF:0B:CF:0D:32:86:FC:1A:A2 # Fingerprint (SHA1): B8:01:86:D1:EB:9C:86:A5:41:04:CF:30:54:F3:4C:52:B7:E5:58:C6 CKA_CLASS CK_OBJECT_CLASS CKO_NSS_TRUST CKA_TOKEN CK_BBOOL CK_TRUE @@ -2262,7 +2262,7 @@ CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE # Subject: OU=Go Daddy Class 2 Certification Authority,O="The Go Daddy Group, Inc.",C=US # Not Valid Before: Tue Jun 29 17:06:20 2004 # Not Valid After : Thu Jun 29 17:06:20 2034 -# Fingerprint (MD5): 91:DE:06:25:AB:DA:FD:32:17:0C:BB:25:17:2A:84:67 +# Fingerprint (SHA-256): C3:84:6B:F2:4B:9E:93:CA:64:27:4C:0E:C6:7C:1E:CC:5E:02:4F:FC:AC:D2:D7:40:19:35:0E:81:FE:54:6A:E4 # Fingerprint (SHA1): 27:96:BA:E6:3F:18:01:E2:77:26:1B:A0:D7:77:70:02:8F:20:EE:E4 CKA_CLASS CK_OBJECT_CLASS CKO_CERTIFICATE CKA_TOKEN CK_BBOOL CK_TRUE @@ -2363,13 +2363,13 @@ CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE -# Trust for Certificate "Go Daddy Class 2 CA" +# Trust for "Go Daddy Class 2 CA" # Issuer: OU=Go Daddy Class 2 Certification Authority,O="The Go Daddy Group, Inc.",C=US # Serial Number: 0 (0x0) # Subject: OU=Go Daddy Class 2 Certification Authority,O="The Go Daddy Group, Inc.",C=US # Not Valid Before: Tue Jun 29 17:06:20 2004 # Not Valid After : Thu Jun 29 17:06:20 2034 -# Fingerprint (MD5): 91:DE:06:25:AB:DA:FD:32:17:0C:BB:25:17:2A:84:67 +# Fingerprint (SHA-256): C3:84:6B:F2:4B:9E:93:CA:64:27:4C:0E:C6:7C:1E:CC:5E:02:4F:FC:AC:D2:D7:40:19:35:0E:81:FE:54:6A:E4 # Fingerprint (SHA1): 27:96:BA:E6:3F:18:01:E2:77:26:1B:A0:D7:77:70:02:8F:20:EE:E4 CKA_CLASS CK_OBJECT_CLASS CKO_NSS_TRUST CKA_TOKEN CK_BBOOL CK_TRUE @@ -2408,7 +2408,7 @@ CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE # Subject: OU=Starfield Class 2 Certification Authority,O="Starfield Technologies, Inc.",C=US # Not Valid Before: Tue Jun 29 17:39:16 2004 # Not Valid After : Thu Jun 29 17:39:16 2034 -# Fingerprint (MD5): 32:4A:4B:BB:C8:63:69:9B:BE:74:9A:C6:DD:1D:46:24 +# Fingerprint (SHA-256): 14:65:FA:20:53:97:B8:76:FA:A6:F0:A9:95:8E:55:90:E4:0F:CC:7F:AA:4F:B7:C2:C8:67:75:21:FB:5F:B6:58 # Fingerprint (SHA1): AD:7E:1C:28:B0:64:EF:8F:60:03:40:20:14:C3:D0:E3:37:0E:B5:8A CKA_CLASS CK_OBJECT_CLASS CKO_CERTIFICATE CKA_TOKEN CK_BBOOL CK_TRUE @@ -2510,13 +2510,13 @@ CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE -# Trust for Certificate "Starfield Class 2 CA" +# Trust for "Starfield Class 2 CA" # Issuer: OU=Starfield Class 2 Certification Authority,O="Starfield Technologies, Inc.",C=US # Serial Number: 0 (0x0) # Subject: OU=Starfield Class 2 Certification Authority,O="Starfield Technologies, Inc.",C=US # Not Valid Before: Tue Jun 29 17:39:16 2004 # Not Valid After : Thu Jun 29 17:39:16 2034 -# Fingerprint (MD5): 32:4A:4B:BB:C8:63:69:9B:BE:74:9A:C6:DD:1D:46:24 +# Fingerprint (SHA-256): 14:65:FA:20:53:97:B8:76:FA:A6:F0:A9:95:8E:55:90:E4:0F:CC:7F:AA:4F:B7:C2:C8:67:75:21:FB:5F:B6:58 # Fingerprint (SHA1): AD:7E:1C:28:B0:64:EF:8F:60:03:40:20:14:C3:D0:E3:37:0E:B5:8A CKA_CLASS CK_OBJECT_CLASS CKO_NSS_TRUST CKA_TOKEN CK_BBOOL CK_TRUE @@ -2555,7 +2555,7 @@ CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE # Subject: CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US # Not Valid Before: Fri Nov 10 00:00:00 2006 # Not Valid After : Mon Nov 10 00:00:00 2031 -# Fingerprint (MD5): 87:CE:0B:7B:2A:0E:49:00:E1:58:71:9B:37:A8:93:72 +# Fingerprint (SHA-256): 3E:90:99:B5:01:5E:8F:48:6C:00:BC:EA:9D:11:1E:E7:21:FA:BA:35:5A:89:BC:F1:DF:69:56:1E:3D:C6:32:5C # Fingerprint (SHA1): 05:63:B8:63:0D:62:D7:5A:BB:C8:AB:1E:4B:DF:B5:A8:99:B2:4D:43 CKA_CLASS CK_OBJECT_CLASS CKO_CERTIFICATE CKA_TOKEN CK_BBOOL CK_TRUE @@ -2652,13 +2652,13 @@ CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE -# Trust for Certificate "DigiCert Assured ID Root CA" +# Trust for "DigiCert Assured ID Root CA" # Issuer: CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US # Serial Number:0c:e7:e0:e5:17:d8:46:fe:8f:e5:60:fc:1b:f0:30:39 # Subject: CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US # Not Valid Before: Fri Nov 10 00:00:00 2006 # Not Valid After : Mon Nov 10 00:00:00 2031 -# Fingerprint (MD5): 87:CE:0B:7B:2A:0E:49:00:E1:58:71:9B:37:A8:93:72 +# Fingerprint (SHA-256): 3E:90:99:B5:01:5E:8F:48:6C:00:BC:EA:9D:11:1E:E7:21:FA:BA:35:5A:89:BC:F1:DF:69:56:1E:3D:C6:32:5C # Fingerprint (SHA1): 05:63:B8:63:0D:62:D7:5A:BB:C8:AB:1E:4B:DF:B5:A8:99:B2:4D:43 CKA_CLASS CK_OBJECT_CLASS CKO_NSS_TRUST CKA_TOKEN CK_BBOOL CK_TRUE @@ -2698,7 +2698,7 @@ CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE # Subject: CN=DigiCert Global Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US # Not Valid Before: Fri Nov 10 00:00:00 2006 # Not Valid After : Mon Nov 10 00:00:00 2031 -# Fingerprint (MD5): 79:E4:A9:84:0D:7D:3A:96:D7:C0:4F:E2:43:4C:89:2E +# Fingerprint (SHA-256): 43:48:A0:E9:44:4C:78:CB:26:5E:05:8D:5E:89:44:B4:D8:4F:96:62:BD:26:DB:25:7F:89:34:A4:43:C7:01:61 # Fingerprint (SHA1): A8:98:5D:3A:65:E5:E5:C4:B2:D7:D6:6D:40:C6:DD:2F:B1:9C:54:36 CKA_CLASS CK_OBJECT_CLASS CKO_CERTIFICATE CKA_TOKEN CK_BBOOL CK_TRUE @@ -2795,13 +2795,13 @@ CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE -# Trust for Certificate "DigiCert Global Root CA" +# Trust for "DigiCert Global Root CA" # Issuer: CN=DigiCert Global Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US # Serial Number:08:3b:e0:56:90:42:46:b1:a1:75:6a:c9:59:91:c7:4a # Subject: CN=DigiCert Global Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US # Not Valid Before: Fri Nov 10 00:00:00 2006 # Not Valid After : Mon Nov 10 00:00:00 2031 -# Fingerprint (MD5): 79:E4:A9:84:0D:7D:3A:96:D7:C0:4F:E2:43:4C:89:2E +# Fingerprint (SHA-256): 43:48:A0:E9:44:4C:78:CB:26:5E:05:8D:5E:89:44:B4:D8:4F:96:62:BD:26:DB:25:7F:89:34:A4:43:C7:01:61 # Fingerprint (SHA1): A8:98:5D:3A:65:E5:E5:C4:B2:D7:D6:6D:40:C6:DD:2F:B1:9C:54:36 CKA_CLASS CK_OBJECT_CLASS CKO_NSS_TRUST CKA_TOKEN CK_BBOOL CK_TRUE @@ -2841,7 +2841,7 @@ CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE # Subject: CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US # Not Valid Before: Fri Nov 10 00:00:00 2006 # Not Valid After : Mon Nov 10 00:00:00 2031 -# Fingerprint (MD5): D4:74:DE:57:5C:39:B2:D3:9C:85:83:C5:C0:65:49:8A +# Fingerprint (SHA-256): 74:31:E5:F4:C3:C1:CE:46:90:77:4F:0B:61:E0:54:40:88:3B:A9:A0:1E:D0:0B:A6:AB:D7:80:6E:D3:B1:18:CF # Fingerprint (SHA1): 5F:B7:EE:06:33:E2:59:DB:AD:0C:4C:9A:E6:D3:8F:1A:61:C7:DC:25 CKA_CLASS CK_OBJECT_CLASS CKO_CERTIFICATE CKA_TOKEN CK_BBOOL CK_TRUE @@ -2939,13 +2939,13 @@ CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE -# Trust for Certificate "DigiCert High Assurance EV Root CA" +# Trust for "DigiCert High Assurance EV Root CA" # Issuer: CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US # Serial Number:02:ac:5c:26:6a:0b:40:9b:8f:0b:79:f2:ae:46:25:77 # Subject: CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US # Not Valid Before: Fri Nov 10 00:00:00 2006 # Not Valid After : Mon Nov 10 00:00:00 2031 -# Fingerprint (MD5): D4:74:DE:57:5C:39:B2:D3:9C:85:83:C5:C0:65:49:8A +# Fingerprint (SHA-256): 74:31:E5:F4:C3:C1:CE:46:90:77:4F:0B:61:E0:54:40:88:3B:A9:A0:1E:D0:0B:A6:AB:D7:80:6E:D3:B1:18:CF # Fingerprint (SHA1): 5F:B7:EE:06:33:E2:59:DB:AD:0C:4C:9A:E6:D3:8F:1A:61:C7:DC:25 CKA_CLASS CK_OBJECT_CLASS CKO_NSS_TRUST CKA_TOKEN CK_BBOOL CK_TRUE @@ -2985,7 +2985,7 @@ CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE # Subject: CN=SwissSign Platinum CA - G2,O=SwissSign AG,C=CH # Not Valid Before: Wed Oct 25 08:36:00 2006 # Not Valid After : Sat Oct 25 08:36:00 2036 -# Fingerprint (MD5): C9:98:27:77:28:1E:3D:0E:15:3C:84:00:B8:85:03:E6 +# Fingerprint (SHA-256): 3B:22:2E:56:67:11:E9:92:30:0D:C0:B1:5A:B9:47:3D:AF:DE:F8:C8:4D:0C:EF:7D:33:17:B4:C1:82:1D:14:36 # Fingerprint (SHA1): 56:E0:FA:C0:3B:8F:18:23:55:18:E5:D3:11:CA:E8:C2:43:31:AB:66 CKA_CLASS CK_OBJECT_CLASS CKO_CERTIFICATE CKA_TOKEN CK_BBOOL CK_TRUE @@ -3110,13 +3110,13 @@ CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE -# Trust for Certificate "SwissSign Platinum CA - G2" +# Trust for "SwissSign Platinum CA - G2" # Issuer: CN=SwissSign Platinum CA - G2,O=SwissSign AG,C=CH # Serial Number:4e:b2:00:67:0c:03:5d:4f # Subject: CN=SwissSign Platinum CA - G2,O=SwissSign AG,C=CH # Not Valid Before: Wed Oct 25 08:36:00 2006 # Not Valid After : Sat Oct 25 08:36:00 2036 -# Fingerprint (MD5): C9:98:27:77:28:1E:3D:0E:15:3C:84:00:B8:85:03:E6 +# Fingerprint (SHA-256): 3B:22:2E:56:67:11:E9:92:30:0D:C0:B1:5A:B9:47:3D:AF:DE:F8:C8:4D:0C:EF:7D:33:17:B4:C1:82:1D:14:36 # Fingerprint (SHA1): 56:E0:FA:C0:3B:8F:18:23:55:18:E5:D3:11:CA:E8:C2:43:31:AB:66 CKA_CLASS CK_OBJECT_CLASS CKO_NSS_TRUST CKA_TOKEN CK_BBOOL CK_TRUE @@ -3153,7 +3153,7 @@ CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE # Subject: CN=SwissSign Gold CA - G2,O=SwissSign AG,C=CH # Not Valid Before: Wed Oct 25 08:30:35 2006 # Not Valid After : Sat Oct 25 08:30:35 2036 -# Fingerprint (MD5): 24:77:D9:A8:91:D1:3B:FA:88:2D:C2:FF:F8:CD:33:93 +# Fingerprint (SHA-256): 62:DD:0B:E9:B9:F5:0A:16:3E:A0:F8:E7:5C:05:3B:1E:CA:57:EA:55:C8:68:8F:64:7C:68:81:F2:C8:35:7B:95 # Fingerprint (SHA1): D8:C5:38:8A:B7:30:1B:1B:6E:D4:7A:E6:45:25:3A:6F:9F:1A:27:61 CKA_CLASS CK_OBJECT_CLASS CKO_CERTIFICATE CKA_TOKEN CK_BBOOL CK_TRUE @@ -3277,13 +3277,13 @@ CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE -# Trust for Certificate "SwissSign Gold CA - G2" +# Trust for "SwissSign Gold CA - G2" # Issuer: CN=SwissSign Gold CA - G2,O=SwissSign AG,C=CH # Serial Number:00:bb:40:1c:43:f5:5e:4f:b0 # Subject: CN=SwissSign Gold CA - G2,O=SwissSign AG,C=CH # Not Valid Before: Wed Oct 25 08:30:35 2006 # Not Valid After : Sat Oct 25 08:30:35 2036 -# Fingerprint (MD5): 24:77:D9:A8:91:D1:3B:FA:88:2D:C2:FF:F8:CD:33:93 +# Fingerprint (SHA-256): 62:DD:0B:E9:B9:F5:0A:16:3E:A0:F8:E7:5C:05:3B:1E:CA:57:EA:55:C8:68:8F:64:7C:68:81:F2:C8:35:7B:95 # Fingerprint (SHA1): D8:C5:38:8A:B7:30:1B:1B:6E:D4:7A:E6:45:25:3A:6F:9F:1A:27:61 CKA_CLASS CK_OBJECT_CLASS CKO_NSS_TRUST CKA_TOKEN CK_BBOOL CK_TRUE @@ -3320,7 +3320,7 @@ CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE # Subject: CN=SwissSign Silver CA - G2,O=SwissSign AG,C=CH # Not Valid Before: Wed Oct 25 08:32:46 2006 # Not Valid After : Sat Oct 25 08:32:46 2036 -# Fingerprint (MD5): E0:06:A1:C9:7D:CF:C9:FC:0D:C0:56:75:96:D8:62:13 +# Fingerprint (SHA-256): BE:6C:4D:A2:BB:B9:BA:59:B6:F3:93:97:68:37:42:46:C3:C0:05:99:3F:A9:8F:02:0D:1D:ED:BE:D4:8A:81:D5 # Fingerprint (SHA1): 9B:AA:E5:9F:56:EE:21:CB:43:5A:BE:25:93:DF:A7:F0:40:D1:1D:CB CKA_CLASS CK_OBJECT_CLASS CKO_CERTIFICATE CKA_TOKEN CK_BBOOL CK_TRUE @@ -3445,13 +3445,13 @@ CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE -# Trust for Certificate "SwissSign Silver CA - G2" +# Trust for "SwissSign Silver CA - G2" # Issuer: CN=SwissSign Silver CA - G2,O=SwissSign AG,C=CH # Serial Number:4f:1b:d4:2f:54:bb:2f:4b # Subject: CN=SwissSign Silver CA - G2,O=SwissSign AG,C=CH # Not Valid Before: Wed Oct 25 08:32:46 2006 # Not Valid After : Sat Oct 25 08:32:46 2036 -# Fingerprint (MD5): E0:06:A1:C9:7D:CF:C9:FC:0D:C0:56:75:96:D8:62:13 +# Fingerprint (SHA-256): BE:6C:4D:A2:BB:B9:BA:59:B6:F3:93:97:68:37:42:46:C3:C0:05:99:3F:A9:8F:02:0D:1D:ED:BE:D4:8A:81:D5 # Fingerprint (SHA1): 9B:AA:E5:9F:56:EE:21:CB:43:5A:BE:25:93:DF:A7:F0:40:D1:1D:CB CKA_CLASS CK_OBJECT_CLASS CKO_NSS_TRUST CKA_TOKEN CK_BBOOL CK_TRUE @@ -3488,7 +3488,7 @@ CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE # Subject: CN=SecureTrust CA,O=SecureTrust Corporation,C=US # Not Valid Before: Tue Nov 07 19:31:18 2006 # Not Valid After : Mon Dec 31 19:40:55 2029 -# Fingerprint (MD5): DC:32:C3:A7:6D:25:57:C7:68:09:9D:EA:2D:A9:A2:D1 +# Fingerprint (SHA-256): F1:C1:B5:0A:E5:A2:0D:D8:03:0E:C9:F6:BC:24:82:3D:D3:67:B5:25:57:59:B4:E7:1B:61:FC:E9:F7:37:5D:73 # Fingerprint (SHA1): 87:82:C6:C3:04:35:3B:CF:D2:96:92:D2:59:3E:7D:44:D9:34:FF:11 CKA_CLASS CK_OBJECT_CLASS CKO_CERTIFICATE CKA_TOKEN CK_BBOOL CK_TRUE @@ -3581,13 +3581,13 @@ CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE -# Trust for Certificate "SecureTrust CA" +# Trust for "SecureTrust CA" # Issuer: CN=SecureTrust CA,O=SecureTrust Corporation,C=US # Serial Number:0c:f0:8e:5c:08:16:a5:ad:42:7f:f0:eb:27:18:59:d0 # Subject: CN=SecureTrust CA,O=SecureTrust Corporation,C=US # Not Valid Before: Tue Nov 07 19:31:18 2006 # Not Valid After : Mon Dec 31 19:40:55 2029 -# Fingerprint (MD5): DC:32:C3:A7:6D:25:57:C7:68:09:9D:EA:2D:A9:A2:D1 +# Fingerprint (SHA-256): F1:C1:B5:0A:E5:A2:0D:D8:03:0E:C9:F6:BC:24:82:3D:D3:67:B5:25:57:59:B4:E7:1B:61:FC:E9:F7:37:5D:73 # Fingerprint (SHA1): 87:82:C6:C3:04:35:3B:CF:D2:96:92:D2:59:3E:7D:44:D9:34:FF:11 CKA_CLASS CK_OBJECT_CLASS CKO_NSS_TRUST CKA_TOKEN CK_BBOOL CK_TRUE @@ -3625,7 +3625,7 @@ CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE # Subject: CN=Secure Global CA,O=SecureTrust Corporation,C=US # Not Valid Before: Tue Nov 07 19:42:28 2006 # Not Valid After : Mon Dec 31 19:52:06 2029 -# Fingerprint (MD5): CF:F4:27:0D:D4:ED:DC:65:16:49:6D:3D:DA:BF:6E:DE +# Fingerprint (SHA-256): 42:00:F5:04:3A:C8:59:0E:BB:52:7D:20:9E:D1:50:30:29:FB:CB:D4:1C:A1:B5:06:EC:27:F1:5A:DE:7D:AC:69 # Fingerprint (SHA1): 3A:44:73:5A:E5:81:90:1F:24:86:61:46:1E:3B:9C:C4:5F:F5:3A:1B CKA_CLASS CK_OBJECT_CLASS CKO_CERTIFICATE CKA_TOKEN CK_BBOOL CK_TRUE @@ -3718,13 +3718,13 @@ CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE -# Trust for Certificate "Secure Global CA" +# Trust for "Secure Global CA" # Issuer: CN=Secure Global CA,O=SecureTrust Corporation,C=US # Serial Number:07:56:22:a4:e8:d4:8a:89:4d:f4:13:c8:f0:f8:ea:a5 # Subject: CN=Secure Global CA,O=SecureTrust Corporation,C=US # Not Valid Before: Tue Nov 07 19:42:28 2006 # Not Valid After : Mon Dec 31 19:52:06 2029 -# Fingerprint (MD5): CF:F4:27:0D:D4:ED:DC:65:16:49:6D:3D:DA:BF:6E:DE +# Fingerprint (SHA-256): 42:00:F5:04:3A:C8:59:0E:BB:52:7D:20:9E:D1:50:30:29:FB:CB:D4:1C:A1:B5:06:EC:27:F1:5A:DE:7D:AC:69 # Fingerprint (SHA1): 3A:44:73:5A:E5:81:90:1F:24:86:61:46:1E:3B:9C:C4:5F:F5:3A:1B CKA_CLASS CK_OBJECT_CLASS CKO_NSS_TRUST CKA_TOKEN CK_BBOOL CK_TRUE @@ -3762,7 +3762,7 @@ CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE # Subject: CN=COMODO Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB # Not Valid Before: Fri Dec 01 00:00:00 2006 # Not Valid After : Mon Dec 31 23:59:59 2029 -# Fingerprint (MD5): 5C:48:DC:F7:42:72:EC:56:94:6D:1C:CC:71:35:80:75 +# Fingerprint (SHA-256): 0C:2C:D6:3D:F7:80:6F:A3:99:ED:E8:09:11:6B:57:5B:F8:79:89:F0:65:18:F9:80:8C:86:05:03:17:8B:AF:66 # Fingerprint (SHA1): 66:31:BF:9E:F7:4F:9E:B6:C9:D5:A6:0C:BA:6A:BE:D1:F7:BD:EF:7B CKA_CLASS CK_OBJECT_CLASS CKO_CERTIFICATE CKA_TOKEN CK_BBOOL CK_TRUE @@ -3870,13 +3870,13 @@ CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE -# Trust for Certificate "COMODO Certification Authority" +# Trust for "COMODO Certification Authority" # Issuer: CN=COMODO Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB # Serial Number:4e:81:2d:8a:82:65:e0:0b:02:ee:3e:35:02:46:e5:3d # Subject: CN=COMODO Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB # Not Valid Before: Fri Dec 01 00:00:00 2006 # Not Valid After : Mon Dec 31 23:59:59 2029 -# Fingerprint (MD5): 5C:48:DC:F7:42:72:EC:56:94:6D:1C:CC:71:35:80:75 +# Fingerprint (SHA-256): 0C:2C:D6:3D:F7:80:6F:A3:99:ED:E8:09:11:6B:57:5B:F8:79:89:F0:65:18:F9:80:8C:86:05:03:17:8B:AF:66 # Fingerprint (SHA1): 66:31:BF:9E:F7:4F:9E:B6:C9:D5:A6:0C:BA:6A:BE:D1:F7:BD:EF:7B CKA_CLASS CK_OBJECT_CLASS CKO_NSS_TRUST CKA_TOKEN CK_BBOOL CK_TRUE @@ -3918,7 +3918,7 @@ CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE # Subject: CN=Network Solutions Certificate Authority,O=Network Solutions L.L.C.,C=US # Not Valid Before: Fri Dec 01 00:00:00 2006 # Not Valid After : Mon Dec 31 23:59:59 2029 -# Fingerprint (MD5): D3:F3:A6:16:C0:FA:6B:1D:59:B1:2D:96:4D:0E:11:2E +# Fingerprint (SHA-256): 15:F0:BA:00:A3:AC:7A:F3:AC:88:4C:07:2B:10:11:A0:77:BD:77:C0:97:F4:01:64:B2:F8:59:8A:BD:83:86:0C # Fingerprint (SHA1): 74:F8:A3:C3:EF:E7:B3:90:06:4B:83:90:3C:21:64:60:20:E5:DF:CE CKA_CLASS CK_OBJECT_CLASS CKO_CERTIFICATE CKA_TOKEN CK_BBOOL CK_TRUE @@ -4018,13 +4018,13 @@ CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE -# Trust for Certificate "Network Solutions Certificate Authority" +# Trust for "Network Solutions Certificate Authority" # Issuer: CN=Network Solutions Certificate Authority,O=Network Solutions L.L.C.,C=US # Serial Number:57:cb:33:6f:c2:5c:16:e6:47:16:17:e3:90:31:68:e0 # Subject: CN=Network Solutions Certificate Authority,O=Network Solutions L.L.C.,C=US # Not Valid Before: Fri Dec 01 00:00:00 2006 # Not Valid After : Mon Dec 31 23:59:59 2029 -# Fingerprint (MD5): D3:F3:A6:16:C0:FA:6B:1D:59:B1:2D:96:4D:0E:11:2E +# Fingerprint (SHA-256): 15:F0:BA:00:A3:AC:7A:F3:AC:88:4C:07:2B:10:11:A0:77:BD:77:C0:97:F4:01:64:B2:F8:59:8A:BD:83:86:0C # Fingerprint (SHA1): 74:F8:A3:C3:EF:E7:B3:90:06:4B:83:90:3C:21:64:60:20:E5:DF:CE CKA_CLASS CK_OBJECT_CLASS CKO_NSS_TRUST CKA_TOKEN CK_BBOOL CK_TRUE @@ -4064,7 +4064,7 @@ CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE # Subject: CN=COMODO ECC Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB # Not Valid Before: Thu Mar 06 00:00:00 2008 # Not Valid After : Mon Jan 18 23:59:59 2038 -# Fingerprint (MD5): 7C:62:FF:74:9D:31:53:5E:68:4A:D5:78:AA:1E:BF:23 +# Fingerprint (SHA-256): 17:93:92:7A:06:14:54:97:89:AD:CE:2F:8F:34:F7:F0:B6:6D:0F:3A:E3:A3:B8:4D:21:EC:15:DB:BA:4F:AD:C7 # Fingerprint (SHA1): 9F:74:4E:9F:2B:4D:BA:EC:0F:31:2C:50:B6:56:3B:8E:2D:93:C3:11 CKA_CLASS CK_OBJECT_CLASS CKO_CERTIFICATE CKA_TOKEN CK_BBOOL CK_TRUE @@ -4146,13 +4146,13 @@ CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE -# Trust for Certificate "COMODO ECC Certification Authority" +# Trust for "COMODO ECC Certification Authority" # Issuer: CN=COMODO ECC Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB # Serial Number:1f:47:af:aa:62:00:70:50:54:4c:01:9e:9b:63:99:2a # Subject: CN=COMODO ECC Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB # Not Valid Before: Thu Mar 06 00:00:00 2008 # Not Valid After : Mon Jan 18 23:59:59 2038 -# Fingerprint (MD5): 7C:62:FF:74:9D:31:53:5E:68:4A:D5:78:AA:1E:BF:23 +# Fingerprint (SHA-256): 17:93:92:7A:06:14:54:97:89:AD:CE:2F:8F:34:F7:F0:B6:6D:0F:3A:E3:A3:B8:4D:21:EC:15:DB:BA:4F:AD:C7 # Fingerprint (SHA1): 9F:74:4E:9F:2B:4D:BA:EC:0F:31:2C:50:B6:56:3B:8E:2D:93:C3:11 CKA_CLASS CK_OBJECT_CLASS CKO_NSS_TRUST CKA_TOKEN CK_BBOOL CK_TRUE @@ -4194,7 +4194,7 @@ CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE # Subject: CN=OISTE WISeKey Global Root GA CA,OU=OISTE Foundation Endorsed,OU=Copyright (c) 2005,O=WISeKey,C=CH # Not Valid Before: Sun Dec 11 16:03:44 2005 # Not Valid After : Fri Dec 11 16:09:51 2037 -# Fingerprint (MD5): BC:6C:51:33:A7:E9:D3:66:63:54:15:72:1B:21:92:93 +# Fingerprint (SHA-256): 41:C9:23:86:6A:B4:CA:D6:B7:AD:57:80:81:58:2E:02:07:97:A6:CB:DF:4F:FF:78:CE:83:96:B3:89:37:D7:F5 # Fingerprint (SHA1): 59:22:A1:E1:5A:EA:16:35:21:F8:98:39:6A:46:46:B0:44:1B:0F:A9 CKA_CLASS CK_OBJECT_CLASS CKO_CERTIFICATE CKA_TOKEN CK_BBOOL CK_TRUE @@ -4299,13 +4299,13 @@ CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE -# Trust for Certificate "OISTE WISeKey Global Root GA CA" +# Trust for "OISTE WISeKey Global Root GA CA" # Issuer: CN=OISTE WISeKey Global Root GA CA,OU=OISTE Foundation Endorsed,OU=Copyright (c) 2005,O=WISeKey,C=CH # Serial Number:41:3d:72:c7:f4:6b:1f:81:43:7d:f1:d2:28:54:df:9a # Subject: CN=OISTE WISeKey Global Root GA CA,OU=OISTE Foundation Endorsed,OU=Copyright (c) 2005,O=WISeKey,C=CH # Not Valid Before: Sun Dec 11 16:03:44 2005 # Not Valid After : Fri Dec 11 16:09:51 2037 -# Fingerprint (MD5): BC:6C:51:33:A7:E9:D3:66:63:54:15:72:1B:21:92:93 +# Fingerprint (SHA-256): 41:C9:23:86:6A:B4:CA:D6:B7:AD:57:80:81:58:2E:02:07:97:A6:CB:DF:4F:FF:78:CE:83:96:B3:89:37:D7:F5 # Fingerprint (SHA1): 59:22:A1:E1:5A:EA:16:35:21:F8:98:39:6A:46:46:B0:44:1B:0F:A9 CKA_CLASS CK_OBJECT_CLASS CKO_NSS_TRUST CKA_TOKEN CK_BBOOL CK_TRUE @@ -4347,7 +4347,7 @@ CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE # Subject: CN=Certigna,O=Dhimyotis,C=FR # Not Valid Before: Fri Jun 29 15:13:05 2007 # Not Valid After : Tue Jun 29 15:13:05 2027 -# Fingerprint (MD5): AB:57:A6:5B:7D:42:82:19:B5:D8:58:26:28:5E:FD:FF +# Fingerprint (SHA-256): E3:B6:A2:DB:2E:D7:CE:48:84:2F:7A:C5:32:41:C7:B7:1D:54:14:4B:FB:40:C1:1F:3F:1D:0B:42:F5:EE:A1:2D # Fingerprint (SHA1): B1:2E:13:63:45:86:A4:6F:1A:B2:60:68:37:58:2D:C4:AC:FD:94:97 CKA_CLASS CK_OBJECT_CLASS CKO_CERTIFICATE CKA_TOKEN CK_BBOOL CK_TRUE @@ -4436,13 +4436,13 @@ CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE -# Trust for Certificate "Certigna" +# Trust for "Certigna" # Issuer: CN=Certigna,O=Dhimyotis,C=FR # Serial Number:00:fe:dc:e3:01:0f:c9:48:ff # Subject: CN=Certigna,O=Dhimyotis,C=FR # Not Valid Before: Fri Jun 29 15:13:05 2007 # Not Valid After : Tue Jun 29 15:13:05 2027 -# Fingerprint (MD5): AB:57:A6:5B:7D:42:82:19:B5:D8:58:26:28:5E:FD:FF +# Fingerprint (SHA-256): E3:B6:A2:DB:2E:D7:CE:48:84:2F:7A:C5:32:41:C7:B7:1D:54:14:4B:FB:40:C1:1F:3F:1D:0B:42:F5:EE:A1:2D # Fingerprint (SHA1): B1:2E:13:63:45:86:A4:6F:1A:B2:60:68:37:58:2D:C4:AC:FD:94:97 CKA_CLASS CK_OBJECT_CLASS CKO_NSS_TRUST CKA_TOKEN CK_BBOOL CK_TRUE @@ -4478,7 +4478,7 @@ CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE # Subject: OU=ePKI Root Certification Authority,O="Chunghwa Telecom Co., Ltd.",C=TW # Not Valid Before: Mon Dec 20 02:31:27 2004 # Not Valid After : Wed Dec 20 02:31:27 2034 -# Fingerprint (MD5): 1B:2E:00:CA:26:06:90:3D:AD:FE:6F:15:68:D3:6B:B3 +# Fingerprint (SHA-256): C0:A6:F4:DC:63:A2:4B:FD:CF:54:EF:2A:6A:08:2A:0A:72:DE:35:80:3E:2F:F5:FF:52:7A:E5:D8:72:06:DF:D5 # Fingerprint (SHA1): 67:65:0D:F1:7E:8E:7E:5B:82:40:A4:F4:56:4B:CF:E2:3D:69:C6:F0 CKA_CLASS CK_OBJECT_CLASS CKO_CERTIFICATE CKA_TOKEN CK_BBOOL CK_TRUE @@ -4605,13 +4605,13 @@ CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE -# Trust for Certificate "ePKI Root Certification Authority" +# Trust for "ePKI Root Certification Authority" # Issuer: OU=ePKI Root Certification Authority,O="Chunghwa Telecom Co., Ltd.",C=TW # Serial Number:15:c8:bd:65:47:5c:af:b8:97:00:5e:e4:06:d2:bc:9d # Subject: OU=ePKI Root Certification Authority,O="Chunghwa Telecom Co., Ltd.",C=TW # Not Valid Before: Mon Dec 20 02:31:27 2004 # Not Valid After : Wed Dec 20 02:31:27 2034 -# Fingerprint (MD5): 1B:2E:00:CA:26:06:90:3D:AD:FE:6F:15:68:D3:6B:B3 +# Fingerprint (SHA-256): C0:A6:F4:DC:63:A2:4B:FD:CF:54:EF:2A:6A:08:2A:0A:72:DE:35:80:3E:2F:F5:FF:52:7A:E5:D8:72:06:DF:D5 # Fingerprint (SHA1): 67:65:0D:F1:7E:8E:7E:5B:82:40:A4:F4:56:4B:CF:E2:3D:69:C6:F0 CKA_CLASS CK_OBJECT_CLASS CKO_NSS_TRUST CKA_TOKEN CK_BBOOL CK_TRUE @@ -4650,7 +4650,7 @@ CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE # Subject: OU=certSIGN ROOT CA,O=certSIGN,C=RO # Not Valid Before: Tue Jul 04 17:20:04 2006 # Not Valid After : Fri Jul 04 17:20:04 2031 -# Fingerprint (MD5): 18:98:C0:D6:E9:3A:FC:F9:B0:F5:0C:F7:4B:01:44:17 +# Fingerprint (SHA-256): EA:A9:62:C4:FA:4A:6B:AF:EB:E4:15:19:6D:35:1C:CD:88:8D:4F:53:F3:FA:8A:E6:D7:C4:66:A9:4E:60:42:BB # Fingerprint (SHA1): FA:B7:EE:36:97:26:62:FB:2D:B0:2A:F6:BF:03:FD:E8:7C:4B:2F:9B CKA_CLASS CK_OBJECT_CLASS CKO_CERTIFICATE CKA_TOKEN CK_BBOOL CK_TRUE @@ -4732,13 +4732,13 @@ CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE -# Trust for Certificate "certSIGN ROOT CA" +# Trust for "certSIGN ROOT CA" # Issuer: OU=certSIGN ROOT CA,O=certSIGN,C=RO # Serial Number:20:06:05:16:70:02 # Subject: OU=certSIGN ROOT CA,O=certSIGN,C=RO # Not Valid Before: Tue Jul 04 17:20:04 2006 # Not Valid After : Fri Jul 04 17:20:04 2031 -# Fingerprint (MD5): 18:98:C0:D6:E9:3A:FC:F9:B0:F5:0C:F7:4B:01:44:17 +# Fingerprint (SHA-256): EA:A9:62:C4:FA:4A:6B:AF:EB:E4:15:19:6D:35:1C:CD:88:8D:4F:53:F3:FA:8A:E6:D7:C4:66:A9:4E:60:42:BB # Fingerprint (SHA1): FA:B7:EE:36:97:26:62:FB:2D:B0:2A:F6:BF:03:FD:E8:7C:4B:2F:9B CKA_CLASS CK_OBJECT_CLASS CKO_NSS_TRUST CKA_TOKEN CK_BBOOL CK_TRUE @@ -4774,7 +4774,7 @@ CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE # Subject: CN=NetLock Arany (Class Gold) F..tan..s..tv..ny,OU=Tan..s..tv..nykiad..k (Certification Services),O=NetLock Kft.,L=Budapest,C=HU # Not Valid Before: Thu Dec 11 15:08:21 2008 # Not Valid After : Wed Dec 06 15:08:21 2028 -# Fingerprint (MD5): C5:A1:B7:FF:73:DD:D6:D7:34:32:18:DF:FC:3C:AD:88 +# Fingerprint (SHA-256): 6C:61:DA:C3:A2:DE:F0:31:50:6B:E0:36:D2:A6:FE:40:19:94:FB:D1:3D:F9:C8:D4:66:59:92:74:C4:46:EC:98 # Fingerprint (SHA1): 06:08:3F:59:3F:15:A1:04:A0:69:A4:6B:A9:03:D0:06:B7:97:09:91 CKA_CLASS CK_OBJECT_CLASS CKO_CERTIFICATE CKA_TOKEN CK_BBOOL CK_TRUE @@ -4884,13 +4884,13 @@ CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE -# Trust for Certificate "NetLock Arany (Class Gold) Főtanúsítvány" +# Trust for "NetLock Arany (Class Gold) Főtanúsítvány" # Issuer: CN=NetLock Arany (Class Gold) F..tan..s..tv..ny,OU=Tan..s..tv..nykiad..k (Certification Services),O=NetLock Kft.,L=Budapest,C=HU # Serial Number:49:41:2c:e4:00:10 # Subject: CN=NetLock Arany (Class Gold) F..tan..s..tv..ny,OU=Tan..s..tv..nykiad..k (Certification Services),O=NetLock Kft.,L=Budapest,C=HU # Not Valid Before: Thu Dec 11 15:08:21 2008 # Not Valid After : Wed Dec 06 15:08:21 2028 -# Fingerprint (MD5): C5:A1:B7:FF:73:DD:D6:D7:34:32:18:DF:FC:3C:AD:88 +# Fingerprint (SHA-256): 6C:61:DA:C3:A2:DE:F0:31:50:6B:E0:36:D2:A6:FE:40:19:94:FB:D1:3D:F9:C8:D4:66:59:92:74:C4:46:EC:98 # Fingerprint (SHA1): 06:08:3F:59:3F:15:A1:04:A0:69:A4:6B:A9:03:D0:06:B7:97:09:91 CKA_CLASS CK_OBJECT_CLASS CKO_NSS_TRUST CKA_TOKEN CK_BBOOL CK_TRUE @@ -4933,7 +4933,7 @@ CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE # Subject: CN=Hongkong Post Root CA 1,O=Hongkong Post,C=HK # Not Valid Before: Thu May 15 05:13:14 2003 # Not Valid After : Mon May 15 04:52:29 2023 -# Fingerprint (MD5): A8:0D:6F:39:78:B9:43:6D:77:42:6D:98:5A:CC:23:CA +# Fingerprint (SHA-256): F9:E6:7D:33:6C:51:00:2A:C0:54:C6:32:02:2D:66:DD:A2:E7:E3:FF:F1:0A:D0:61:ED:31:D8:BB:B4:10:CF:B2 # Fingerprint (SHA1): D6:DA:A8:20:8D:09:D2:15:4D:24:B5:2F:CB:34:6E:B2:58:B2:8A:58 CKA_CLASS CK_OBJECT_CLASS CKO_CERTIFICATE CKA_TOKEN CK_BBOOL CK_TRUE @@ -5017,13 +5017,13 @@ CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE -# Trust for Certificate "Hongkong Post Root CA 1" +# Trust for "Hongkong Post Root CA 1" # Issuer: CN=Hongkong Post Root CA 1,O=Hongkong Post,C=HK # Serial Number: 1000 (0x3e8) # Subject: CN=Hongkong Post Root CA 1,O=Hongkong Post,C=HK # Not Valid Before: Thu May 15 05:13:14 2003 # Not Valid After : Mon May 15 04:52:29 2023 -# Fingerprint (MD5): A8:0D:6F:39:78:B9:43:6D:77:42:6D:98:5A:CC:23:CA +# Fingerprint (SHA-256): F9:E6:7D:33:6C:51:00:2A:C0:54:C6:32:02:2D:66:DD:A2:E7:E3:FF:F1:0A:D0:61:ED:31:D8:BB:B4:10:CF:B2 # Fingerprint (SHA1): D6:DA:A8:20:8D:09:D2:15:4D:24:B5:2F:CB:34:6E:B2:58:B2:8A:58 CKA_CLASS CK_OBJECT_CLASS CKO_NSS_TRUST CKA_TOKEN CK_BBOOL CK_TRUE @@ -5060,7 +5060,7 @@ CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE # Subject: CN=SecureSign RootCA11,O="Japan Certification Services, Inc.",C=JP # Not Valid Before: Wed Apr 08 04:56:47 2009 # Not Valid After : Sun Apr 08 04:56:47 2029 -# Fingerprint (MD5): B7:52:74:E2:92:B4:80:93:F2:75:E4:CC:D7:F2:EA:26 +# Fingerprint (SHA-256): BF:0F:EE:FB:9E:3A:58:1A:D5:F9:E9:DB:75:89:98:57:43:D2:61:08:5C:4D:31:4F:6F:5D:72:59:AA:42:16:12 # Fingerprint (SHA1): 3B:C4:9F:48:F8:F3:73:A0:9C:1E:BD:F8:5B:B1:C3:65:C7:D8:11:B3 CKA_CLASS CK_OBJECT_CLASS CKO_CERTIFICATE CKA_TOKEN CK_BBOOL CK_TRUE @@ -5150,13 +5150,13 @@ CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE -# Trust for Certificate "SecureSign RootCA11" +# Trust for "SecureSign RootCA11" # Issuer: CN=SecureSign RootCA11,O="Japan Certification Services, Inc.",C=JP # Serial Number: 1 (0x1) # Subject: CN=SecureSign RootCA11,O="Japan Certification Services, Inc.",C=JP # Not Valid Before: Wed Apr 08 04:56:47 2009 # Not Valid After : Sun Apr 08 04:56:47 2029 -# Fingerprint (MD5): B7:52:74:E2:92:B4:80:93:F2:75:E4:CC:D7:F2:EA:26 +# Fingerprint (SHA-256): BF:0F:EE:FB:9E:3A:58:1A:D5:F9:E9:DB:75:89:98:57:43:D2:61:08:5C:4D:31:4F:6F:5D:72:59:AA:42:16:12 # Fingerprint (SHA1): 3B:C4:9F:48:F8:F3:73:A0:9C:1E:BD:F8:5B:B1:C3:65:C7:D8:11:B3 CKA_CLASS CK_OBJECT_CLASS CKO_NSS_TRUST CKA_TOKEN CK_BBOOL CK_TRUE @@ -5194,7 +5194,7 @@ CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE # Subject: E=info@e-szigno.hu,CN=Microsec e-Szigno Root CA 2009,O=Microsec Ltd.,L=Budapest,C=HU # Not Valid Before: Tue Jun 16 11:30:18 2009 # Not Valid After : Sun Dec 30 11:30:18 2029 -# Fingerprint (MD5): F8:49:F4:03:BC:44:2D:83:BE:48:69:7D:29:64:FC:B1 +# Fingerprint (SHA-256): 3C:5F:81:FE:A5:FA:B8:2C:64:BF:A2:EA:EC:AF:CD:E8:E0:77:FC:86:20:A7:CA:E5:37:16:3D:F3:6E:DB:F3:78 # Fingerprint (SHA1): 89:DF:74:FE:5C:F4:0F:4A:80:F9:E3:37:7D:54:DA:91:E1:01:31:8E CKA_CLASS CK_OBJECT_CLASS CKO_CERTIFICATE CKA_TOKEN CK_BBOOL CK_TRUE @@ -5299,13 +5299,13 @@ CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE -# Trust for Certificate "Microsec e-Szigno Root CA 2009" +# Trust for "Microsec e-Szigno Root CA 2009" # Issuer: E=info@e-szigno.hu,CN=Microsec e-Szigno Root CA 2009,O=Microsec Ltd.,L=Budapest,C=HU # Serial Number:00:c2:7e:43:04:4e:47:3f:19 # Subject: E=info@e-szigno.hu,CN=Microsec e-Szigno Root CA 2009,O=Microsec Ltd.,L=Budapest,C=HU # Not Valid Before: Tue Jun 16 11:30:18 2009 # Not Valid After : Sun Dec 30 11:30:18 2029 -# Fingerprint (MD5): F8:49:F4:03:BC:44:2D:83:BE:48:69:7D:29:64:FC:B1 +# Fingerprint (SHA-256): 3C:5F:81:FE:A5:FA:B8:2C:64:BF:A2:EA:EC:AF:CD:E8:E0:77:FC:86:20:A7:CA:E5:37:16:3D:F3:6E:DB:F3:78 # Fingerprint (SHA1): 89:DF:74:FE:5C:F4:0F:4A:80:F9:E3:37:7D:54:DA:91:E1:01:31:8E CKA_CLASS CK_OBJECT_CLASS CKO_NSS_TRUST CKA_TOKEN CK_BBOOL CK_TRUE @@ -5346,7 +5346,7 @@ CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE # Subject: CN=GlobalSign,O=GlobalSign,OU=GlobalSign Root CA - R3 # Not Valid Before: Wed Mar 18 10:00:00 2009 # Not Valid After : Sun Mar 18 10:00:00 2029 -# Fingerprint (MD5): C5:DF:B8:49:CA:05:13:55:EE:2D:BA:1A:C3:3E:B0:28 +# Fingerprint (SHA-256): CB:B5:22:D7:B7:F1:27:AD:6A:01:13:86:5B:DF:1C:D4:10:2E:7D:07:59:AF:63:5A:7C:F4:72:0D:C9:63:C5:3B # Fingerprint (SHA1): D6:9B:56:11:48:F0:1C:77:C5:45:78:C1:09:26:DF:5B:85:69:76:AD CKA_CLASS CK_OBJECT_CLASS CKO_CERTIFICATE CKA_TOKEN CK_BBOOL CK_TRUE @@ -5433,13 +5433,13 @@ CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE -# Trust for Certificate "GlobalSign Root CA - R3" +# Trust for "GlobalSign Root CA - R3" # Issuer: CN=GlobalSign,O=GlobalSign,OU=GlobalSign Root CA - R3 # Serial Number:04:00:00:00:00:01:21:58:53:08:a2 # Subject: CN=GlobalSign,O=GlobalSign,OU=GlobalSign Root CA - R3 # Not Valid Before: Wed Mar 18 10:00:00 2009 # Not Valid After : Sun Mar 18 10:00:00 2029 -# Fingerprint (MD5): C5:DF:B8:49:CA:05:13:55:EE:2D:BA:1A:C3:3E:B0:28 +# Fingerprint (SHA-256): CB:B5:22:D7:B7:F1:27:AD:6A:01:13:86:5B:DF:1C:D4:10:2E:7D:07:59:AF:63:5A:7C:F4:72:0D:C9:63:C5:3B # Fingerprint (SHA1): D6:9B:56:11:48:F0:1C:77:C5:45:78:C1:09:26:DF:5B:85:69:76:AD CKA_CLASS CK_OBJECT_CLASS CKO_NSS_TRUST CKA_TOKEN CK_BBOOL CK_TRUE @@ -5476,7 +5476,7 @@ CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE # Subject: CN=Autoridad de Certificacion Firmaprofesional CIF A62634068,C=ES # Not Valid Before: Wed May 20 08:38:15 2009 # Not Valid After : Tue Dec 31 08:38:15 2030 -# Fingerprint (MD5): 73:3A:74:7A:EC:BB:A3:96:A6:C2:E4:E2:C8:9B:C0:C3 +# Fingerprint (SHA-256): 04:04:80:28:BF:1F:28:64:D4:8F:9A:D4:D8:32:94:36:6A:82:88:56:55:3F:3B:14:30:3F:90:14:7F:5D:40:EF # Fingerprint (SHA1): AE:C5:FB:3F:C8:E1:BF:C4:E5:4F:03:07:5A:9A:E8:00:B7:F7:B6:FA CKA_CLASS CK_OBJECT_CLASS CKO_CERTIFICATE CKA_TOKEN CK_BBOOL CK_TRUE @@ -5608,13 +5608,13 @@ CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE -# Trust for Certificate "Autoridad de Certificacion Firmaprofesional CIF A62634068" +# Trust for "Autoridad de Certificacion Firmaprofesional CIF A62634068" # Issuer: CN=Autoridad de Certificacion Firmaprofesional CIF A62634068,C=ES # Serial Number:53:ec:3b:ee:fb:b2:48:5f # Subject: CN=Autoridad de Certificacion Firmaprofesional CIF A62634068,C=ES # Not Valid Before: Wed May 20 08:38:15 2009 # Not Valid After : Tue Dec 31 08:38:15 2030 -# Fingerprint (MD5): 73:3A:74:7A:EC:BB:A3:96:A6:C2:E4:E2:C8:9B:C0:C3 +# Fingerprint (SHA-256): 04:04:80:28:BF:1F:28:64:D4:8F:9A:D4:D8:32:94:36:6A:82:88:56:55:3F:3B:14:30:3F:90:14:7F:5D:40:EF # Fingerprint (SHA1): AE:C5:FB:3F:C8:E1:BF:C4:E5:4F:03:07:5A:9A:E8:00:B7:F7:B6:FA CKA_CLASS CK_OBJECT_CLASS CKO_NSS_TRUST CKA_TOKEN CK_BBOOL CK_TRUE @@ -5652,7 +5652,7 @@ CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE # Subject: CN=Izenpe.com,O=IZENPE S.A.,C=ES # Not Valid Before: Thu Dec 13 13:08:28 2007 # Not Valid After : Sun Dec 13 08:27:25 2037 -# Fingerprint (MD5): A6:B0:CD:85:80:DA:5C:50:34:A3:39:90:2F:55:67:73 +# Fingerprint (SHA-256): 25:30:CC:8E:98:32:15:02:BA:D9:6F:9B:1F:BA:1B:09:9E:2D:29:9E:0F:45:48:BB:91:4F:36:3B:C0:D4:53:1F # Fingerprint (SHA1): 2F:78:3D:25:52:18:A7:4A:65:39:71:B5:2C:A2:9C:45:15:6F:E9:19 CKA_CLASS CK_OBJECT_CLASS CKO_CERTIFICATE CKA_TOKEN CK_BBOOL CK_TRUE @@ -5779,13 +5779,13 @@ CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE -# Trust for Certificate "Izenpe.com" +# Trust for "Izenpe.com" # Issuer: CN=Izenpe.com,O=IZENPE S.A.,C=ES # Serial Number:00:b0:b7:5a:16:48:5f:bf:e1:cb:f5:8b:d7:19:e6:7d # Subject: CN=Izenpe.com,O=IZENPE S.A.,C=ES # Not Valid Before: Thu Dec 13 13:08:28 2007 # Not Valid After : Sun Dec 13 08:27:25 2037 -# Fingerprint (MD5): A6:B0:CD:85:80:DA:5C:50:34:A3:39:90:2F:55:67:73 +# Fingerprint (SHA-256): 25:30:CC:8E:98:32:15:02:BA:D9:6F:9B:1F:BA:1B:09:9E:2D:29:9E:0F:45:48:BB:91:4F:36:3B:C0:D4:53:1F # Fingerprint (SHA1): 2F:78:3D:25:52:18:A7:4A:65:39:71:B5:2C:A2:9C:45:15:6F:E9:19 CKA_CLASS CK_OBJECT_CLASS CKO_NSS_TRUST CKA_TOKEN CK_BBOOL CK_TRUE @@ -5822,7 +5822,7 @@ CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE # Subject: CN=Chambers of Commerce Root - 2008,O=AC Camerfirma S.A.,serialNumber=A82743287,L=Madrid (see current address at www.camerfirma.com/address),C=EU # Not Valid Before: Fri Aug 01 12:29:50 2008 # Not Valid After : Sat Jul 31 12:29:50 2038 -# Fingerprint (MD5): 5E:80:9E:84:5A:0E:65:0B:17:02:F3:55:18:2A:3E:D7 +# Fingerprint (SHA-256): 06:3E:4A:FA:C4:91:DF:D3:32:F3:08:9B:85:42:E9:46:17:D8:93:D7:FE:94:4E:10:A7:93:7E:E2:9D:96:93:C0 # Fingerprint (SHA1): 78:6A:74:AC:76:AB:14:7F:9C:6A:30:50:BA:9E:A8:7E:FE:9A:CE:3C CKA_CLASS CK_OBJECT_CLASS CKO_CERTIFICATE CKA_TOKEN CK_BBOOL CK_TRUE @@ -5986,13 +5986,13 @@ CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE -# Trust for Certificate "Chambers of Commerce Root - 2008" +# Trust for "Chambers of Commerce Root - 2008" # Issuer: CN=Chambers of Commerce Root - 2008,O=AC Camerfirma S.A.,serialNumber=A82743287,L=Madrid (see current address at www.camerfirma.com/address),C=EU # Serial Number:00:a3:da:42:7e:a4:b1:ae:da # Subject: CN=Chambers of Commerce Root - 2008,O=AC Camerfirma S.A.,serialNumber=A82743287,L=Madrid (see current address at www.camerfirma.com/address),C=EU # Not Valid Before: Fri Aug 01 12:29:50 2008 # Not Valid After : Sat Jul 31 12:29:50 2038 -# Fingerprint (MD5): 5E:80:9E:84:5A:0E:65:0B:17:02:F3:55:18:2A:3E:D7 +# Fingerprint (SHA-256): 06:3E:4A:FA:C4:91:DF:D3:32:F3:08:9B:85:42:E9:46:17:D8:93:D7:FE:94:4E:10:A7:93:7E:E2:9D:96:93:C0 # Fingerprint (SHA1): 78:6A:74:AC:76:AB:14:7F:9C:6A:30:50:BA:9E:A8:7E:FE:9A:CE:3C CKA_CLASS CK_OBJECT_CLASS CKO_NSS_TRUST CKA_TOKEN CK_BBOOL CK_TRUE @@ -6036,7 +6036,7 @@ CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE # Subject: CN=Global Chambersign Root - 2008,O=AC Camerfirma S.A.,serialNumber=A82743287,L=Madrid (see current address at www.camerfirma.com/address),C=EU # Not Valid Before: Fri Aug 01 12:31:40 2008 # Not Valid After : Sat Jul 31 12:31:40 2038 -# Fingerprint (MD5): 9E:80:FF:78:01:0C:2E:C1:36:BD:FE:96:90:6E:08:F3 +# Fingerprint (SHA-256): 13:63:35:43:93:34:A7:69:80:16:A0:D3:24:DE:72:28:4E:07:9D:7B:52:20:BB:8F:BD:74:78:16:EE:BE:BA:CA # Fingerprint (SHA1): 4A:BD:EE:EC:95:0D:35:9C:89:AE:C7:52:A1:2C:5B:29:F6:D6:AA:0C CKA_CLASS CK_OBJECT_CLASS CKO_CERTIFICATE CKA_TOKEN CK_BBOOL CK_TRUE @@ -6197,13 +6197,13 @@ CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE -# Trust for Certificate "Global Chambersign Root - 2008" +# Trust for "Global Chambersign Root - 2008" # Issuer: CN=Global Chambersign Root - 2008,O=AC Camerfirma S.A.,serialNumber=A82743287,L=Madrid (see current address at www.camerfirma.com/address),C=EU # Serial Number:00:c9:cd:d3:e9:d5:7d:23:ce # Subject: CN=Global Chambersign Root - 2008,O=AC Camerfirma S.A.,serialNumber=A82743287,L=Madrid (see current address at www.camerfirma.com/address),C=EU # Not Valid Before: Fri Aug 01 12:31:40 2008 # Not Valid After : Sat Jul 31 12:31:40 2038 -# Fingerprint (MD5): 9E:80:FF:78:01:0C:2E:C1:36:BD:FE:96:90:6E:08:F3 +# Fingerprint (SHA-256): 13:63:35:43:93:34:A7:69:80:16:A0:D3:24:DE:72:28:4E:07:9D:7B:52:20:BB:8F:BD:74:78:16:EE:BE:BA:CA # Fingerprint (SHA1): 4A:BD:EE:EC:95:0D:35:9C:89:AE:C7:52:A1:2C:5B:29:F6:D6:AA:0C CKA_CLASS CK_OBJECT_CLASS CKO_NSS_TRUST CKA_TOKEN CK_BBOOL CK_TRUE @@ -6246,7 +6246,7 @@ CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE # Subject: CN=Go Daddy Root Certificate Authority - G2,O="GoDaddy.com, Inc.",L=Scottsdale,ST=Arizona,C=US # Not Valid Before: Tue Sep 01 00:00:00 2009 # Not Valid After : Thu Dec 31 23:59:59 2037 -# Fingerprint (MD5): 80:3A:BC:22:C1:E6:FB:8D:9B:3B:27:4A:32:1B:9A:01 +# Fingerprint (SHA-256): 45:14:0B:32:47:EB:9C:C8:C5:B4:F0:D7:B5:30:91:F7:32:92:08:9E:6E:5A:63:E2:74:9D:D3:AC:A9:19:8E:DA # Fingerprint (SHA1): 47:BE:AB:C9:22:EA:E8:0E:78:78:34:62:A7:9F:45:C2:54:FD:E6:8B CKA_CLASS CK_OBJECT_CLASS CKO_CERTIFICATE CKA_TOKEN CK_BBOOL CK_TRUE @@ -6347,13 +6347,13 @@ CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE -# Trust for Certificate "Go Daddy Root Certificate Authority - G2" +# Trust for "Go Daddy Root Certificate Authority - G2" # Issuer: CN=Go Daddy Root Certificate Authority - G2,O="GoDaddy.com, Inc.",L=Scottsdale,ST=Arizona,C=US # Serial Number: 0 (0x0) # Subject: CN=Go Daddy Root Certificate Authority - G2,O="GoDaddy.com, Inc.",L=Scottsdale,ST=Arizona,C=US # Not Valid Before: Tue Sep 01 00:00:00 2009 # Not Valid After : Thu Dec 31 23:59:59 2037 -# Fingerprint (MD5): 80:3A:BC:22:C1:E6:FB:8D:9B:3B:27:4A:32:1B:9A:01 +# Fingerprint (SHA-256): 45:14:0B:32:47:EB:9C:C8:C5:B4:F0:D7:B5:30:91:F7:32:92:08:9E:6E:5A:63:E2:74:9D:D3:AC:A9:19:8E:DA # Fingerprint (SHA1): 47:BE:AB:C9:22:EA:E8:0E:78:78:34:62:A7:9F:45:C2:54:FD:E6:8B CKA_CLASS CK_OBJECT_CLASS CKO_NSS_TRUST CKA_TOKEN CK_BBOOL CK_TRUE @@ -6394,7 +6394,7 @@ CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE # Subject: CN=Starfield Root Certificate Authority - G2,O="Starfield Technologies, Inc.",L=Scottsdale,ST=Arizona,C=US # Not Valid Before: Tue Sep 01 00:00:00 2009 # Not Valid After : Thu Dec 31 23:59:59 2037 -# Fingerprint (MD5): D6:39:81:C6:52:7E:96:69:FC:FC:CA:66:ED:05:F2:96 +# Fingerprint (SHA-256): 2C:E1:CB:0B:F9:D2:F9:E1:02:99:3F:BE:21:51:52:C3:B2:DD:0C:AB:DE:1C:68:E5:31:9B:83:91:54:DB:B7:F5 # Fingerprint (SHA1): B5:1C:06:7C:EE:2B:0C:3D:F8:55:AB:2D:92:F4:FE:39:D4:E7:0F:0E CKA_CLASS CK_OBJECT_CLASS CKO_CERTIFICATE CKA_TOKEN CK_BBOOL CK_TRUE @@ -6499,13 +6499,13 @@ CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE -# Trust for Certificate "Starfield Root Certificate Authority - G2" +# Trust for "Starfield Root Certificate Authority - G2" # Issuer: CN=Starfield Root Certificate Authority - G2,O="Starfield Technologies, Inc.",L=Scottsdale,ST=Arizona,C=US # Serial Number: 0 (0x0) # Subject: CN=Starfield Root Certificate Authority - G2,O="Starfield Technologies, Inc.",L=Scottsdale,ST=Arizona,C=US # Not Valid Before: Tue Sep 01 00:00:00 2009 # Not Valid After : Thu Dec 31 23:59:59 2037 -# Fingerprint (MD5): D6:39:81:C6:52:7E:96:69:FC:FC:CA:66:ED:05:F2:96 +# Fingerprint (SHA-256): 2C:E1:CB:0B:F9:D2:F9:E1:02:99:3F:BE:21:51:52:C3:B2:DD:0C:AB:DE:1C:68:E5:31:9B:83:91:54:DB:B7:F5 # Fingerprint (SHA1): B5:1C:06:7C:EE:2B:0C:3D:F8:55:AB:2D:92:F4:FE:39:D4:E7:0F:0E CKA_CLASS CK_OBJECT_CLASS CKO_NSS_TRUST CKA_TOKEN CK_BBOOL CK_TRUE @@ -6547,7 +6547,7 @@ CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE # Subject: CN=Starfield Services Root Certificate Authority - G2,O="Starfield Technologies, Inc.",L=Scottsdale,ST=Arizona,C=US # Not Valid Before: Tue Sep 01 00:00:00 2009 # Not Valid After : Thu Dec 31 23:59:59 2037 -# Fingerprint (MD5): 17:35:74:AF:7B:61:1C:EB:F4:F9:3C:E2:EE:40:F9:A2 +# Fingerprint (SHA-256): 56:8D:69:05:A2:C8:87:08:A4:B3:02:51:90:ED:CF:ED:B1:97:4A:60:6A:13:C6:E5:29:0F:CB:2A:E6:3E:DA:B5 # Fingerprint (SHA1): 92:5A:8F:8D:2C:6D:04:E0:66:5F:59:6A:FF:22:D8:63:E8:25:6F:3F CKA_CLASS CK_OBJECT_CLASS CKO_CERTIFICATE CKA_TOKEN CK_BBOOL CK_TRUE @@ -6653,13 +6653,13 @@ CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE -# Trust for Certificate "Starfield Services Root Certificate Authority - G2" +# Trust for "Starfield Services Root Certificate Authority - G2" # Issuer: CN=Starfield Services Root Certificate Authority - G2,O="Starfield Technologies, Inc.",L=Scottsdale,ST=Arizona,C=US # Serial Number: 0 (0x0) # Subject: CN=Starfield Services Root Certificate Authority - G2,O="Starfield Technologies, Inc.",L=Scottsdale,ST=Arizona,C=US # Not Valid Before: Tue Sep 01 00:00:00 2009 # Not Valid After : Thu Dec 31 23:59:59 2037 -# Fingerprint (MD5): 17:35:74:AF:7B:61:1C:EB:F4:F9:3C:E2:EE:40:F9:A2 +# Fingerprint (SHA-256): 56:8D:69:05:A2:C8:87:08:A4:B3:02:51:90:ED:CF:ED:B1:97:4A:60:6A:13:C6:E5:29:0F:CB:2A:E6:3E:DA:B5 # Fingerprint (SHA1): 92:5A:8F:8D:2C:6D:04:E0:66:5F:59:6A:FF:22:D8:63:E8:25:6F:3F CKA_CLASS CK_OBJECT_CLASS CKO_NSS_TRUST CKA_TOKEN CK_BBOOL CK_TRUE @@ -6701,7 +6701,7 @@ CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE # Subject: CN=AffirmTrust Commercial,O=AffirmTrust,C=US # Not Valid Before: Fri Jan 29 14:06:06 2010 # Not Valid After : Tue Dec 31 14:06:06 2030 -# Fingerprint (MD5): 82:92:BA:5B:EF:CD:8A:6F:A6:3D:55:F9:84:F6:D6:B7 +# Fingerprint (SHA-256): 03:76:AB:1D:54:C5:F9:80:3C:E4:B2:E2:01:A0:EE:7E:EF:7B:57:B6:36:E8:A9:3C:9B:8D:48:60:C9:6F:5F:A7 # Fingerprint (SHA1): F9:B5:B6:32:45:5F:9C:BE:EC:57:5F:80:DC:E9:6E:2C:C7:B2:78:B7 CKA_CLASS CK_OBJECT_CLASS CKO_CERTIFICATE CKA_TOKEN CK_BBOOL CK_TRUE @@ -6786,13 +6786,13 @@ CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE -# Trust for Certificate "AffirmTrust Commercial" +# Trust for "AffirmTrust Commercial" # Issuer: CN=AffirmTrust Commercial,O=AffirmTrust,C=US # Serial Number:77:77:06:27:26:a9:b1:7c # Subject: CN=AffirmTrust Commercial,O=AffirmTrust,C=US # Not Valid Before: Fri Jan 29 14:06:06 2010 # Not Valid After : Tue Dec 31 14:06:06 2030 -# Fingerprint (MD5): 82:92:BA:5B:EF:CD:8A:6F:A6:3D:55:F9:84:F6:D6:B7 +# Fingerprint (SHA-256): 03:76:AB:1D:54:C5:F9:80:3C:E4:B2:E2:01:A0:EE:7E:EF:7B:57:B6:36:E8:A9:3C:9B:8D:48:60:C9:6F:5F:A7 # Fingerprint (SHA1): F9:B5:B6:32:45:5F:9C:BE:EC:57:5F:80:DC:E9:6E:2C:C7:B2:78:B7 CKA_CLASS CK_OBJECT_CLASS CKO_NSS_TRUST CKA_TOKEN CK_BBOOL CK_TRUE @@ -6829,7 +6829,7 @@ CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE # Subject: CN=AffirmTrust Networking,O=AffirmTrust,C=US # Not Valid Before: Fri Jan 29 14:08:24 2010 # Not Valid After : Tue Dec 31 14:08:24 2030 -# Fingerprint (MD5): 42:65:CA:BE:01:9A:9A:4C:A9:8C:41:49:CD:C0:D5:7F +# Fingerprint (SHA-256): 0A:81:EC:5A:92:97:77:F1:45:90:4A:F3:8D:5D:50:9F:66:B5:E2:C5:8F:CD:B5:31:05:8B:0E:17:F3:F0:B4:1B # Fingerprint (SHA1): 29:36:21:02:8B:20:ED:02:F5:66:C5:32:D1:D6:ED:90:9F:45:00:2F CKA_CLASS CK_OBJECT_CLASS CKO_CERTIFICATE CKA_TOKEN CK_BBOOL CK_TRUE @@ -6914,13 +6914,13 @@ CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE -# Trust for Certificate "AffirmTrust Networking" +# Trust for "AffirmTrust Networking" # Issuer: CN=AffirmTrust Networking,O=AffirmTrust,C=US # Serial Number:7c:4f:04:39:1c:d4:99:2d # Subject: CN=AffirmTrust Networking,O=AffirmTrust,C=US # Not Valid Before: Fri Jan 29 14:08:24 2010 # Not Valid After : Tue Dec 31 14:08:24 2030 -# Fingerprint (MD5): 42:65:CA:BE:01:9A:9A:4C:A9:8C:41:49:CD:C0:D5:7F +# Fingerprint (SHA-256): 0A:81:EC:5A:92:97:77:F1:45:90:4A:F3:8D:5D:50:9F:66:B5:E2:C5:8F:CD:B5:31:05:8B:0E:17:F3:F0:B4:1B # Fingerprint (SHA1): 29:36:21:02:8B:20:ED:02:F5:66:C5:32:D1:D6:ED:90:9F:45:00:2F CKA_CLASS CK_OBJECT_CLASS CKO_NSS_TRUST CKA_TOKEN CK_BBOOL CK_TRUE @@ -6957,7 +6957,7 @@ CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE # Subject: CN=AffirmTrust Premium,O=AffirmTrust,C=US # Not Valid Before: Fri Jan 29 14:10:36 2010 # Not Valid After : Mon Dec 31 14:10:36 2040 -# Fingerprint (MD5): C4:5D:0E:48:B6:AC:28:30:4E:0A:BC:F9:38:16:87:57 +# Fingerprint (SHA-256): 70:A7:3F:7F:37:6B:60:07:42:48:90:45:34:B1:14:82:D5:BF:0E:69:8E:CC:49:8D:F5:25:77:EB:F2:E9:3B:9A # Fingerprint (SHA1): D8:A6:33:2C:E0:03:6F:B1:85:F6:63:4F:7D:6A:06:65:26:32:28:27 CKA_CLASS CK_OBJECT_CLASS CKO_CERTIFICATE CKA_TOKEN CK_BBOOL CK_TRUE @@ -7074,13 +7074,13 @@ CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE -# Trust for Certificate "AffirmTrust Premium" +# Trust for "AffirmTrust Premium" # Issuer: CN=AffirmTrust Premium,O=AffirmTrust,C=US # Serial Number:6d:8c:14:46:b1:a6:0a:ee # Subject: CN=AffirmTrust Premium,O=AffirmTrust,C=US # Not Valid Before: Fri Jan 29 14:10:36 2010 # Not Valid After : Mon Dec 31 14:10:36 2040 -# Fingerprint (MD5): C4:5D:0E:48:B6:AC:28:30:4E:0A:BC:F9:38:16:87:57 +# Fingerprint (SHA-256): 70:A7:3F:7F:37:6B:60:07:42:48:90:45:34:B1:14:82:D5:BF:0E:69:8E:CC:49:8D:F5:25:77:EB:F2:E9:3B:9A # Fingerprint (SHA1): D8:A6:33:2C:E0:03:6F:B1:85:F6:63:4F:7D:6A:06:65:26:32:28:27 CKA_CLASS CK_OBJECT_CLASS CKO_NSS_TRUST CKA_TOKEN CK_BBOOL CK_TRUE @@ -7117,7 +7117,7 @@ CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE # Subject: CN=AffirmTrust Premium ECC,O=AffirmTrust,C=US # Not Valid Before: Fri Jan 29 14:20:24 2010 # Not Valid After : Mon Dec 31 14:20:24 2040 -# Fingerprint (MD5): 64:B0:09:55:CF:B1:D5:99:E2:BE:13:AB:A6:5D:EA:4D +# Fingerprint (SHA-256): BD:71:FD:F6:DA:97:E4:CF:62:D1:64:7A:DD:25:81:B0:7D:79:AD:F8:39:7E:B4:EC:BA:9C:5E:84:88:82:14:23 # Fingerprint (SHA1): B8:23:6B:00:2F:1D:16:86:53:01:55:6C:11:A4:37:CA:EB:FF:C3:BB CKA_CLASS CK_OBJECT_CLASS CKO_CERTIFICATE CKA_TOKEN CK_BBOOL CK_TRUE @@ -7182,13 +7182,13 @@ CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE -# Trust for Certificate "AffirmTrust Premium ECC" +# Trust for "AffirmTrust Premium ECC" # Issuer: CN=AffirmTrust Premium ECC,O=AffirmTrust,C=US # Serial Number:74:97:25:8a:c7:3f:7a:54 # Subject: CN=AffirmTrust Premium ECC,O=AffirmTrust,C=US # Not Valid Before: Fri Jan 29 14:20:24 2010 # Not Valid After : Mon Dec 31 14:20:24 2040 -# Fingerprint (MD5): 64:B0:09:55:CF:B1:D5:99:E2:BE:13:AB:A6:5D:EA:4D +# Fingerprint (SHA-256): BD:71:FD:F6:DA:97:E4:CF:62:D1:64:7A:DD:25:81:B0:7D:79:AD:F8:39:7E:B4:EC:BA:9C:5E:84:88:82:14:23 # Fingerprint (SHA1): B8:23:6B:00:2F:1D:16:86:53:01:55:6C:11:A4:37:CA:EB:FF:C3:BB CKA_CLASS CK_OBJECT_CLASS CKO_NSS_TRUST CKA_TOKEN CK_BBOOL CK_TRUE @@ -7225,7 +7225,7 @@ CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE # Subject: CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL # Not Valid Before: Wed Oct 22 12:07:37 2008 # Not Valid After : Mon Dec 31 12:07:37 2029 -# Fingerprint (MD5): D5:E9:81:40:C5:18:69:FC:46:2C:89:75:62:0F:AA:78 +# Fingerprint (SHA-256): 5C:58:46:8D:55:F5:8E:49:7E:74:39:82:D2:B5:00:10:B6:D1:65:37:4A:CF:83:A7:D4:A3:2D:B7:68:C4:40:8E # Fingerprint (SHA1): 07:E0:32:E0:20:B7:2C:3F:19:2F:06:28:A2:59:3A:19:A7:0F:06:9E CKA_CLASS CK_OBJECT_CLASS CKO_CERTIFICATE CKA_TOKEN CK_BBOOL CK_TRUE @@ -7323,13 +7323,13 @@ CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE -# Trust for Certificate "Certum Trusted Network CA" +# Trust for "Certum Trusted Network CA" # Issuer: CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL # Serial Number: 279744 (0x444c0) # Subject: CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL # Not Valid Before: Wed Oct 22 12:07:37 2008 # Not Valid After : Mon Dec 31 12:07:37 2029 -# Fingerprint (MD5): D5:E9:81:40:C5:18:69:FC:46:2C:89:75:62:0F:AA:78 +# Fingerprint (SHA-256): 5C:58:46:8D:55:F5:8E:49:7E:74:39:82:D2:B5:00:10:B6:D1:65:37:4A:CF:83:A7:D4:A3:2D:B7:68:C4:40:8E # Fingerprint (SHA1): 07:E0:32:E0:20:B7:2C:3F:19:2F:06:28:A2:59:3A:19:A7:0F:06:9E CKA_CLASS CK_OBJECT_CLASS CKO_NSS_TRUST CKA_TOKEN CK_BBOOL CK_TRUE @@ -7369,7 +7369,7 @@ CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE # Subject: CN=TWCA Root Certification Authority,OU=Root CA,O=TAIWAN-CA,C=TW # Not Valid Before: Thu Aug 28 07:24:33 2008 # Not Valid After : Tue Dec 31 15:59:59 2030 -# Fingerprint (MD5): AA:08:8F:F6:F9:7B:B7:F2:B1:A7:1E:9B:EA:EA:BD:79 +# Fingerprint (SHA-256): BF:D8:8F:E1:10:1C:41:AE:3E:80:1B:F8:BE:56:35:0E:E9:BA:D1:A6:B9:BD:51:5E:DC:5C:6D:5B:87:11:AC:44 # Fingerprint (SHA1): CF:9E:87:6D:D3:EB:FC:42:26:97:A3:B5:A3:7A:A0:76:A9:06:23:48 CKA_CLASS CK_OBJECT_CLASS CKO_CERTIFICATE CKA_TOKEN CK_BBOOL CK_TRUE @@ -7461,13 +7461,13 @@ CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE -# Trust for Certificate "TWCA Root Certification Authority" +# Trust for "TWCA Root Certification Authority" # Issuer: CN=TWCA Root Certification Authority,OU=Root CA,O=TAIWAN-CA,C=TW # Serial Number: 1 (0x1) # Subject: CN=TWCA Root Certification Authority,OU=Root CA,O=TAIWAN-CA,C=TW # Not Valid Before: Thu Aug 28 07:24:33 2008 # Not Valid After : Tue Dec 31 15:59:59 2030 -# Fingerprint (MD5): AA:08:8F:F6:F9:7B:B7:F2:B1:A7:1E:9B:EA:EA:BD:79 +# Fingerprint (SHA-256): BF:D8:8F:E1:10:1C:41:AE:3E:80:1B:F8:BE:56:35:0E:E9:BA:D1:A6:B9:BD:51:5E:DC:5C:6D:5B:87:11:AC:44 # Fingerprint (SHA1): CF:9E:87:6D:D3:EB:FC:42:26:97:A3:B5:A3:7A:A0:76:A9:06:23:48 CKA_CLASS CK_OBJECT_CLASS CKO_NSS_TRUST CKA_TOKEN CK_BBOOL CK_TRUE @@ -7667,187 +7667,6 @@ CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_NOT_TRUSTED CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_NOT_TRUSTED CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE -# -# Certificate "Explicitly Distrusted DigiNotar PKIoverheid G2" -# -# Issuer: CN=DigiNotar PKIoverheid CA Organisatie - G2,O=DigiNotar B.V.,C=NL -# Serial Number: 268435455 (0xfffffff) -# Subject: CN=DigiNotar PKIoverheid CA Organisatie - G2,O=DigiNotar B.V.,C=NL -# Not Valid Before: Wed May 12 08:51:39 2010 -# Not Valid After : Mon Mar 23 09:50:05 2020 -# Fingerprint (MD5): 2E:61:A2:D1:78:CE:EE:BF:59:33:B0:23:14:0F:94:1C -# Fingerprint (SHA1): D5:F2:57:A9:BF:2D:D0:3F:8B:46:57:F9:2B:C9:A4:C6:92:E1:42:42 -CKA_CLASS CK_OBJECT_CLASS CKO_CERTIFICATE -CKA_TOKEN CK_BBOOL CK_TRUE -CKA_PRIVATE CK_BBOOL CK_FALSE -CKA_MODIFIABLE CK_BBOOL CK_FALSE -CKA_LABEL UTF8 "Explicitly Distrusted DigiNotar PKIoverheid G2" -CKA_CERTIFICATE_TYPE CK_CERTIFICATE_TYPE CKC_X_509 -CKA_SUBJECT MULTILINE_OCTAL -\060\132\061\013\060\011\006\003\125\004\006\023\002\116\114\061 -\027\060\025\006\003\125\004\012\014\016\104\151\147\151\116\157 -\164\141\162\040\102\056\126\056\061\062\060\060\006\003\125\004 -\003\014\051\104\151\147\151\116\157\164\141\162\040\120\113\111 -\157\166\145\162\150\145\151\144\040\103\101\040\117\162\147\141 -\156\151\163\141\164\151\145\040\055\040\107\062 -END -CKA_ID UTF8 "0" -CKA_ISSUER MULTILINE_OCTAL -\060\132\061\013\060\011\006\003\125\004\006\023\002\116\114\061 -\027\060\025\006\003\125\004\012\014\016\104\151\147\151\116\157 -\164\141\162\040\102\056\126\056\061\062\060\060\006\003\125\004 -\003\014\051\104\151\147\151\116\157\164\141\162\040\120\113\111 -\157\166\145\162\150\145\151\144\040\103\101\040\117\162\147\141 -\156\151\163\141\164\151\145\040\055\040\107\062 -END -CKA_SERIAL_NUMBER MULTILINE_OCTAL -\002\004\017\377\377\377 -END -CKA_VALUE MULTILINE_OCTAL -\060\202\006\225\060\202\004\175\240\003\002\001\002\002\004\017 -\377\377\377\060\015\006\011\052\206\110\206\367\015\001\001\013 -\005\000\060\132\061\013\060\011\006\003\125\004\006\023\002\116 -\114\061\027\060\025\006\003\125\004\012\014\016\104\151\147\151 -\116\157\164\141\162\040\102\056\126\056\061\062\060\060\006\003 -\125\004\003\014\051\104\151\147\151\116\157\164\141\162\040\120 -\113\111\157\166\145\162\150\145\151\144\040\103\101\040\117\162 -\147\141\156\151\163\141\164\151\145\040\055\040\107\062\060\036 -\027\015\061\060\060\065\061\062\060\070\065\061\063\071\132\027 -\015\062\060\060\063\062\063\060\071\065\060\060\065\132\060\132 -\061\013\060\011\006\003\125\004\006\023\002\116\114\061\027\060 -\025\006\003\125\004\012\014\016\104\151\147\151\116\157\164\141 -\162\040\102\056\126\056\061\062\060\060\006\003\125\004\003\014 -\051\104\151\147\151\116\157\164\141\162\040\120\113\111\157\166 -\145\162\150\145\151\144\040\103\101\040\117\162\147\141\156\151 -\163\141\164\151\145\040\055\040\107\062\060\202\002\042\060\015 -\006\011\052\206\110\206\367\015\001\001\001\005\000\003\202\002 -\017\000\060\202\002\012\002\202\002\001\000\261\023\031\017\047 -\346\154\324\125\206\113\320\354\211\212\105\221\170\254\107\275 -\107\053\344\374\105\353\117\264\046\163\133\067\323\303\177\366 -\343\336\327\243\370\055\150\305\010\076\113\224\326\344\207\045 -\066\153\204\265\030\164\363\050\130\163\057\233\152\317\274\004 -\036\366\336\335\257\374\113\252\365\333\146\142\045\001\045\202 -\336\362\227\132\020\156\335\135\251\042\261\004\251\043\163\072 -\370\161\255\035\317\204\104\353\107\321\257\155\310\174\050\253 -\307\362\067\172\164\137\137\305\002\024\212\243\132\343\033\154 -\001\343\135\216\331\150\326\364\011\033\062\334\221\265\054\365 -\040\353\214\003\155\046\111\270\223\304\205\135\330\322\233\257 -\126\152\314\005\063\314\240\102\236\064\125\104\234\153\240\324 -\022\320\053\124\315\267\211\015\345\366\353\350\373\205\001\063 -\117\172\153\361\235\162\063\226\016\367\262\204\245\245\047\304 -\047\361\121\163\051\167\272\147\156\376\114\334\264\342\241\241 -\201\057\071\111\215\103\070\023\316\320\245\134\302\207\072\000 -\147\145\102\043\361\066\131\012\035\243\121\310\274\243\224\052 -\061\337\343\074\362\235\032\074\004\260\357\261\012\060\023\163 -\266\327\363\243\114\001\165\024\205\170\300\327\212\071\130\205 -\120\372\056\346\305\276\317\213\077\257\217\066\324\045\011\055 -\322\017\254\162\223\362\277\213\324\120\263\371\025\120\233\231 -\365\024\331\373\213\221\243\062\046\046\240\370\337\073\140\201 -\206\203\171\133\053\353\023\075\051\072\301\155\335\275\236\216 -\207\326\112\256\064\227\005\356\024\246\366\334\070\176\112\351 -\044\124\007\075\227\150\067\106\153\015\307\250\041\257\023\124 -\344\011\152\361\115\106\012\311\135\373\233\117\275\336\373\267 -\124\313\270\070\234\247\071\373\152\055\300\173\215\253\245\247 -\127\354\112\222\212\063\305\341\040\134\163\330\220\222\053\200 -\325\017\206\030\151\174\071\117\204\206\274\367\114\133\363\325 -\264\312\240\302\360\067\042\312\171\122\037\123\346\252\363\220 -\260\073\335\362\050\375\254\353\305\006\044\240\311\324\057\017 -\130\375\265\236\354\017\317\262\131\320\242\004\172\070\152\256 -\162\373\275\360\045\142\224\011\247\005\013\002\003\001\000\001 -\243\202\001\141\060\202\001\135\060\110\006\003\125\035\040\004 -\101\060\077\060\075\006\004\125\035\040\000\060\065\060\063\006 -\010\053\006\001\005\005\007\002\001\026\047\150\164\164\160\072 -\057\057\167\167\167\056\144\151\147\151\156\157\164\141\162\056 -\156\154\057\143\160\163\057\160\153\151\157\166\145\162\150\145 -\151\144\060\017\006\003\125\035\023\001\001\377\004\005\060\003 -\001\001\377\060\016\006\003\125\035\017\001\001\377\004\004\003 -\002\001\006\060\201\205\006\003\125\035\043\004\176\060\174\200 -\024\071\020\213\111\222\134\333\141\022\040\315\111\235\032\216 -\332\234\147\100\271\241\136\244\134\060\132\061\013\060\011\006 -\003\125\004\006\023\002\116\114\061\036\060\034\006\003\125\004 -\012\014\025\123\164\141\141\164\040\144\145\162\040\116\145\144 -\145\162\154\141\156\144\145\156\061\053\060\051\006\003\125\004 -\003\014\042\123\164\141\141\164\040\144\145\162\040\116\145\144 -\145\162\154\141\156\144\145\156\040\122\157\157\164\040\103\101 -\040\055\040\107\062\202\004\000\230\226\364\060\111\006\003\125 -\035\037\004\102\060\100\060\076\240\074\240\072\206\070\150\164 -\164\160\072\057\057\143\162\154\056\160\153\151\157\166\145\162 -\150\145\151\144\056\156\154\057\104\157\155\117\162\147\141\156 -\151\163\141\164\151\145\114\141\164\145\163\164\103\122\114\055 -\107\062\056\143\162\154\060\035\006\003\125\035\016\004\026\004 -\024\274\135\224\073\331\253\173\003\045\163\141\302\333\055\356 -\374\253\217\145\241\060\015\006\011\052\206\110\206\367\015\001 -\001\013\005\000\003\202\002\001\000\217\374\055\114\267\331\055 -\325\037\275\357\313\364\267\150\027\165\235\116\325\367\335\234 -\361\052\046\355\237\242\266\034\003\325\123\263\354\010\317\064 -\342\343\303\364\265\026\057\310\303\276\327\323\163\253\000\066 -\371\032\112\176\326\143\351\136\106\272\245\266\216\025\267\243 -\052\330\103\035\357\135\310\037\201\205\263\213\367\377\074\364 -\331\364\106\010\077\234\274\035\240\331\250\114\315\045\122\116 -\012\261\040\367\037\351\103\331\124\106\201\023\232\300\136\164 -\154\052\230\062\352\374\167\273\015\245\242\061\230\042\176\174 -\174\347\332\244\255\354\267\056\032\031\161\370\110\120\332\103 -\217\054\204\335\301\100\047\343\265\360\025\116\226\324\370\134 -\343\206\051\106\053\327\073\007\353\070\177\310\206\127\227\323 -\357\052\063\304\027\120\325\144\151\153\053\153\105\136\135\057 -\027\312\132\116\317\303\327\071\074\365\073\237\106\271\233\347 -\016\111\227\235\326\325\343\033\017\352\217\001\116\232\023\224 -\131\012\002\007\110\113\032\140\253\177\117\355\013\330\125\015 -\150\157\125\234\151\145\025\102\354\300\334\335\154\254\303\026 -\316\013\035\126\233\244\304\304\322\056\340\017\342\104\047\053 -\120\151\244\334\142\350\212\041\051\102\154\314\000\072\226\166 -\233\357\100\300\244\136\167\204\062\154\046\052\071\146\256\135 -\343\271\271\262\054\150\037\036\232\220\003\071\360\252\263\244 -\314\111\213\030\064\351\067\311\173\051\307\204\174\157\104\025 -\057\354\141\131\004\311\105\313\242\326\122\242\174\177\051\222 -\326\112\305\213\102\250\324\376\352\330\307\207\043\030\344\235 -\172\175\163\100\122\230\240\256\156\343\005\077\005\017\340\245 -\306\155\115\355\203\067\210\234\307\363\334\102\232\152\266\327 -\041\111\066\167\362\357\030\117\305\160\331\236\351\336\267\053 -\213\364\274\176\050\337\015\100\311\205\134\256\235\305\061\377 -\320\134\016\265\250\176\360\351\057\272\257\210\256\345\265\321 -\130\245\257\234\161\247\051\001\220\203\151\067\202\005\272\374 -\011\301\010\156\214\170\073\303\063\002\200\077\104\205\010\035 -\337\125\126\010\255\054\205\055\135\261\003\341\256\252\164\305 -\244\363\116\272\067\230\173\202\271 -END - -# Trust for Certificate "Explicitly Distrusted DigiNotar PKIoverheid G2" -# Issuer: CN=DigiNotar PKIoverheid CA Organisatie - G2,O=DigiNotar B.V.,C=NL -# Serial Number: 268435455 (0xfffffff) -# Subject: CN=DigiNotar PKIoverheid CA Organisatie - G2,O=DigiNotar B.V.,C=NL -# Not Valid Before: Wed May 12 08:51:39 2010 -# Not Valid After : Mon Mar 23 09:50:05 2020 -# Fingerprint (MD5): 2E:61:A2:D1:78:CE:EE:BF:59:33:B0:23:14:0F:94:1C -# Fingerprint (SHA1): D5:F2:57:A9:BF:2D:D0:3F:8B:46:57:F9:2B:C9:A4:C6:92:E1:42:42 -CKA_CLASS CK_OBJECT_CLASS CKO_NSS_TRUST -CKA_TOKEN CK_BBOOL CK_TRUE -CKA_PRIVATE CK_BBOOL CK_FALSE -CKA_MODIFIABLE CK_BBOOL CK_FALSE -CKA_LABEL UTF8 "Explicitly Distrusted DigiNotar PKIoverheid G2" -CKA_CERT_SHA1_HASH MULTILINE_OCTAL -\325\362\127\251\277\055\320\077\213\106\127\371\053\311\244\306 -\222\341\102\102 -END -CKA_CERT_MD5_HASH MULTILINE_OCTAL -\056\141\242\321\170\316\356\277\131\063\260\043\024\017\224\034 -END -CKA_ISSUER MULTILINE_OCTAL -\060\132\061\013\060\011\006\003\125\004\006\023\002\116\114\061 -\027\060\025\006\003\125\004\012\014\016\104\151\147\151\116\157 -\164\141\162\040\102\056\126\056\061\062\060\060\006\003\125\004 -\003\014\051\104\151\147\151\116\157\164\141\162\040\120\113\111 -\157\166\145\162\150\145\151\144\040\103\101\040\117\162\147\141 -\156\151\163\141\164\151\145\040\055\040\107\062 -END -CKA_SERIAL_NUMBER MULTILINE_OCTAL -\002\004\017\377\377\377 -END -CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_NOT_TRUSTED -CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_NOT_TRUSTED -CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_NOT_TRUSTED -CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE - # # Certificate "Security Communication RootCA2" # @@ -7856,7 +7675,7 @@ CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE # Subject: OU=Security Communication RootCA2,O="SECOM Trust Systems CO.,LTD.",C=JP # Not Valid Before: Fri May 29 05:00:39 2009 # Not Valid After : Tue May 29 05:00:39 2029 -# Fingerprint (MD5): 6C:39:7D:A4:0E:55:59:B2:3F:D6:41:B1:12:50:DE:43 +# Fingerprint (SHA-256): 51:3B:2C:EC:B8:10:D4:CD:E5:DD:85:39:1A:DF:C6:C2:DD:60:D8:7B:B7:36:D2:B5:21:48:4A:A4:7A:0E:BE:F6 # Fingerprint (SHA1): 5F:3B:8C:F2:F8:10:B3:7D:78:B4:CE:EC:19:19:C3:73:34:B9:C7:74 CKA_CLASS CK_OBJECT_CLASS CKO_CERTIFICATE CKA_TOKEN CK_BBOOL CK_TRUE @@ -7946,13 +7765,13 @@ CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE -# Trust for Certificate "Security Communication RootCA2" +# Trust for "Security Communication RootCA2" # Issuer: OU=Security Communication RootCA2,O="SECOM Trust Systems CO.,LTD.",C=JP # Serial Number: 0 (0x0) # Subject: OU=Security Communication RootCA2,O="SECOM Trust Systems CO.,LTD.",C=JP # Not Valid Before: Fri May 29 05:00:39 2009 # Not Valid After : Tue May 29 05:00:39 2029 -# Fingerprint (MD5): 6C:39:7D:A4:0E:55:59:B2:3F:D6:41:B1:12:50:DE:43 +# Fingerprint (SHA-256): 51:3B:2C:EC:B8:10:D4:CD:E5:DD:85:39:1A:DF:C6:C2:DD:60:D8:7B:B7:36:D2:B5:21:48:4A:A4:7A:0E:BE:F6 # Fingerprint (SHA1): 5F:3B:8C:F2:F8:10:B3:7D:78:B4:CE:EC:19:19:C3:73:34:B9:C7:74 CKA_CLASS CK_OBJECT_CLASS CKO_NSS_TRUST CKA_TOKEN CK_BBOOL CK_TRUE @@ -7990,7 +7809,7 @@ CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE # Subject: CN=EC-ACC,OU=Jerarquia Entitats de Certificacio Catalanes,OU=Vegeu https://www.catcert.net/verarrel (c)03,OU=Serveis Publics de Certificacio,O=Agencia Catalana de Certificacio (NIF Q-0801176-I),C=ES # Not Valid Before: Tue Jan 07 23:00:00 2003 # Not Valid After : Tue Jan 07 22:59:59 2031 -# Fingerprint (MD5): EB:F5:9D:29:0D:61:F9:42:1F:7C:C2:BA:6D:E3:15:09 +# Fingerprint (SHA-256): 88:49:7F:01:60:2F:31:54:24:6A:E2:8C:4D:5A:EF:10:F1:D8:7E:BB:76:62:6F:4A:E0:B7:F9:5B:A7:96:87:99 # Fingerprint (SHA1): 28:90:3A:63:5B:52:80:FA:E6:77:4C:0B:6D:A7:D6:BA:A6:4A:F2:E8 CKA_CLASS CK_OBJECT_CLASS CKO_CERTIFICATE CKA_TOKEN CK_BBOOL CK_TRUE @@ -8137,13 +7956,13 @@ CKA_NSS_EMAIL_DISTRUST_AFTER MULTILINE_OCTAL \062\062\060\070\063\061\060\060\060\060\060\060\132 END -# Trust for Certificate "EC-ACC" +# Trust for "EC-ACC" # Issuer: CN=EC-ACC,OU=Jerarquia Entitats de Certificacio Catalanes,OU=Vegeu https://www.catcert.net/verarrel (c)03,OU=Serveis Publics de Certificacio,O=Agencia Catalana de Certificacio (NIF Q-0801176-I),C=ES # Serial Number:ee:2b:3d:eb:d4:21:de:14:a8:62:ac:04:f3:dd:c4:01 # Subject: CN=EC-ACC,OU=Jerarquia Entitats de Certificacio Catalanes,OU=Vegeu https://www.catcert.net/verarrel (c)03,OU=Serveis Publics de Certificacio,O=Agencia Catalana de Certificacio (NIF Q-0801176-I),C=ES # Not Valid Before: Tue Jan 07 23:00:00 2003 # Not Valid After : Tue Jan 07 22:59:59 2031 -# Fingerprint (MD5): EB:F5:9D:29:0D:61:F9:42:1F:7C:C2:BA:6D:E3:15:09 +# Fingerprint (SHA-256): 88:49:7F:01:60:2F:31:54:24:6A:E2:8C:4D:5A:EF:10:F1:D8:7E:BB:76:62:6F:4A:E0:B7:F9:5B:A7:96:87:99 # Fingerprint (SHA1): 28:90:3A:63:5B:52:80:FA:E6:77:4C:0B:6D:A7:D6:BA:A6:4A:F2:E8 CKA_CLASS CK_OBJECT_CLASS CKO_NSS_TRUST CKA_TOKEN CK_BBOOL CK_TRUE @@ -8192,7 +8011,7 @@ CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE # Subject: CN=Hellenic Academic and Research Institutions RootCA 2011,O=Hellenic Academic and Research Institutions Cert. Authority,C=GR # Not Valid Before: Tue Dec 06 13:49:52 2011 # Not Valid After : Mon Dec 01 13:49:52 2031 -# Fingerprint (MD5): 73:9F:4C:4B:73:5B:79:E9:FA:BA:1C:EF:6E:CB:D5:C9 +# Fingerprint (SHA-256): BC:10:4F:15:A4:8B:E7:09:DC:A5:42:A7:E1:D4:B9:DF:6F:05:45:27:E8:02:EA:A9:2D:59:54:44:25:8A:FE:71 # Fingerprint (SHA1): FE:45:65:9B:79:03:5B:98:A1:61:B5:51:2E:AC:DA:58:09:48:22:4D CKA_CLASS CK_OBJECT_CLASS CKO_CERTIFICATE CKA_TOKEN CK_BBOOL CK_TRUE @@ -8302,13 +8121,13 @@ CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE -# Trust for Certificate "Hellenic Academic and Research Institutions RootCA 2011" +# Trust for "Hellenic Academic and Research Institutions RootCA 2011" # Issuer: CN=Hellenic Academic and Research Institutions RootCA 2011,O=Hellenic Academic and Research Institutions Cert. Authority,C=GR # Serial Number: 0 (0x0) # Subject: CN=Hellenic Academic and Research Institutions RootCA 2011,O=Hellenic Academic and Research Institutions Cert. Authority,C=GR # Not Valid Before: Tue Dec 06 13:49:52 2011 # Not Valid After : Mon Dec 01 13:49:52 2031 -# Fingerprint (MD5): 73:9F:4C:4B:73:5B:79:E9:FA:BA:1C:EF:6E:CB:D5:C9 +# Fingerprint (SHA-256): BC:10:4F:15:A4:8B:E7:09:DC:A5:42:A7:E1:D4:B9:DF:6F:05:45:27:E8:02:EA:A9:2D:59:54:44:25:8A:FE:71 # Fingerprint (SHA1): FE:45:65:9B:79:03:5B:98:A1:61:B5:51:2E:AC:DA:58:09:48:22:4D CKA_CLASS CK_OBJECT_CLASS CKO_NSS_TRUST CKA_TOKEN CK_BBOOL CK_TRUE @@ -8342,68 +8161,6 @@ CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_TRUSTED_DELEGATOR CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_MUST_VERIFY_TRUST CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE -# Explicitly Distrust "MITM subCA 1 issued by Trustwave", Bug 724929 -# Issuer: E=ca@trustwave.com,CN="Trustwave Organization Issuing CA, Level 2",O="Trustwave Holdings, Inc.",L=Chicago,ST=Illinois,C=US -# Serial Number: 1800000005 (0x6b49d205) -# Not Before: Apr 7 15:37:15 2011 GMT -# Not After : Apr 4 15:37:15 2021 GMT -CKA_CLASS CK_OBJECT_CLASS CKO_NSS_TRUST -CKA_TOKEN CK_BBOOL CK_TRUE -CKA_PRIVATE CK_BBOOL CK_FALSE -CKA_MODIFIABLE CK_BBOOL CK_FALSE -CKA_LABEL UTF8 "MITM subCA 1 issued by Trustwave" -CKA_ISSUER MULTILINE_OCTAL -\060\201\253\061\013\060\011\006\003\125\004\006\023\002\125\123 -\061\021\060\017\006\003\125\004\010\023\010\111\154\154\151\156 -\157\151\163\061\020\060\016\006\003\125\004\007\023\007\103\150 -\151\143\141\147\157\061\041\060\037\006\003\125\004\012\023\030 -\124\162\165\163\164\167\141\166\145\040\110\157\154\144\151\156 -\147\163\054\040\111\156\143\056\061\063\060\061\006\003\125\004 -\003\023\052\124\162\165\163\164\167\141\166\145\040\117\162\147 -\141\156\151\172\141\164\151\157\156\040\111\163\163\165\151\156 -\147\040\103\101\054\040\114\145\166\145\154\040\062\061\037\060 -\035\006\011\052\206\110\206\367\015\001\011\001\026\020\143\141 -\100\164\162\165\163\164\167\141\166\145\056\143\157\155 -END -CKA_SERIAL_NUMBER MULTILINE_OCTAL -\002\004\153\111\322\005 -END -CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_NOT_TRUSTED -CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_NOT_TRUSTED -CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_NOT_TRUSTED -CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE - -# Explicitly Distrust "MITM subCA 2 issued by Trustwave", Bug 724929 -# Issuer: E=ca@trustwave.com,CN="Trustwave Organization Issuing CA, Level 2",O="Trustwave Holdings, Inc.",L=Chicago,ST=Illinois,C=US -# Serial Number: 1800000006 (0x6b49d206) -# Not Before: Apr 18 21:09:30 2011 GMT -# Not After : Apr 15 21:09:30 2021 GMT -CKA_CLASS CK_OBJECT_CLASS CKO_NSS_TRUST -CKA_TOKEN CK_BBOOL CK_TRUE -CKA_PRIVATE CK_BBOOL CK_FALSE -CKA_MODIFIABLE CK_BBOOL CK_FALSE -CKA_LABEL UTF8 "MITM subCA 2 issued by Trustwave" -CKA_ISSUER MULTILINE_OCTAL -\060\201\253\061\013\060\011\006\003\125\004\006\023\002\125\123 -\061\021\060\017\006\003\125\004\010\023\010\111\154\154\151\156 -\157\151\163\061\020\060\016\006\003\125\004\007\023\007\103\150 -\151\143\141\147\157\061\041\060\037\006\003\125\004\012\023\030 -\124\162\165\163\164\167\141\166\145\040\110\157\154\144\151\156 -\147\163\054\040\111\156\143\056\061\063\060\061\006\003\125\004 -\003\023\052\124\162\165\163\164\167\141\166\145\040\117\162\147 -\141\156\151\172\141\164\151\157\156\040\111\163\163\165\151\156 -\147\040\103\101\054\040\114\145\166\145\154\040\062\061\037\060 -\035\006\011\052\206\110\206\367\015\001\011\001\026\020\143\141 -\100\164\162\165\163\164\167\141\166\145\056\143\157\155 -END -CKA_SERIAL_NUMBER MULTILINE_OCTAL -\002\004\153\111\322\006 -END -CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_NOT_TRUSTED -CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_NOT_TRUSTED -CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_NOT_TRUSTED -CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE - # # Certificate "Actalis Authentication Root CA" # @@ -8412,7 +8169,7 @@ CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE # Subject: CN=Actalis Authentication Root CA,O=Actalis S.p.A./03358520967,L=Milan,C=IT # Not Valid Before: Thu Sep 22 11:22:02 2011 # Not Valid After : Sun Sep 22 11:22:02 2030 -# Fingerprint (MD5): 69:C1:0D:4F:07:A3:1B:C3:FE:56:3D:04:BC:11:F6:A6 +# Fingerprint (SHA-256): 55:92:60:84:EC:96:3A:64:B9:6E:2A:BE:01:CE:0B:A8:6A:64:FB:FE:BC:C7:AA:B5:AF:C1:55:B3:7F:D7:60:66 # Fingerprint (SHA1): F3:73:B3:87:06:5A:28:84:8A:F2:F3:4A:CE:19:2B:DD:C7:8E:9C:AC CKA_CLASS CK_OBJECT_CLASS CKO_CERTIFICATE CKA_TOKEN CK_BBOOL CK_TRUE @@ -8546,7 +8303,7 @@ CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE # Subject: CN=Actalis Authentication Root CA,O=Actalis S.p.A./03358520967,L=Milan,C=IT # Not Valid Before: Thu Sep 22 11:22:02 2011 # Not Valid After : Sun Sep 22 11:22:02 2030 -# Fingerprint (MD5): 69:C1:0D:4F:07:A3:1B:C3:FE:56:3D:04:BC:11:F6:A6 +# Fingerprint (SHA-256): 55:92:60:84:EC:96:3A:64:B9:6E:2A:BE:01:CE:0B:A8:6A:64:FB:FE:BC:C7:AA:B5:AF:C1:55:B3:7F:D7:60:66 # Fingerprint (SHA1): F3:73:B3:87:06:5A:28:84:8A:F2:F3:4A:CE:19:2B:DD:C7:8E:9C:AC CKA_CLASS CK_OBJECT_CLASS CKO_NSS_TRUST CKA_TOKEN CK_BBOOL CK_TRUE @@ -8585,7 +8342,7 @@ CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE # Subject: CN=Buypass Class 2 Root CA,O=Buypass AS-983163327,C=NO # Not Valid Before: Tue Oct 26 08:38:03 2010 # Not Valid After : Fri Oct 26 08:38:03 2040 -# Fingerprint (MD5): 46:A7:D2:FE:45:FB:64:5A:A8:59:90:9B:78:44:9B:29 +# Fingerprint (SHA-256): 9A:11:40:25:19:7C:5B:B9:5D:94:E6:3D:55:CD:43:79:08:47:B6:46:B2:3C:DF:11:AD:A4:A0:0E:FF:15:FB:48 # Fingerprint (SHA1): 49:0A:75:74:DE:87:0A:47:FE:58:EE:F6:C7:6B:EB:C6:0B:12:40:99 CKA_CLASS CK_OBJECT_CLASS CKO_CERTIFICATE CKA_TOKEN CK_BBOOL CK_TRUE @@ -8709,7 +8466,7 @@ CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE # Subject: CN=Buypass Class 2 Root CA,O=Buypass AS-983163327,C=NO # Not Valid Before: Tue Oct 26 08:38:03 2010 # Not Valid After : Fri Oct 26 08:38:03 2040 -# Fingerprint (MD5): 46:A7:D2:FE:45:FB:64:5A:A8:59:90:9B:78:44:9B:29 +# Fingerprint (SHA-256): 9A:11:40:25:19:7C:5B:B9:5D:94:E6:3D:55:CD:43:79:08:47:B6:46:B2:3C:DF:11:AD:A4:A0:0E:FF:15:FB:48 # Fingerprint (SHA1): 49:0A:75:74:DE:87:0A:47:FE:58:EE:F6:C7:6B:EB:C6:0B:12:40:99 CKA_CLASS CK_OBJECT_CLASS CKO_NSS_TRUST CKA_TOKEN CK_BBOOL CK_TRUE @@ -8746,7 +8503,7 @@ CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE # Subject: CN=Buypass Class 3 Root CA,O=Buypass AS-983163327,C=NO # Not Valid Before: Tue Oct 26 08:28:58 2010 # Not Valid After : Fri Oct 26 08:28:58 2040 -# Fingerprint (MD5): 3D:3B:18:9E:2C:64:5A:E8:D5:88:CE:0E:F9:37:C2:EC +# Fingerprint (SHA-256): ED:F7:EB:BC:A2:7A:2A:38:4D:38:7B:7D:40:10:C6:66:E2:ED:B4:84:3E:4C:29:B4:AE:1D:5B:93:32:E6:B2:4D # Fingerprint (SHA1): DA:FA:F7:FA:66:84:EC:06:8F:14:50:BD:C7:C2:81:A5:BC:A9:64:57 CKA_CLASS CK_OBJECT_CLASS CKO_CERTIFICATE CKA_TOKEN CK_BBOOL CK_TRUE @@ -8870,7 +8627,7 @@ CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE # Subject: CN=Buypass Class 3 Root CA,O=Buypass AS-983163327,C=NO # Not Valid Before: Tue Oct 26 08:28:58 2010 # Not Valid After : Fri Oct 26 08:28:58 2040 -# Fingerprint (MD5): 3D:3B:18:9E:2C:64:5A:E8:D5:88:CE:0E:F9:37:C2:EC +# Fingerprint (SHA-256): ED:F7:EB:BC:A2:7A:2A:38:4D:38:7B:7D:40:10:C6:66:E2:ED:B4:84:3E:4C:29:B4:AE:1D:5B:93:32:E6:B2:4D # Fingerprint (SHA1): DA:FA:F7:FA:66:84:EC:06:8F:14:50:BD:C7:C2:81:A5:BC:A9:64:57 CKA_CLASS CK_OBJECT_CLASS CKO_NSS_TRUST CKA_TOKEN CK_BBOOL CK_TRUE @@ -8907,7 +8664,7 @@ CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE # Subject: CN=T-TeleSec GlobalRoot Class 3,OU=T-Systems Trust Center,O=T-Systems Enterprise Services GmbH,C=DE # Not Valid Before: Wed Oct 01 10:29:56 2008 # Not Valid After : Sat Oct 01 23:59:59 2033 -# Fingerprint (MD5): CA:FB:40:A8:4E:39:92:8A:1D:FE:8E:2F:C4:27:EA:EF +# Fingerprint (SHA-256): FD:73:DA:D3:1C:64:4F:F1:B4:3B:EF:0C:CD:DA:96:71:0B:9C:D9:87:5E:CA:7E:31:70:7A:F3:E9:6D:52:2B:BD # Fingerprint (SHA1): 55:A6:72:3E:CB:F2:EC:CD:C3:23:74:70:19:9D:2A:BE:11:E3:81:D1 CKA_CLASS CK_OBJECT_CLASS CKO_CERTIFICATE CKA_TOKEN CK_BBOOL CK_TRUE @@ -9014,7 +8771,7 @@ CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE # Subject: CN=T-TeleSec GlobalRoot Class 3,OU=T-Systems Trust Center,O=T-Systems Enterprise Services GmbH,C=DE # Not Valid Before: Wed Oct 01 10:29:56 2008 # Not Valid After : Sat Oct 01 23:59:59 2033 -# Fingerprint (MD5): CA:FB:40:A8:4E:39:92:8A:1D:FE:8E:2F:C4:27:EA:EF +# Fingerprint (SHA-256): FD:73:DA:D3:1C:64:4F:F1:B4:3B:EF:0C:CD:DA:96:71:0B:9C:D9:87:5E:CA:7E:31:70:7A:F3:E9:6D:52:2B:BD # Fingerprint (SHA1): 55:A6:72:3E:CB:F2:EC:CD:C3:23:74:70:19:9D:2A:BE:11:E3:81:D1 CKA_CLASS CK_OBJECT_CLASS CKO_NSS_TRUST CKA_TOKEN CK_BBOOL CK_TRUE @@ -9047,74 +8804,6 @@ CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_MUST_VERIFY_TRUST CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_MUST_VERIFY_TRUST CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE -# Explicitly Distrust "TURKTRUST Mis-issued Intermediate CA 1", Bug 825022 -# Issuer: O=T..RKTRUST Bilgi ..leti..im ve Bili..im G..venli..i Hizmetleri A...,C=TR,CN=T..RKTRUST Elektronik Sunucu Sertifikas.. Hizmetleri -# Serial Number: 2087 (0x827) -# Subject: CN=*.EGO.GOV.TR,OU=EGO BILGI ISLEM,O=EGO,L=ANKARA,ST=ANKARA,C=TR -# Not Valid Before: Mon Aug 08 07:07:51 2011 -# Not Valid After : Tue Jul 06 07:07:51 2021 -# Fingerprint (MD5): F8:F5:25:FF:0C:31:CF:85:E1:0C:86:17:C1:CE:1F:8E -# Fingerprint (SHA1): C6:9F:28:C8:25:13:9E:65:A6:46:C4:34:AC:A5:A1:D2:00:29:5D:B1 -CKA_CLASS CK_OBJECT_CLASS CKO_NSS_TRUST -CKA_TOKEN CK_BBOOL CK_TRUE -CKA_PRIVATE CK_BBOOL CK_FALSE -CKA_MODIFIABLE CK_BBOOL CK_FALSE -CKA_LABEL UTF8 "TURKTRUST Mis-issued Intermediate CA 1" -CKA_ISSUER MULTILINE_OCTAL -\060\201\254\061\075\060\073\006\003\125\004\003\014\064\124\303 -\234\122\113\124\122\125\123\124\040\105\154\145\153\164\162\157 -\156\151\153\040\123\165\156\165\143\165\040\123\145\162\164\151 -\146\151\153\141\163\304\261\040\110\151\172\155\145\164\154\145 -\162\151\061\013\060\011\006\003\125\004\006\023\002\124\122\061 -\136\060\134\006\003\125\004\012\014\125\124\303\234\122\113\124 -\122\125\123\124\040\102\151\154\147\151\040\304\260\154\145\164 -\151\305\237\151\155\040\166\145\040\102\151\154\151\305\237\151 -\155\040\107\303\274\166\145\156\154\151\304\237\151\040\110\151 -\172\155\145\164\154\145\162\151\040\101\056\305\236\056\040\050 -\143\051\040\113\141\163\304\261\155\040\040\062\060\060\065 -END -CKA_SERIAL_NUMBER MULTILINE_OCTAL -\002\002\010\047 -END -CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_NOT_TRUSTED -CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_NOT_TRUSTED -CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_NOT_TRUSTED -CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE - -# Explicitly Distrust "TURKTRUST Mis-issued Intermediate CA 2", Bug 825022 -# Issuer: O=T..RKTRUST Bilgi ..leti..im ve Bili..im G..venli..i Hizmetleri A...,C=TR,CN=T..RKTRUST Elektronik Sunucu Sertifikas.. Hizmetleri -# Serial Number: 2148 (0x864) -# Subject: E=ileti@kktcmerkezbankasi.org,CN=e-islem.kktcmerkezbankasi.org,O=KKTC Merkez Bankasi,L=Lefkosa,ST=Lefkosa,C=TR -# Not Valid Before: Mon Aug 08 07:07:51 2011 -# Not Valid After : Thu Aug 05 07:07:51 2021 -# Fingerprint (MD5): BF:C3:EC:AD:0F:42:4F:B4:B5:38:DB:35:BF:AD:84:A2 -# Fingerprint (SHA1): F9:2B:E5:26:6C:C0:5D:B2:DC:0D:C3:F2:DC:74:E0:2D:EF:D9:49:CB -CKA_CLASS CK_OBJECT_CLASS CKO_NSS_TRUST -CKA_TOKEN CK_BBOOL CK_TRUE -CKA_PRIVATE CK_BBOOL CK_FALSE -CKA_MODIFIABLE CK_BBOOL CK_FALSE -CKA_LABEL UTF8 "TURKTRUST Mis-issued Intermediate CA 2" -CKA_ISSUER MULTILINE_OCTAL -\060\201\254\061\075\060\073\006\003\125\004\003\014\064\124\303 -\234\122\113\124\122\125\123\124\040\105\154\145\153\164\162\157 -\156\151\153\040\123\165\156\165\143\165\040\123\145\162\164\151 -\146\151\153\141\163\304\261\040\110\151\172\155\145\164\154\145 -\162\151\061\013\060\011\006\003\125\004\006\023\002\124\122\061 -\136\060\134\006\003\125\004\012\014\125\124\303\234\122\113\124 -\122\125\123\124\040\102\151\154\147\151\040\304\260\154\145\164 -\151\305\237\151\155\040\166\145\040\102\151\154\151\305\237\151 -\155\040\107\303\274\166\145\156\154\151\304\237\151\040\110\151 -\172\155\145\164\154\145\162\151\040\101\056\305\236\056\040\050 -\143\051\040\113\141\163\304\261\155\040\040\062\060\060\065 -END -CKA_SERIAL_NUMBER MULTILINE_OCTAL -\002\002\010\144 -END -CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_NOT_TRUSTED -CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_NOT_TRUSTED -CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_NOT_TRUSTED -CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE - # # Certificate "D-TRUST Root Class 3 CA 2 2009" # @@ -9123,7 +8812,7 @@ CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE # Subject: CN=D-TRUST Root Class 3 CA 2 2009,O=D-Trust GmbH,C=DE # Not Valid Before: Thu Nov 05 08:35:58 2009 # Not Valid After : Mon Nov 05 08:35:58 2029 -# Fingerprint (MD5): CD:E0:25:69:8D:47:AC:9C:89:35:90:F7:FD:51:3D:2F +# Fingerprint (SHA-256): 49:E7:A4:42:AC:F0:EA:62:87:05:00:54:B5:25:64:B6:50:E4:F4:9E:42:E3:48:D6:AA:38:E0:39:E9:57:B1:C1 # Fingerprint (SHA1): 58:E8:AB:B0:36:15:33:FB:80:F7:9B:1B:6D:29:D3:FF:8D:5F:00:F0 CKA_CLASS CK_OBJECT_CLASS CKO_CERTIFICATE CKA_TOKEN CK_BBOOL CK_TRUE @@ -9229,7 +8918,7 @@ CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE # Subject: CN=D-TRUST Root Class 3 CA 2 2009,O=D-Trust GmbH,C=DE # Not Valid Before: Thu Nov 05 08:35:58 2009 # Not Valid After : Mon Nov 05 08:35:58 2029 -# Fingerprint (MD5): CD:E0:25:69:8D:47:AC:9C:89:35:90:F7:FD:51:3D:2F +# Fingerprint (SHA-256): 49:E7:A4:42:AC:F0:EA:62:87:05:00:54:B5:25:64:B6:50:E4:F4:9E:42:E3:48:D6:AA:38:E0:39:E9:57:B1:C1 # Fingerprint (SHA1): 58:E8:AB:B0:36:15:33:FB:80:F7:9B:1B:6D:29:D3:FF:8D:5F:00:F0 CKA_CLASS CK_OBJECT_CLASS CKO_NSS_TRUST CKA_TOKEN CK_BBOOL CK_TRUE @@ -9266,7 +8955,7 @@ CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE # Subject: CN=D-TRUST Root Class 3 CA 2 EV 2009,O=D-Trust GmbH,C=DE # Not Valid Before: Thu Nov 05 08:50:46 2009 # Not Valid After : Mon Nov 05 08:50:46 2029 -# Fingerprint (MD5): AA:C6:43:2C:5E:2D:CD:C4:34:C0:50:4F:11:02:4F:B6 +# Fingerprint (SHA-256): EE:C5:49:6B:98:8C:E9:86:25:B9:34:09:2E:EC:29:08:BE:D0:B0:F3:16:C2:D4:73:0C:84:EA:F1:F3:D3:48:81 # Fingerprint (SHA1): 96:C9:1B:0B:95:B4:10:98:42:FA:D0:D8:22:79:FE:60:FA:B9:16:83 CKA_CLASS CK_OBJECT_CLASS CKO_CERTIFICATE CKA_TOKEN CK_BBOOL CK_TRUE @@ -9375,7 +9064,7 @@ CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE # Subject: CN=D-TRUST Root Class 3 CA 2 EV 2009,O=D-Trust GmbH,C=DE # Not Valid Before: Thu Nov 05 08:50:46 2009 # Not Valid After : Mon Nov 05 08:50:46 2029 -# Fingerprint (MD5): AA:C6:43:2C:5E:2D:CD:C4:34:C0:50:4F:11:02:4F:B6 +# Fingerprint (SHA-256): EE:C5:49:6B:98:8C:E9:86:25:B9:34:09:2E:EC:29:08:BE:D0:B0:F3:16:C2:D4:73:0C:84:EA:F1:F3:D3:48:81 # Fingerprint (SHA1): 96:C9:1B:0B:95:B4:10:98:42:FA:D0:D8:22:79:FE:60:FA:B9:16:83 CKA_CLASS CK_OBJECT_CLASS CKO_NSS_TRUST CKA_TOKEN CK_BBOOL CK_TRUE @@ -9413,7 +9102,7 @@ CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE # Subject: CN=CA Disig Root R2,O=Disig a.s.,L=Bratislava,C=SK # Not Valid Before: Thu Jul 19 09:15:30 2012 # Not Valid After : Sat Jul 19 09:15:30 2042 -# Fingerprint (MD5): 26:01:FB:D8:27:A7:17:9A:45:54:38:1A:43:01:3B:03 +# Fingerprint (SHA-256): E2:3D:4A:03:6D:7B:70:E9:F5:95:B1:42:20:79:D2:B9:1E:DF:BB:1F:B6:51:A0:63:3E:AA:8A:9D:C5:F8:07:03 # Fingerprint (SHA1): B5:61:EB:EA:A4:DE:E4:25:4B:69:1A:98:A5:57:47:C2:34:C7:D9:71 CKA_CLASS CK_OBJECT_CLASS CKO_CERTIFICATE CKA_TOKEN CK_BBOOL CK_TRUE @@ -9540,7 +9229,7 @@ CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE # Subject: CN=CA Disig Root R2,O=Disig a.s.,L=Bratislava,C=SK # Not Valid Before: Thu Jul 19 09:15:30 2012 # Not Valid After : Sat Jul 19 09:15:30 2042 -# Fingerprint (MD5): 26:01:FB:D8:27:A7:17:9A:45:54:38:1A:43:01:3B:03 +# Fingerprint (SHA-256): E2:3D:4A:03:6D:7B:70:E9:F5:95:B1:42:20:79:D2:B9:1E:DF:BB:1F:B6:51:A0:63:3E:AA:8A:9D:C5:F8:07:03 # Fingerprint (SHA1): B5:61:EB:EA:A4:DE:E4:25:4B:69:1A:98:A5:57:47:C2:34:C7:D9:71 CKA_CLASS CK_OBJECT_CLASS CKO_NSS_TRUST CKA_TOKEN CK_BBOOL CK_TRUE @@ -9578,7 +9267,7 @@ CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE # Subject: C=ES,O=ACCV,OU=PKIACCV,CN=ACCVRAIZ1 # Not Valid Before: Thu May 05 09:37:37 2011 # Not Valid After : Tue Dec 31 09:37:37 2030 -# Fingerprint (MD5): D0:A0:5A:EE:05:B6:09:94:21:A1:7D:F1:B2:29:82:02 +# Fingerprint (SHA-256): 9A:6E:C0:12:E1:A7:DA:9D:BE:34:19:4D:47:8A:D7:C0:DB:18:22:FB:07:1D:F1:29:81:49:6E:D1:04:38:41:13 # Fingerprint (SHA1): 93:05:7A:88:15:C6:4F:CE:88:2F:FA:91:16:52:28:78:BC:53:64:17 CKA_CLASS CK_OBJECT_CLASS CKO_CERTIFICATE CKA_TOKEN CK_BBOOL CK_TRUE @@ -9742,7 +9431,7 @@ CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE # Subject: C=ES,O=ACCV,OU=PKIACCV,CN=ACCVRAIZ1 # Not Valid Before: Thu May 05 09:37:37 2011 # Not Valid After : Tue Dec 31 09:37:37 2030 -# Fingerprint (MD5): D0:A0:5A:EE:05:B6:09:94:21:A1:7D:F1:B2:29:82:02 +# Fingerprint (SHA-256): 9A:6E:C0:12:E1:A7:DA:9D:BE:34:19:4D:47:8A:D7:C0:DB:18:22:FB:07:1D:F1:29:81:49:6E:D1:04:38:41:13 # Fingerprint (SHA1): 93:05:7A:88:15:C6:4F:CE:88:2F:FA:91:16:52:28:78:BC:53:64:17 CKA_CLASS CK_OBJECT_CLASS CKO_NSS_TRUST CKA_TOKEN CK_BBOOL CK_TRUE @@ -9779,7 +9468,7 @@ CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE # Subject: CN=TWCA Global Root CA,OU=Root CA,O=TAIWAN-CA,C=TW # Not Valid Before: Wed Jun 27 06:28:33 2012 # Not Valid After : Tue Dec 31 15:59:59 2030 -# Fingerprint (MD5): F9:03:7E:CF:E6:9E:3C:73:7A:2A:90:07:69:FF:2B:96 +# Fingerprint (SHA-256): 59:76:90:07:F7:68:5D:0F:CD:50:87:2F:9F:95:D5:75:5A:5B:2B:45:7D:81:F3:69:2B:61:0A:98:67:2F:0E:1B # Fingerprint (SHA1): 9C:BB:48:53:F6:A4:F6:D3:52:A4:E8:32:52:55:60:13:F5:AD:AF:65 CKA_CLASS CK_OBJECT_CLASS CKO_CERTIFICATE CKA_TOKEN CK_BBOOL CK_TRUE @@ -9904,7 +9593,7 @@ CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE # Subject: CN=TWCA Global Root CA,OU=Root CA,O=TAIWAN-CA,C=TW # Not Valid Before: Wed Jun 27 06:28:33 2012 # Not Valid After : Tue Dec 31 15:59:59 2030 -# Fingerprint (MD5): F9:03:7E:CF:E6:9E:3C:73:7A:2A:90:07:69:FF:2B:96 +# Fingerprint (SHA-256): 59:76:90:07:F7:68:5D:0F:CD:50:87:2F:9F:95:D5:75:5A:5B:2B:45:7D:81:F3:69:2B:61:0A:98:67:2F:0E:1B # Fingerprint (SHA1): 9C:BB:48:53:F6:A4:F6:D3:52:A4:E8:32:52:55:60:13:F5:AD:AF:65 CKA_CLASS CK_OBJECT_CLASS CKO_NSS_TRUST CKA_TOKEN CK_BBOOL CK_TRUE @@ -9942,7 +9631,7 @@ CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE # Subject: CN=TeliaSonera Root CA v1,O=TeliaSonera # Not Valid Before: Thu Oct 18 12:00:50 2007 # Not Valid After : Mon Oct 18 12:00:50 2032 -# Fingerprint (MD5): 37:41:49:1B:18:56:9A:26:F5:AD:C2:66:FB:40:A5:4C +# Fingerprint (SHA-256): DD:69:36:FE:21:F8:F0:77:C1:23:A1:A5:21:C1:22:24:F7:22:55:B7:3E:03:A7:26:06:93:E8:A2:4B:0F:A3:89 # Fingerprint (SHA1): 43:13:BB:96:F1:D5:86:9B:C1:4E:6A:92:F6:CF:F6:34:69:87:82:37 CKA_CLASS CK_OBJECT_CLASS CKO_CERTIFICATE CKA_TOKEN CK_BBOOL CK_TRUE @@ -10063,7 +9752,7 @@ CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE # Subject: CN=TeliaSonera Root CA v1,O=TeliaSonera # Not Valid Before: Thu Oct 18 12:00:50 2007 # Not Valid After : Mon Oct 18 12:00:50 2032 -# Fingerprint (MD5): 37:41:49:1B:18:56:9A:26:F5:AD:C2:66:FB:40:A5:4C +# Fingerprint (SHA-256): DD:69:36:FE:21:F8:F0:77:C1:23:A1:A5:21:C1:22:24:F7:22:55:B7:3E:03:A7:26:06:93:E8:A2:4B:0F:A3:89 # Fingerprint (SHA1): 43:13:BB:96:F1:D5:86:9B:C1:4E:6A:92:F6:CF:F6:34:69:87:82:37 CKA_CLASS CK_OBJECT_CLASS CKO_NSS_TRUST CKA_TOKEN CK_BBOOL CK_TRUE @@ -10100,7 +9789,7 @@ CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE # Subject: CN=E-Tugra Certification Authority,OU=E-Tugra Sertifikasyon Merkezi,O=E-Tu..ra EBG Bili..im Teknolojileri ve Hizmetleri A....,L=Ankara,C=TR # Not Valid Before: Tue Mar 05 12:09:48 2013 # Not Valid After : Fri Mar 03 12:09:48 2023 -# Fingerprint (MD5): B8:A1:03:63:B0:BD:21:71:70:8A:6F:13:3A:BB:79:49 +# Fingerprint (SHA-256): B0:BF:D5:2B:B0:D7:D9:BD:92:BF:5D:4D:C1:3D:A2:55:C0:2C:54:2F:37:83:65:EA:89:39:11:F5:5E:55:F2:3C # Fingerprint (SHA1): 51:C6:E7:08:49:06:6E:F3:92:D4:5C:A0:0D:6D:A3:62:8F:C3:52:39 CKA_CLASS CK_OBJECT_CLASS CKO_CERTIFICATE CKA_TOKEN CK_BBOOL CK_TRUE @@ -10253,7 +9942,7 @@ CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE # Subject: CN=E-Tugra Certification Authority,OU=E-Tugra Sertifikasyon Merkezi,O=E-Tu..ra EBG Bili..im Teknolojileri ve Hizmetleri A....,L=Ankara,C=TR # Not Valid Before: Tue Mar 05 12:09:48 2013 # Not Valid After : Fri Mar 03 12:09:48 2023 -# Fingerprint (MD5): B8:A1:03:63:B0:BD:21:71:70:8A:6F:13:3A:BB:79:49 +# Fingerprint (SHA-256): B0:BF:D5:2B:B0:D7:D9:BD:92:BF:5D:4D:C1:3D:A2:55:C0:2C:54:2F:37:83:65:EA:89:39:11:F5:5E:55:F2:3C # Fingerprint (SHA1): 51:C6:E7:08:49:06:6E:F3:92:D4:5C:A0:0D:6D:A3:62:8F:C3:52:39 CKA_CLASS CK_OBJECT_CLASS CKO_NSS_TRUST CKA_TOKEN CK_BBOOL CK_TRUE @@ -10297,7 +9986,7 @@ CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE # Subject: CN=T-TeleSec GlobalRoot Class 2,OU=T-Systems Trust Center,O=T-Systems Enterprise Services GmbH,C=DE # Not Valid Before: Wed Oct 01 10:40:14 2008 # Not Valid After : Sat Oct 01 23:59:59 2033 -# Fingerprint (MD5): 2B:9B:9E:E4:7B:6C:1F:00:72:1A:CC:C1:77:79:DF:6A +# Fingerprint (SHA-256): 91:E2:F5:78:8D:58:10:EB:A7:BA:58:73:7D:E1:54:8A:8E:CA:CD:01:45:98:BC:0B:14:3E:04:1B:17:05:25:52 # Fingerprint (SHA1): 59:0D:2D:7D:88:4F:40:2E:61:7E:A5:62:32:17:65:CF:17:D8:94:E9 CKA_CLASS CK_OBJECT_CLASS CKO_CERTIFICATE CKA_TOKEN CK_BBOOL CK_TRUE @@ -10404,7 +10093,7 @@ CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE # Subject: CN=T-TeleSec GlobalRoot Class 2,OU=T-Systems Trust Center,O=T-Systems Enterprise Services GmbH,C=DE # Not Valid Before: Wed Oct 01 10:40:14 2008 # Not Valid After : Sat Oct 01 23:59:59 2033 -# Fingerprint (MD5): 2B:9B:9E:E4:7B:6C:1F:00:72:1A:CC:C1:77:79:DF:6A +# Fingerprint (SHA-256): 91:E2:F5:78:8D:58:10:EB:A7:BA:58:73:7D:E1:54:8A:8E:CA:CD:01:45:98:BC:0B:14:3E:04:1B:17:05:25:52 # Fingerprint (SHA1): 59:0D:2D:7D:88:4F:40:2E:61:7E:A5:62:32:17:65:CF:17:D8:94:E9 CKA_CLASS CK_OBJECT_CLASS CKO_NSS_TRUST CKA_TOKEN CK_BBOOL CK_TRUE @@ -10445,7 +10134,7 @@ CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE # Subject: C=DE,O=Atos,CN=Atos TrustedRoot 2011 # Not Valid Before: Thu Jul 07 14:58:30 2011 # Not Valid After : Tue Dec 31 23:59:59 2030 -# Fingerprint (MD5): AE:B9:C4:32:4B:AC:7F:5D:66:CC:77:94:BB:2A:77:56 +# Fingerprint (SHA-256): F3:56:BE:A2:44:B7:A9:1E:B3:5D:53:CA:9A:D7:86:4A:CE:01:8E:2D:35:D5:F8:F9:6D:DF:68:A6:F4:1A:A4:74 # Fingerprint (SHA1): 2B:B1:F5:3E:55:0C:1D:C5:F1:D4:E6:B7:6A:46:4B:55:06:02:AC:21 CKA_CLASS CK_OBJECT_CLASS CKO_CERTIFICATE CKA_TOKEN CK_BBOOL CK_TRUE @@ -10537,7 +10226,7 @@ CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE # Subject: C=DE,O=Atos,CN=Atos TrustedRoot 2011 # Not Valid Before: Thu Jul 07 14:58:30 2011 # Not Valid After : Tue Dec 31 23:59:59 2030 -# Fingerprint (MD5): AE:B9:C4:32:4B:AC:7F:5D:66:CC:77:94:BB:2A:77:56 +# Fingerprint (SHA-256): F3:56:BE:A2:44:B7:A9:1E:B3:5D:53:CA:9A:D7:86:4A:CE:01:8E:2D:35:D5:F8:F9:6D:DF:68:A6:F4:1A:A4:74 # Fingerprint (SHA1): 2B:B1:F5:3E:55:0C:1D:C5:F1:D4:E6:B7:6A:46:4B:55:06:02:AC:21 CKA_CLASS CK_OBJECT_CLASS CKO_NSS_TRUST CKA_TOKEN CK_BBOOL CK_TRUE @@ -23399,3 +23088,414 @@ CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_TRUSTED_DELEGATOR CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_TRUSTED_DELEGATOR CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_MUST_VERIFY_TRUST CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE + +# +# Certificate "Telia Root CA v2" +# +# Issuer: CN=Telia Root CA v2,O=Telia Finland Oyj,C=FI +# Serial Number:01:67:5f:27:d6:fe:7a:e3:e4:ac:be:09:5b:05:9e +# Subject: CN=Telia Root CA v2,O=Telia Finland Oyj,C=FI +# Not Valid Before: Thu Nov 29 11:55:54 2018 +# Not Valid After : Sun Nov 29 11:55:54 2043 +# Fingerprint (SHA-256): 24:2B:69:74:2F:CB:1E:5B:2A:BF:98:89:8B:94:57:21:87:54:4E:5B:4D:99:11:78:65:73:62:1F:6A:74:B8:2C +# Fingerprint (SHA1): B9:99:CD:D1:73:50:8A:C4:47:05:08:9C:8C:88:FB:BE:A0:2B:40:CD +CKA_CLASS CK_OBJECT_CLASS CKO_CERTIFICATE +CKA_TOKEN CK_BBOOL CK_TRUE +CKA_PRIVATE CK_BBOOL CK_FALSE +CKA_MODIFIABLE CK_BBOOL CK_FALSE +CKA_LABEL UTF8 "Telia Root CA v2" +CKA_CERTIFICATE_TYPE CK_CERTIFICATE_TYPE CKC_X_509 +CKA_SUBJECT MULTILINE_OCTAL +\060\104\061\013\060\011\006\003\125\004\006\023\002\106\111\061 +\032\060\030\006\003\125\004\012\014\021\124\145\154\151\141\040 +\106\151\156\154\141\156\144\040\117\171\152\061\031\060\027\006 +\003\125\004\003\014\020\124\145\154\151\141\040\122\157\157\164 +\040\103\101\040\166\062 +END +CKA_ID UTF8 "0" +CKA_ISSUER MULTILINE_OCTAL +\060\104\061\013\060\011\006\003\125\004\006\023\002\106\111\061 +\032\060\030\006\003\125\004\012\014\021\124\145\154\151\141\040 +\106\151\156\154\141\156\144\040\117\171\152\061\031\060\027\006 +\003\125\004\003\014\020\124\145\154\151\141\040\122\157\157\164 +\040\103\101\040\166\062 +END +CKA_SERIAL_NUMBER MULTILINE_OCTAL +\002\017\001\147\137\047\326\376\172\343\344\254\276\011\133\005 +\236 +END +CKA_VALUE MULTILINE_OCTAL +\060\202\005\164\060\202\003\134\240\003\002\001\002\002\017\001 +\147\137\047\326\376\172\343\344\254\276\011\133\005\236\060\015 +\006\011\052\206\110\206\367\015\001\001\013\005\000\060\104\061 +\013\060\011\006\003\125\004\006\023\002\106\111\061\032\060\030 +\006\003\125\004\012\014\021\124\145\154\151\141\040\106\151\156 +\154\141\156\144\040\117\171\152\061\031\060\027\006\003\125\004 +\003\014\020\124\145\154\151\141\040\122\157\157\164\040\103\101 +\040\166\062\060\036\027\015\061\070\061\061\062\071\061\061\065 +\065\065\064\132\027\015\064\063\061\061\062\071\061\061\065\065 +\065\064\132\060\104\061\013\060\011\006\003\125\004\006\023\002 +\106\111\061\032\060\030\006\003\125\004\012\014\021\124\145\154 +\151\141\040\106\151\156\154\141\156\144\040\117\171\152\061\031 +\060\027\006\003\125\004\003\014\020\124\145\154\151\141\040\122 +\157\157\164\040\103\101\040\166\062\060\202\002\042\060\015\006 +\011\052\206\110\206\367\015\001\001\001\005\000\003\202\002\017 +\000\060\202\002\012\002\202\002\001\000\262\320\077\007\274\342 +\173\320\153\231\370\342\167\151\347\316\235\244\003\274\202\155 +\241\376\201\145\037\114\047\254\216\000\272\026\173\353\060\152 +\000\300\263\164\150\176\262\257\307\325\142\263\172\077\120\312 +\214\066\104\044\143\322\066\351\014\205\366\103\166\325\114\241 +\140\162\147\342\050\063\245\313\061\270\072\042\043\064\270\175 +\275\126\042\100\235\352\364\173\003\255\150\374\262\201\117\230 +\320\164\352\215\345\175\315\143\303\243\366\336\222\302\130\031 +\340\226\273\305\304\251\075\245\164\226\376\257\371\211\252\275 +\225\027\124\330\170\104\361\014\167\025\222\340\230\102\247\244 +\326\252\040\222\315\301\240\263\226\262\072\204\102\215\175\325 +\225\344\326\333\351\142\304\130\263\171\305\214\323\065\063\203 +\237\165\241\122\047\141\070\361\131\075\216\120\340\275\171\074 +\347\154\226\376\136\331\002\145\264\216\134\320\021\064\337\135 +\277\122\247\201\000\303\177\231\105\231\025\325\027\310\012\123 +\354\143\363\231\175\314\151\022\206\302\027\360\001\236\277\204 +\274\321\122\313\033\222\146\316\244\123\345\241\277\304\333\011 +\326\346\211\126\053\310\343\174\336\343\377\211\345\065\156\050 +\350\154\013\043\121\251\045\005\353\110\370\335\261\312\372\154 +\010\121\357\267\030\154\104\312\046\341\163\306\211\006\201\345 +\212\254\260\342\051\306\271\044\263\153\104\021\364\245\103\302 +\114\103\345\160\066\214\266\063\127\172\225\056\202\240\364\134 +\020\263\141\203\366\002\005\206\056\174\055\154\334\003\106\156 +\065\223\325\172\225\057\336\040\330\133\176\224\220\004\152\272 +\131\075\004\005\165\235\067\242\016\056\075\353\301\244\122\203 +\376\320\153\324\146\216\334\306\351\022\116\035\052\127\252\020 +\274\174\136\202\175\246\246\311\362\055\271\365\027\047\255\321 +\016\211\124\053\225\372\300\255\035\230\024\170\063\102\206\012 +\251\163\265\373\164\015\267\033\060\031\304\132\016\034\047\267 +\332\030\320\377\212\310\005\272\361\252\034\242\067\267\346\110 +\244\106\054\224\352\250\166\142\107\213\020\123\007\110\127\154 +\342\222\115\266\256\005\313\334\301\112\136\217\254\075\031\116 +\302\355\140\165\053\333\301\312\102\325\002\003\001\000\001\243 +\143\060\141\060\037\006\003\125\035\043\004\030\060\026\200\024 +\162\254\344\063\171\252\105\207\366\375\254\035\236\326\307\057 +\206\330\044\071\060\035\006\003\125\035\016\004\026\004\024\162 +\254\344\063\171\252\105\207\366\375\254\035\236\326\307\057\206 +\330\044\071\060\016\006\003\125\035\017\001\001\377\004\004\003 +\002\001\006\060\017\006\003\125\035\023\001\001\377\004\005\060 +\003\001\001\377\060\015\006\011\052\206\110\206\367\015\001\001 +\013\005\000\003\202\002\001\000\240\073\131\247\011\224\076\066 +\204\322\176\057\071\245\226\227\372\021\255\374\147\363\161\011 +\362\262\211\204\147\104\257\271\357\355\226\354\234\144\333\062 +\060\157\147\232\254\176\137\262\253\001\066\176\201\372\344\204 +\136\322\254\066\340\153\142\305\175\113\016\202\155\322\166\142 +\321\376\227\370\237\060\174\030\371\264\122\167\202\035\166\333 +\323\035\251\360\301\232\000\275\155\165\330\175\347\372\307\070 +\243\234\160\350\106\171\003\257\056\164\333\165\370\156\123\014 +\003\310\231\032\211\065\031\074\323\311\124\174\250\360\054\346 +\156\007\171\157\152\341\346\352\221\202\151\012\035\303\176\131 +\242\236\153\106\025\230\133\323\257\106\035\142\310\316\200\122 +\111\021\077\311\004\022\303\023\174\077\073\212\226\333\074\240 +\036\012\264\213\124\262\044\147\015\357\202\313\276\074\175\321 +\342\177\256\026\326\126\130\271\332\040\261\203\025\241\357\212 +\115\062\157\101\057\023\122\202\224\327\032\301\170\242\121\335 +\053\160\155\267\032\371\367\260\340\147\227\126\333\174\141\123 +\011\003\050\002\100\307\263\330\375\234\160\152\306\050\303\205 +\351\342\355\032\223\240\336\113\230\242\204\076\005\167\001\226 +\075\373\264\040\017\234\162\002\172\022\057\325\243\272\121\170 +\257\052\053\104\145\116\265\375\012\350\301\315\171\207\141\053 +\336\200\127\105\277\147\361\233\221\136\245\244\354\131\110\020 +\015\070\307\260\372\303\104\155\004\365\170\120\034\222\226\133 +\332\365\270\056\272\133\317\345\360\152\235\113\057\130\163\055 +\117\055\304\034\076\364\263\077\253\025\016\073\031\101\212\244 +\301\127\022\146\161\114\372\123\343\127\353\142\225\011\236\124 +\335\321\302\074\127\074\275\070\255\230\144\267\270\003\232\123 +\126\140\135\263\330\102\033\134\113\022\212\034\353\353\175\306 +\172\151\307\047\177\244\370\213\362\344\224\146\207\113\351\224 +\007\011\022\171\212\262\353\164\004\334\316\364\104\131\340\026 +\312\305\054\130\327\074\173\317\142\206\152\120\175\065\066\146 +\247\373\067\347\050\307\330\320\255\245\151\224\217\350\301\337 +\044\370\033\007\061\207\201\330\135\366\350\050\330\112\122\200 +\254\023\356\120\024\036\230\307 +END +CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE +CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE +CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE + +# Trust for "Telia Root CA v2" +# Issuer: CN=Telia Root CA v2,O=Telia Finland Oyj,C=FI +# Serial Number:01:67:5f:27:d6:fe:7a:e3:e4:ac:be:09:5b:05:9e +# Subject: CN=Telia Root CA v2,O=Telia Finland Oyj,C=FI +# Not Valid Before: Thu Nov 29 11:55:54 2018 +# Not Valid After : Sun Nov 29 11:55:54 2043 +# Fingerprint (SHA-256): 24:2B:69:74:2F:CB:1E:5B:2A:BF:98:89:8B:94:57:21:87:54:4E:5B:4D:99:11:78:65:73:62:1F:6A:74:B8:2C +# Fingerprint (SHA1): B9:99:CD:D1:73:50:8A:C4:47:05:08:9C:8C:88:FB:BE:A0:2B:40:CD +CKA_CLASS CK_OBJECT_CLASS CKO_NSS_TRUST +CKA_TOKEN CK_BBOOL CK_TRUE +CKA_PRIVATE CK_BBOOL CK_FALSE +CKA_MODIFIABLE CK_BBOOL CK_FALSE +CKA_LABEL UTF8 "Telia Root CA v2" +CKA_CERT_SHA1_HASH MULTILINE_OCTAL +\271\231\315\321\163\120\212\304\107\005\010\234\214\210\373\276 +\240\053\100\315 +END +CKA_CERT_MD5_HASH MULTILINE_OCTAL +\016\217\254\252\202\337\205\261\364\334\020\034\374\231\331\110 +END +CKA_ISSUER MULTILINE_OCTAL +\060\104\061\013\060\011\006\003\125\004\006\023\002\106\111\061 +\032\060\030\006\003\125\004\012\014\021\124\145\154\151\141\040 +\106\151\156\154\141\156\144\040\117\171\152\061\031\060\027\006 +\003\125\004\003\014\020\124\145\154\151\141\040\122\157\157\164 +\040\103\101\040\166\062 +END +CKA_SERIAL_NUMBER MULTILINE_OCTAL +\002\017\001\147\137\047\326\376\172\343\344\254\276\011\133\005 +\236 +END +CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_TRUSTED_DELEGATOR +CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_TRUSTED_DELEGATOR +CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_MUST_VERIFY_TRUST +CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE + +# +# Certificate "D-TRUST BR Root CA 1 2020" +# +# Issuer: CN=D-TRUST BR Root CA 1 2020,O=D-Trust GmbH,C=DE +# Serial Number:7c:c9:8f:2b:84:d7:df:ea:0f:c9:65:9a:d3:4b:4d:96 +# Subject: CN=D-TRUST BR Root CA 1 2020,O=D-Trust GmbH,C=DE +# Not Valid Before: Tue Feb 11 09:45:00 2020 +# Not Valid After : Sun Feb 11 09:44:59 2035 +# Fingerprint (SHA-256): E5:9A:AA:81:60:09:C2:2B:FF:5B:25:BA:D3:7D:F3:06:F0:49:79:7C:1F:81:D8:5A:B0:89:E6:57:BD:8F:00:44 +# Fingerprint (SHA1): 1F:5B:98:F0:E3:B5:F7:74:3C:ED:E6:B0:36:7D:32:CD:F4:09:41:67 +CKA_CLASS CK_OBJECT_CLASS CKO_CERTIFICATE +CKA_TOKEN CK_BBOOL CK_TRUE +CKA_PRIVATE CK_BBOOL CK_FALSE +CKA_MODIFIABLE CK_BBOOL CK_FALSE +CKA_LABEL UTF8 "D-TRUST BR Root CA 1 2020" +CKA_CERTIFICATE_TYPE CK_CERTIFICATE_TYPE CKC_X_509 +CKA_SUBJECT MULTILINE_OCTAL +\060\110\061\013\060\011\006\003\125\004\006\023\002\104\105\061 +\025\060\023\006\003\125\004\012\023\014\104\055\124\162\165\163 +\164\040\107\155\142\110\061\042\060\040\006\003\125\004\003\023 +\031\104\055\124\122\125\123\124\040\102\122\040\122\157\157\164 +\040\103\101\040\061\040\062\060\062\060 +END +CKA_ID UTF8 "0" +CKA_ISSUER MULTILINE_OCTAL +\060\110\061\013\060\011\006\003\125\004\006\023\002\104\105\061 +\025\060\023\006\003\125\004\012\023\014\104\055\124\162\165\163 +\164\040\107\155\142\110\061\042\060\040\006\003\125\004\003\023 +\031\104\055\124\122\125\123\124\040\102\122\040\122\157\157\164 +\040\103\101\040\061\040\062\060\062\060 +END +CKA_SERIAL_NUMBER MULTILINE_OCTAL +\002\020\174\311\217\053\204\327\337\352\017\311\145\232\323\113 +\115\226 +END +CKA_VALUE MULTILINE_OCTAL +\060\202\002\333\060\202\002\140\240\003\002\001\002\002\020\174 +\311\217\053\204\327\337\352\017\311\145\232\323\113\115\226\060 +\012\006\010\052\206\110\316\075\004\003\003\060\110\061\013\060 +\011\006\003\125\004\006\023\002\104\105\061\025\060\023\006\003 +\125\004\012\023\014\104\055\124\162\165\163\164\040\107\155\142 +\110\061\042\060\040\006\003\125\004\003\023\031\104\055\124\122 +\125\123\124\040\102\122\040\122\157\157\164\040\103\101\040\061 +\040\062\060\062\060\060\036\027\015\062\060\060\062\061\061\060 +\071\064\065\060\060\132\027\015\063\065\060\062\061\061\060\071 +\064\064\065\071\132\060\110\061\013\060\011\006\003\125\004\006 +\023\002\104\105\061\025\060\023\006\003\125\004\012\023\014\104 +\055\124\162\165\163\164\040\107\155\142\110\061\042\060\040\006 +\003\125\004\003\023\031\104\055\124\122\125\123\124\040\102\122 +\040\122\157\157\164\040\103\101\040\061\040\062\060\062\060\060 +\166\060\020\006\007\052\206\110\316\075\002\001\006\005\053\201 +\004\000\042\003\142\000\004\306\313\307\050\321\373\204\365\232 +\357\102\024\040\341\103\153\156\165\255\374\053\003\204\324\166 +\223\045\327\131\073\101\145\153\036\346\064\052\273\164\366\022 +\316\350\155\347\253\344\074\116\077\104\010\213\315\026\161\313 +\277\222\231\364\244\327\074\120\124\122\220\205\203\170\224\147 +\147\243\034\011\031\075\165\064\205\336\355\140\175\307\014\264 +\101\122\271\156\345\356\102\243\202\001\015\060\202\001\011\060 +\017\006\003\125\035\023\001\001\377\004\005\060\003\001\001\377 +\060\035\006\003\125\035\016\004\026\004\024\163\221\020\253\377 +\125\263\132\174\011\045\325\262\272\010\240\153\253\037\155\060 +\016\006\003\125\035\017\001\001\377\004\004\003\002\001\006\060 +\201\306\006\003\125\035\037\004\201\276\060\201\273\060\076\240 +\074\240\072\206\070\150\164\164\160\072\057\057\143\162\154\056 +\144\055\164\162\165\163\164\056\156\145\164\057\143\162\154\057 +\144\055\164\162\165\163\164\137\142\162\137\162\157\157\164\137 +\143\141\137\061\137\062\060\062\060\056\143\162\154\060\171\240 +\167\240\165\206\163\154\144\141\160\072\057\057\144\151\162\145 +\143\164\157\162\171\056\144\055\164\162\165\163\164\056\156\145 +\164\057\103\116\075\104\055\124\122\125\123\124\045\062\060\102 +\122\045\062\060\122\157\157\164\045\062\060\103\101\045\062\060 +\061\045\062\060\062\060\062\060\054\117\075\104\055\124\162\165 +\163\164\045\062\060\107\155\142\110\054\103\075\104\105\077\143 +\145\162\164\151\146\151\143\141\164\145\162\145\166\157\143\141 +\164\151\157\156\154\151\163\164\060\012\006\010\052\206\110\316 +\075\004\003\003\003\151\000\060\146\002\061\000\224\220\055\023 +\372\341\143\370\141\143\350\255\205\170\124\221\234\270\223\070 +\076\032\101\332\100\026\123\102\010\312\057\216\361\076\201\126 +\300\252\330\355\030\304\260\256\364\076\372\046\002\061\000\363 +\050\342\306\333\053\231\373\267\121\270\044\243\244\224\172\032 +\077\346\066\342\003\127\063\212\060\313\202\307\326\024\021\325 +\165\143\133\024\225\234\037\001\317\330\325\162\247\017\073 +END +CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE +CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE +CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE + +# Trust for "D-TRUST BR Root CA 1 2020" +# Issuer: CN=D-TRUST BR Root CA 1 2020,O=D-Trust GmbH,C=DE +# Serial Number:7c:c9:8f:2b:84:d7:df:ea:0f:c9:65:9a:d3:4b:4d:96 +# Subject: CN=D-TRUST BR Root CA 1 2020,O=D-Trust GmbH,C=DE +# Not Valid Before: Tue Feb 11 09:45:00 2020 +# Not Valid After : Sun Feb 11 09:44:59 2035 +# Fingerprint (SHA-256): E5:9A:AA:81:60:09:C2:2B:FF:5B:25:BA:D3:7D:F3:06:F0:49:79:7C:1F:81:D8:5A:B0:89:E6:57:BD:8F:00:44 +# Fingerprint (SHA1): 1F:5B:98:F0:E3:B5:F7:74:3C:ED:E6:B0:36:7D:32:CD:F4:09:41:67 +CKA_CLASS CK_OBJECT_CLASS CKO_NSS_TRUST +CKA_TOKEN CK_BBOOL CK_TRUE +CKA_PRIVATE CK_BBOOL CK_FALSE +CKA_MODIFIABLE CK_BBOOL CK_FALSE +CKA_LABEL UTF8 "D-TRUST BR Root CA 1 2020" +CKA_CERT_SHA1_HASH MULTILINE_OCTAL +\037\133\230\360\343\265\367\164\074\355\346\260\066\175\062\315 +\364\011\101\147 +END +CKA_CERT_MD5_HASH MULTILINE_OCTAL +\265\252\113\325\355\367\343\125\056\217\162\012\363\165\270\355 +END +CKA_ISSUER MULTILINE_OCTAL +\060\110\061\013\060\011\006\003\125\004\006\023\002\104\105\061 +\025\060\023\006\003\125\004\012\023\014\104\055\124\162\165\163 +\164\040\107\155\142\110\061\042\060\040\006\003\125\004\003\023 +\031\104\055\124\122\125\123\124\040\102\122\040\122\157\157\164 +\040\103\101\040\061\040\062\060\062\060 +END +CKA_SERIAL_NUMBER MULTILINE_OCTAL +\002\020\174\311\217\053\204\327\337\352\017\311\145\232\323\113 +\115\226 +END +CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_TRUSTED_DELEGATOR +CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_MUST_VERIFY_TRUST +CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_MUST_VERIFY_TRUST +CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE + +# +# Certificate "D-TRUST EV Root CA 1 2020" +# +# Issuer: CN=D-TRUST EV Root CA 1 2020,O=D-Trust GmbH,C=DE +# Serial Number:5f:02:41:d7:7a:87:7c:4c:03:a3:ac:96:8d:fb:ff:d0 +# Subject: CN=D-TRUST EV Root CA 1 2020,O=D-Trust GmbH,C=DE +# Not Valid Before: Tue Feb 11 10:00:00 2020 +# Not Valid After : Sun Feb 11 09:59:59 2035 +# Fingerprint (SHA-256): 08:17:0D:1A:A3:64:53:90:1A:2F:95:92:45:E3:47:DB:0C:8D:37:AB:AA:BC:56:B8:1A:A1:00:DC:95:89:70:DB +# Fingerprint (SHA1): 61:DB:8C:21:59:69:03:90:D8:7C:9C:12:86:54:CF:9D:3D:F4:DD:07 +CKA_CLASS CK_OBJECT_CLASS CKO_CERTIFICATE +CKA_TOKEN CK_BBOOL CK_TRUE +CKA_PRIVATE CK_BBOOL CK_FALSE +CKA_MODIFIABLE CK_BBOOL CK_FALSE +CKA_LABEL UTF8 "D-TRUST EV Root CA 1 2020" +CKA_CERTIFICATE_TYPE CK_CERTIFICATE_TYPE CKC_X_509 +CKA_SUBJECT MULTILINE_OCTAL +\060\110\061\013\060\011\006\003\125\004\006\023\002\104\105\061 +\025\060\023\006\003\125\004\012\023\014\104\055\124\162\165\163 +\164\040\107\155\142\110\061\042\060\040\006\003\125\004\003\023 +\031\104\055\124\122\125\123\124\040\105\126\040\122\157\157\164 +\040\103\101\040\061\040\062\060\062\060 +END +CKA_ID UTF8 "0" +CKA_ISSUER MULTILINE_OCTAL +\060\110\061\013\060\011\006\003\125\004\006\023\002\104\105\061 +\025\060\023\006\003\125\004\012\023\014\104\055\124\162\165\163 +\164\040\107\155\142\110\061\042\060\040\006\003\125\004\003\023 +\031\104\055\124\122\125\123\124\040\105\126\040\122\157\157\164 +\040\103\101\040\061\040\062\060\062\060 +END +CKA_SERIAL_NUMBER MULTILINE_OCTAL +\002\020\137\002\101\327\172\207\174\114\003\243\254\226\215\373 +\377\320 +END +CKA_VALUE MULTILINE_OCTAL +\060\202\002\333\060\202\002\140\240\003\002\001\002\002\020\137 +\002\101\327\172\207\174\114\003\243\254\226\215\373\377\320\060 +\012\006\010\052\206\110\316\075\004\003\003\060\110\061\013\060 +\011\006\003\125\004\006\023\002\104\105\061\025\060\023\006\003 +\125\004\012\023\014\104\055\124\162\165\163\164\040\107\155\142 +\110\061\042\060\040\006\003\125\004\003\023\031\104\055\124\122 +\125\123\124\040\105\126\040\122\157\157\164\040\103\101\040\061 +\040\062\060\062\060\060\036\027\015\062\060\060\062\061\061\061 +\060\060\060\060\060\132\027\015\063\065\060\062\061\061\060\071 +\065\071\065\071\132\060\110\061\013\060\011\006\003\125\004\006 +\023\002\104\105\061\025\060\023\006\003\125\004\012\023\014\104 +\055\124\162\165\163\164\040\107\155\142\110\061\042\060\040\006 +\003\125\004\003\023\031\104\055\124\122\125\123\124\040\105\126 +\040\122\157\157\164\040\103\101\040\061\040\062\060\062\060\060 +\166\060\020\006\007\052\206\110\316\075\002\001\006\005\053\201 +\004\000\042\003\142\000\004\361\013\335\206\103\040\031\337\227 +\205\350\042\112\233\317\235\230\277\264\005\046\311\313\343\246 +\322\217\305\236\170\173\061\211\251\211\255\047\074\145\020\202 +\374\337\303\235\116\360\063\043\304\322\062\365\034\260\337\063 +\027\135\305\360\261\212\371\357\271\267\024\312\051\112\302\017 +\251\177\165\145\111\052\060\147\364\144\367\326\032\167\332\303 +\302\227\141\102\173\111\255\243\202\001\015\060\202\001\011\060 +\017\006\003\125\035\023\001\001\377\004\005\060\003\001\001\377 +\060\035\006\003\125\035\016\004\026\004\024\177\020\001\026\067 +\072\244\050\344\120\370\244\367\354\153\062\266\376\351\213\060 +\016\006\003\125\035\017\001\001\377\004\004\003\002\001\006\060 +\201\306\006\003\125\035\037\004\201\276\060\201\273\060\076\240 +\074\240\072\206\070\150\164\164\160\072\057\057\143\162\154\056 +\144\055\164\162\165\163\164\056\156\145\164\057\143\162\154\057 +\144\055\164\162\165\163\164\137\145\166\137\162\157\157\164\137 +\143\141\137\061\137\062\060\062\060\056\143\162\154\060\171\240 +\167\240\165\206\163\154\144\141\160\072\057\057\144\151\162\145 +\143\164\157\162\171\056\144\055\164\162\165\163\164\056\156\145 +\164\057\103\116\075\104\055\124\122\125\123\124\045\062\060\105 +\126\045\062\060\122\157\157\164\045\062\060\103\101\045\062\060 +\061\045\062\060\062\060\062\060\054\117\075\104\055\124\162\165 +\163\164\045\062\060\107\155\142\110\054\103\075\104\105\077\143 +\145\162\164\151\146\151\143\141\164\145\162\145\166\157\143\141 +\164\151\157\156\154\151\163\164\060\012\006\010\052\206\110\316 +\075\004\003\003\003\151\000\060\146\002\061\000\312\074\306\052 +\165\302\136\165\142\071\066\000\140\132\213\301\223\231\314\331 +\333\101\073\073\207\231\027\073\325\314\117\312\042\367\240\200 +\313\371\264\261\033\126\365\162\322\374\031\321\002\061\000\221 +\367\060\223\077\020\106\053\161\244\320\073\104\233\300\051\002 +\005\262\101\167\121\363\171\132\236\216\024\240\116\102\322\133 +\201\363\064\152\003\347\042\070\120\133\355\031\117\103\026 +END +CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE +CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE +CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE + +# Trust for "D-TRUST EV Root CA 1 2020" +# Issuer: CN=D-TRUST EV Root CA 1 2020,O=D-Trust GmbH,C=DE +# Serial Number:5f:02:41:d7:7a:87:7c:4c:03:a3:ac:96:8d:fb:ff:d0 +# Subject: CN=D-TRUST EV Root CA 1 2020,O=D-Trust GmbH,C=DE +# Not Valid Before: Tue Feb 11 10:00:00 2020 +# Not Valid After : Sun Feb 11 09:59:59 2035 +# Fingerprint (SHA-256): 08:17:0D:1A:A3:64:53:90:1A:2F:95:92:45:E3:47:DB:0C:8D:37:AB:AA:BC:56:B8:1A:A1:00:DC:95:89:70:DB +# Fingerprint (SHA1): 61:DB:8C:21:59:69:03:90:D8:7C:9C:12:86:54:CF:9D:3D:F4:DD:07 +CKA_CLASS CK_OBJECT_CLASS CKO_NSS_TRUST +CKA_TOKEN CK_BBOOL CK_TRUE +CKA_PRIVATE CK_BBOOL CK_FALSE +CKA_MODIFIABLE CK_BBOOL CK_FALSE +CKA_LABEL UTF8 "D-TRUST EV Root CA 1 2020" +CKA_CERT_SHA1_HASH MULTILINE_OCTAL +\141\333\214\041\131\151\003\220\330\174\234\022\206\124\317\235 +\075\364\335\007 +END +CKA_CERT_MD5_HASH MULTILINE_OCTAL +\214\055\235\160\237\110\231\021\006\021\373\351\313\060\300\156 +END +CKA_ISSUER MULTILINE_OCTAL +\060\110\061\013\060\011\006\003\125\004\006\023\002\104\105\061 +\025\060\023\006\003\125\004\012\023\014\104\055\124\162\165\163 +\164\040\107\155\142\110\061\042\060\040\006\003\125\004\003\023 +\031\104\055\124\122\125\123\124\040\105\126\040\122\157\157\164 +\040\103\101\040\061\040\062\060\062\060 +END +CKA_SERIAL_NUMBER MULTILINE_OCTAL +\002\020\137\002\101\327\172\207\174\114\003\243\254\226\215\373 +\377\320 +END +CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_TRUSTED_DELEGATOR +CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_MUST_VERIFY_TRUST +CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_MUST_VERIFY_TRUST +CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE diff --git a/security/nss/lib/dev/dev.h b/security/nss/lib/dev/dev.h index 26ac8957e9..6430511442 100644 --- a/security/nss/lib/dev/dev.h +++ b/security/nss/lib/dev/dev.h @@ -146,7 +146,6 @@ nssModule_GetCertOrder( * nssSlot_Destroy * nssSlot_AddRef * nssSlot_GetName - * nssSlot_GetTokenName * nssSlot_IsTokenPresent * nssSlot_IsPermanent * nssSlot_IsFriendly @@ -176,10 +175,6 @@ NSS_EXTERN NSSUTF8 * nssSlot_GetName( NSSSlot *slot); -NSS_EXTERN NSSUTF8 * -nssSlot_GetTokenName( - NSSSlot *slot); - NSS_EXTERN NSSModule * nssSlot_GetModule( NSSSlot *slot); diff --git a/security/nss/lib/dev/devslot.c b/security/nss/lib/dev/devslot.c index ebd6e6aa5e..fc14648497 100644 --- a/security/nss/lib/dev/devslot.c +++ b/security/nss/lib/dev/devslot.c @@ -12,7 +12,9 @@ #include "ckhelper.h" #endif /* CKHELPER_H */ -#include "pk11pub.h" +#include "pkim.h" +#include "dev3hack.h" +#include "pk11func.h" /* measured in seconds */ #define NSSSLOT_TOKEN_DELAY_TIME 1 @@ -79,13 +81,6 @@ nssSlot_GetName( return slot->base.name; } -NSS_IMPLEMENT NSSUTF8 * -nssSlot_GetTokenName( - NSSSlot *slot) -{ - return nssToken_GetName(slot->token); -} - NSS_IMPLEMENT void nssSlot_ResetDelay( NSSSlot *slot) @@ -123,11 +118,13 @@ nssSlot_IsTokenPresent( { CK_RV ckrv; PRStatus nssrv; + NSSToken *nssToken = NULL; /* XXX */ nssSession *session; CK_SLOT_INFO slotInfo; void *epv; PRBool isPresent = PR_FALSE; + PRBool doUpdateCachedCerts = PR_FALSE; /* permanent slots are always present unless they're disabled */ if (nssSlot_IsPermanent(slot)) { @@ -169,23 +166,24 @@ nssSlot_IsTokenPresent( PZ_Unlock(slot->isPresentLock); + nssToken = PK11Slot_GetNSSToken(slot->pk11slot); + if (!nssToken) { + isPresent = PR_FALSE; + goto done; + } + nssSlot_EnterMonitor(slot); ckrv = CKAPI(epv)->C_GetSlotInfo(slot->slotID, &slotInfo); nssSlot_ExitMonitor(slot); if (ckrv != CKR_OK) { - slot->token->base.name[0] = 0; /* XXX */ + nssToken->base.name[0] = 0; /* XXX */ isPresent = PR_FALSE; goto done; } slot->ckFlags = slotInfo.flags; /* check for the presence of the token */ if ((slot->ckFlags & CKF_TOKEN_PRESENT) == 0) { - if (!slot->token) { - /* token was never present */ - isPresent = PR_FALSE; - goto done; - } - session = nssToken_GetDefaultSession(slot->token); + session = nssToken_GetDefaultSession(nssToken); if (session) { nssSession_EnterMonitor(session); /* token is not present */ @@ -197,21 +195,21 @@ nssSlot_IsTokenPresent( } nssSession_ExitMonitor(session); } - if (slot->token->base.name[0] != 0) { + if (nssToken->base.name[0] != 0) { /* notify the high-level cache that the token is removed */ - slot->token->base.name[0] = 0; /* XXX */ - nssToken_NotifyCertsNotVisible(slot->token); + nssToken->base.name[0] = 0; /* XXX */ + nssToken_NotifyCertsNotVisible(nssToken); } - slot->token->base.name[0] = 0; /* XXX */ + nssToken->base.name[0] = 0; /* XXX */ /* clear the token cache */ - nssToken_Remove(slot->token); + nssToken_Remove(nssToken); isPresent = PR_FALSE; goto done; } /* token is present, use the session info to determine if the card * has been removed and reinserted. */ - session = nssToken_GetDefaultSession(slot->token); + session = nssToken_GetDefaultSession(nssToken); if (session) { PRBool tokenRemoved; nssSession_EnterMonitor(session); @@ -237,17 +235,31 @@ nssSlot_IsTokenPresent( * a token it doesn't recognize. invalidate all the old * information we had on this token, if we can't refresh, clear * the present flag */ - nssToken_NotifyCertsNotVisible(slot->token); - nssToken_Remove(slot->token); - /* token has been removed, need to refresh with new session */ - nssrv = nssSlot_Refresh(slot); - isPresent = PR_TRUE; + nssToken_NotifyCertsNotVisible(nssToken); + nssToken_Remove(nssToken); + if (nssToken->base.name[0] == 0) { + doUpdateCachedCerts = PR_TRUE; + } + if (PK11_InitToken(slot->pk11slot, PR_FALSE) != SECSuccess) { + isPresent = PR_FALSE; + goto done; + } + if (doUpdateCachedCerts) { + nssTrustDomain_UpdateCachedTokenCerts(nssToken->trustDomain, + nssToken); + } + nssrv = nssToken_Refresh(nssToken); if (nssrv != PR_SUCCESS) { - slot->token->base.name[0] = 0; /* XXX */ + nssToken->base.name[0] = 0; /* XXX */ slot->ckFlags &= ~CKF_TOKEN_PRESENT; isPresent = PR_FALSE; + goto done; } + isPresent = PR_TRUE; done: + if (nssToken) { + (void)nssToken_Destroy(nssToken); + } /* Once we've set up the condition variable, * Before returning, it's necessary to: * 1) Set the lastTokenPingTime so that any other threads waiting on this @@ -283,12 +295,7 @@ nssSlot_GetToken( NSSToken *rvToken = NULL; if (nssSlot_IsTokenPresent(slot)) { - /* Even if a token should be present, check `slot->token` too as it - * might be gone already. This would happen mostly on shutdown. */ - nssSlot_EnterMonitor(slot); - if (slot->token) - rvToken = nssToken_AddRef(slot->token); - nssSlot_ExitMonitor(slot); + rvToken = PK11Slot_GetNSSToken(slot->pk11slot); } return rvToken; diff --git a/security/nss/lib/dev/devt.h b/security/nss/lib/dev/devt.h index 06a57ad05b..19af26f081 100644 --- a/security/nss/lib/dev/devt.h +++ b/security/nss/lib/dev/devt.h @@ -81,7 +81,6 @@ typedef enum { struct NSSSlotStr { struct nssDeviceBaseStr base; NSSModule *module; /* Parent */ - NSSToken *token; /* Peer */ CK_SLOT_ID slotID; CK_FLAGS ckFlags; /* from CK_SLOT_INFO.flags */ struct nssSlotAuthInfoStr authInfo; diff --git a/security/nss/lib/dev/devtoken.c b/security/nss/lib/dev/devtoken.c index 2d89289702..d155d3b2ba 100644 --- a/security/nss/lib/dev/devtoken.c +++ b/security/nss/lib/dev/devtoken.c @@ -32,13 +32,6 @@ nssToken_Destroy( PK11_FreeSlot(tok->pk11slot); PZ_DestroyLock(tok->base.lock); nssTokenObjectCache_Destroy(tok->cache); - - /* We're going away, let the nssSlot know in case it's held - * alive by someone else. Usually we should hold the last ref. */ - nssSlot_EnterMonitor(tok->slot); - tok->slot->token = NULL; - nssSlot_ExitMonitor(tok->slot); - (void)nssSlot_Destroy(tok->slot); return nssArena_Destroy(tok->base.arena); } diff --git a/security/nss/lib/nss/nss.def b/security/nss/lib/nss/nss.def index 41cce1cbe7..ce369aa7dd 100644 --- a/security/nss/lib/nss/nss.def +++ b/security/nss/lib/nss/nss.def @@ -1163,3 +1163,12 @@ PK11_GetCertsMatchingPrivateKey; ;+ local: ;+ *; ;+}; +;+NSS_3.77 { # NSS 3.77 release +;+ global: +CERT_FilterCertListByCertList; +CERT_FilterCertListByNickname; +CERT_IsInList; +PK11_FindObjectForCert; +;+ local: +;+ *; +;+}; diff --git a/security/nss/lib/pk11wrap/dev3hack.c b/security/nss/lib/pk11wrap/dev3hack.c index 3fb0cb0aa2..c28e2cb706 100644 --- a/security/nss/lib/pk11wrap/dev3hack.c +++ b/security/nss/lib/pk11wrap/dev3hack.c @@ -179,7 +179,6 @@ nssToken_CreateFromPK11SlotInfo(NSSTrustDomain *td, PK11SlotInfo *nss3slot) if (!rvToken->slot) { goto loser; } - rvToken->slot->token = rvToken; if (rvToken->defaultSession) rvToken->defaultSession->slot = rvToken->slot; return rvToken; @@ -227,24 +226,6 @@ nssToken_Refresh(NSSToken *token) return token->defaultSession ? PR_SUCCESS : PR_FAILURE; } -NSS_IMPLEMENT PRStatus -nssSlot_Refresh(NSSSlot *slot) -{ - PK11SlotInfo *nss3slot = slot->pk11slot; - PRBool doit = PR_FALSE; - if (slot->token && slot->token->base.name[0] == 0) { - doit = PR_TRUE; - } - if (PK11_InitToken(nss3slot, PR_FALSE) != SECSuccess) { - return PR_FAILURE; - } - if (doit) { - nssTrustDomain_UpdateCachedTokenCerts(slot->token->trustDomain, - slot->token); - } - return nssToken_Refresh(slot->token); -} - NSS_IMPLEMENT PRStatus nssToken_GetTrustOrder(NSSToken *tok) { diff --git a/security/nss/lib/pk11wrap/pk11obj.c b/security/nss/lib/pk11wrap/pk11obj.c index 09ceb11d05..d26351ad25 100644 --- a/security/nss/lib/pk11wrap/pk11obj.c +++ b/security/nss/lib/pk11wrap/pk11obj.c @@ -1722,7 +1722,10 @@ PK11_WriteRawAttribute(PK11ObjectType objType, void *objSpec, slot = ((PK11SymKey *)objSpec)->slot; handle = ((PK11SymKey *)objSpec)->objectID; break; - case PK11_TypeCert: /* don't handle cert case for now */ + case PK11_TypeCert: + handle = PK11_FindObjectForCert((CERTCertificate *)objSpec, NULL, + &slot); + break; default: break; } diff --git a/security/nss/lib/pk11wrap/pk11pub.h b/security/nss/lib/pk11wrap/pk11pub.h index 30e4cbd89b..e1f2ca3d43 100644 --- a/security/nss/lib/pk11wrap/pk11pub.h +++ b/security/nss/lib/pk11wrap/pk11pub.h @@ -680,6 +680,8 @@ CERTCertificate *PK11_FindBestKEAMatch(CERTCertificate *serverCert, void *wincx) PRBool PK11_FortezzaHasKEA(CERTCertificate *cert); CK_OBJECT_HANDLE PK11_FindCertInSlot(PK11SlotInfo *slot, CERTCertificate *cert, void *wincx); +CK_OBJECT_HANDLE PK11_FindObjectForCert(CERTCertificate *cert, + void *wincx, PK11SlotInfo **pSlot); SECStatus PK11_TraverseCertsForNicknameInSlot(SECItem *nickname, PK11SlotInfo *slot, SECStatus (*callback)(CERTCertificate *, void *), void *arg); diff --git a/security/nss/lib/ssl/authcert.c b/security/nss/lib/ssl/authcert.c index 737b4e797d..54b6f59506 100644 --- a/security/nss/lib/ssl/authcert.c +++ b/security/nss/lib/ssl/authcert.c @@ -19,6 +19,149 @@ #include "pk11func.h" /* for PK11_ function calls */ #include "sslimpl.h" +/* convert a CERTDistNameStr to an array ascii strings. + * we ignore caNames which we can't convert, so n could be less than nnames + * n is always set, even on failure. + * This function allows us to use the existing CERT_FilterCertListByCANames. */ +static char ** +ssl_DistNamesToStrings(struct CERTDistNamesStr *caNames, int *n) +{ + char **names; + int i; + SECStatus rv; + PLArenaPool *arena; + + *n = 0; + names = PORT_ZNewArray(char *, caNames->nnames); + if (names == NULL) { + return NULL; + } + arena = PORT_NewArena(2048); + if (arena == NULL) { + PORT_Free(names); + return NULL; + } + for (i = 0; i < caNames->nnames; ++i) { + CERTName dn; + rv = SEC_QuickDERDecodeItem(arena, &dn, SEC_ASN1_GET(CERT_NameTemplate), + caNames->names + i); + if (rv != SECSuccess) { + continue; + } + names[*n] = CERT_NameToAscii(&dn); + if (names[*n]) + (*n)++; + } + PORT_FreeArena(arena, PR_FALSE); + return names; +} + +/* free the dist names we allocated in the above function. n must be the + * returned n from that function. */ +static void +ssl_FreeDistNamesStrings(char **strings, int n) +{ + int i; + for (i = 0; i < n; i++) { + PORT_Free(strings[i]); + } + PORT_Free(strings); +} + +PRBool +ssl_CertIsUsable(sslSocket *ss, CERTCertificate *cert) +{ + SECStatus rv; + SSLSignatureScheme scheme; + + if ((ss == NULL) || (cert == NULL)) { + return PR_FALSE; + } + /* There are two ways of handling the old style handshake: + * 1) check the actual record we are using and return true, + * if (!ss->ssl3.hs.hashType == handshake_hash_record && + * ss->ssl3.hs.hashType == handshake_hash_single) { + * return PR_TRUE; + * 2) assume if ss->peerSignatureSchemesCount == 0 we are using the + * old handshake. + * There is one case where using 2 will be wrong: we somehow call this + * function outside the case where of out GetClientAuthData context. + * In that case we don't know that the 'real' peerScheme list is, so the + * best we can do is either always assume good or always assume bad. + * I think the best results is to always assume good, so we use + * option 2 here to handle that case as well.*/ + if (ss->peerSignatureSchemeCount == 0) { + return PR_TRUE; + } + if (ss->peerSignatureSchemes == NULL) { + return PR_FALSE; /* should this really be an assert? */ + } + rv = ssl_PickClientSignatureScheme(ss, cert, NULL, + ss->peerSignatureSchemes, + ss->peerSignatureSchemeCount, + &scheme); + if (rv != SECSuccess) { + return PR_FALSE; + } + return PR_TRUE; +} + +SECStatus +ssl_FilterClientCertListBySSLSocket(sslSocket *ss, CERTCertList *certList) +{ + CERTCertListNode *node; + CERTCertificate *cert; + + if (!certList) { + return SECFailure; + } + + node = CERT_LIST_HEAD(certList); + + while (!CERT_LIST_END(node, certList)) { + cert = node->cert; + if (PR_TRUE != ssl_CertIsUsable(ss, cert)) { + /* cert doesn't match the socket criteria, remove it */ + CERTCertListNode *freenode = node; + node = CERT_LIST_NEXT(node); + CERT_RemoveCertListNode(freenode); + } else { + /* this cert is good, go to the next cert */ + node = CERT_LIST_NEXT(node); + } + } + + return (SECSuccess); +} + +/* This function can be called by the application's custom GetClientAuthHook + * to filter out any certs in the cert list that doesn't match the negotiated + * requirements of the current SSL connection. + */ +SECStatus +SSL_FilterClientCertListBySocket(PRFileDesc *fd, CERTCertList *certList) +{ + sslSocket *ss = ssl_FindSocket(fd); + if (ss == NULL) { + return SECFailure; + } + return ssl_FilterClientCertListBySSLSocket(ss, certList); +} + +/* This function can be called by the application's custom GetClientAuthHook + * to determine if a single certificate matches the negotiated requirements of + * the current SSL connection. + */ +PRBool +SSL_CertIsUsable(PRFileDesc *fd, CERTCertificate *cert) +{ + sslSocket *ss = ssl_FindSocket(fd); + if (ss == NULL) { + return PR_FALSE; + } + return ssl_CertIsUsable(ss, cert); +} + /* * This callback used by SSL to pull client certificate upon * server request @@ -31,6 +174,7 @@ NSS_GetClientAuthData(void *arg, struct SECKEYPrivateKeyStr **pRetKey) { CERTCertificate *cert = NULL; + CERTCertList *certList = NULL; SECKEYPrivateKey *privkey = NULL; char *chosenNickName = (char *)arg; /* CONST */ SECStatus rv = SECFailure; @@ -39,56 +183,68 @@ NSS_GetClientAuthData(void *arg, if (!ss) { return SECFailure; } - void *proto_win = SSL_RevealPinArg(fd); - PRTime now = ssl_Time(ss); + void *pw_arg = SSL_RevealPinArg(fd); - if (chosenNickName) { - cert = CERT_FindUserCertByUsage(CERT_GetDefaultCertDB(), - chosenNickName, certUsageSSLClient, - PR_FALSE, proto_win); - if (cert) { - privkey = PK11_FindKeyByAnyCert(cert, proto_win); - if (privkey) { - rv = SECSuccess; - } else { - CERT_DestroyCertificate(cert); + /* first, handle any token authentication that may be needed */ + if (chosenNickName && pw_arg) { + certList = PK11_FindCertsFromNickname(chosenNickName, pw_arg); + if (certList) { + CERT_FilterCertListForUserCerts(certList); + rv = CERT_FilterCertListByUsage(certList, certUsageSSLClient, + PR_FALSE); + if ((rv != SECSuccess) || CERT_LIST_EMPTY(certList)) { + CERT_DestroyCertList(certList); + certList = NULL; } } - } else { /* no name given, automatically find the right cert. */ - CERTCertNicknames *names; - int i; + } - names = CERT_GetCertNicknames(CERT_GetDefaultCertDB(), - SEC_CERT_NICKNAMES_USER, proto_win); - if (names != NULL) { - for (i = 0; i < names->numnicknames; i++) { - cert = CERT_FindUserCertByUsage(CERT_GetDefaultCertDB(), - names->nicknames[i], certUsageSSLClient, - PR_FALSE, proto_win); - if (!cert) - continue; - /* Only check unexpired certs */ - if (CERT_CheckCertValidTimes(cert, now, PR_TRUE) != - secCertTimeValid) { - CERT_DestroyCertificate(cert); - continue; - } - rv = NSS_CmpCertChainWCANames(cert, caNames); - if (rv == SECSuccess) { - privkey = - PK11_FindKeyByAnyCert(cert, proto_win); - if (privkey) - break; - } - rv = SECFailure; - CERT_DestroyCertificate(cert); - } - CERT_FreeNicknames(names); + /* otherwise look through the cache based on usage + * if chosenNickname is set, we ignore the expiration date */ + if (certList == NULL) { + certList = CERT_FindUserCertsByUsage(CERT_GetDefaultCertDB(), + certUsageSSLClient, + PR_FALSE, chosenNickName == NULL, + pw_arg); + /* filter only the certs that meet the nickname requirements */ + if (chosenNickName) { + rv = CERT_FilterCertListByNickname(certList, chosenNickName, + pw_arg); + } else { + int nnames = 0; + char **names = ssl_DistNamesToStrings(caNames, &nnames); + rv = CERT_FilterCertListByCANames(certList, nnames, names, + certUsageSSLClient); + ssl_FreeDistNamesStrings(names, nnames); + } + if ((rv != SECSuccess) || CERT_LIST_EMPTY(certList)) { + CERT_DestroyCertList(certList); + certList = NULL; } } - if (rv == SECSuccess) { - *pRetCert = cert; - *pRetKey = privkey; + if (certList == NULL) { + /* no user certs meeting the nickname/usage requirements found */ + return SECFailure; } - return rv; + /* now remove any certs that can't meet the connection requirements */ + rv = ssl_FilterClientCertListBySSLSocket(ss, certList); + if ((rv != SECSuccess) || CERT_LIST_EMPTY(certList)) { + // no certs left. + CERT_DestroyCertList(certList); + return SECFailure; + } + + /* now return the top cert in the list. We've strived to make the + * list ordered by the most likely usable cert, so it should be the best + * match. */ + cert = CERT_DupCertificate(CERT_LIST_HEAD(certList)->cert); + CERT_DestroyCertList(certList); + privkey = PK11_FindKeyByAnyCert(cert, pw_arg); + if (privkey == NULL) { + CERT_DestroyCertificate(cert); + return SECFailure; + } + *pRetCert = cert; + *pRetKey = privkey; + return SECSuccess; } diff --git a/security/nss/lib/ssl/ssl.def b/security/nss/lib/ssl/ssl.def index 9a447dbefa..14fc2b9609 100644 --- a/security/nss/lib/ssl/ssl.def +++ b/security/nss/lib/ssl/ssl.def @@ -240,3 +240,10 @@ SSL_GetExperimentalAPI; ;+ local: ;+*; ;+}; +;+NSS_3.77 { # NSS 3.77 release +;+ global: +SSL_CertIsUsable; +SSL_FilterClientCertListBySocket; +;+ local: +;+*; +;+}; diff --git a/security/nss/lib/ssl/ssl.h b/security/nss/lib/ssl/ssl.h index dc5a9d4cd5..4f86c78d94 100644 --- a/security/nss/lib/ssl/ssl.h +++ b/security/nss/lib/ssl/ssl.h @@ -1232,6 +1232,20 @@ NSS_GetClientAuthData(void *arg, struct CERTCertificateStr **pRetCert, struct SECKEYPrivateKeyStr **pRetKey); +/* This function can be called by the appliation's custom GetClientAuthHook + * to filter out any certs in the cert list that doesn't match the negotiated + * requirements of the current SSL connection. + */ +SSL_IMPORT SECStatus +SSL_FilterClientCertListBySocket(PRFileDesc *socket, CERTCertList *certlist); + +/* This function can be called by the application's custom GetClientAuthHook + * to determine if a single certificate matches the negotiated requirements of + * the current SSL connection. + */ +SSL_IMPORT PRBool +SSL_CertIsUsable(PRFileDesc *socket, CERTCertificate *cert); + /* ** Configure DTLS-SRTP (RFC 5764) cipher suite preferences. ** Input is a list of ciphers in descending preference order and a length diff --git a/security/nss/lib/ssl/ssl3con.c b/security/nss/lib/ssl/ssl3con.c index c6ab4f0516..0ed6187df7 100644 --- a/security/nss/lib/ssl/ssl3con.c +++ b/security/nss/lib/ssl/ssl3con.c @@ -6334,11 +6334,19 @@ ssl_CanUseSignatureScheme(SSLSignatureScheme scheme, } SECStatus -ssl_PrivateKeySupportsRsaPss(SECKEYPrivateKey *privKey, - PRBool *supportsRsaPss) +ssl_PrivateKeySupportsRsaPss(SECKEYPrivateKey *privKey, CERTCertificate *cert, + void *pwarg, PRBool *supportsRsaPss) { - PK11SlotInfo *slot; - slot = PK11_GetSlotFromPrivateKey(privKey); + PK11SlotInfo *slot = NULL; + if (privKey) { + slot = PK11_GetSlotFromPrivateKey(privKey); + } else { + CK_OBJECT_HANDLE certID = PK11_FindObjectForCert(cert, pwarg, &slot); + if (certID == CK_INVALID_HANDLE) { + PORT_SetError(SEC_ERROR_LIBRARY_FAILURE); + return SECFailure; + } + } if (!slot) { PORT_SetError(SEC_ERROR_LIBRARY_FAILURE); return SECFailure; @@ -6355,7 +6363,8 @@ ssl_PickSignatureScheme(sslSocket *ss, SECKEYPrivateKey *privKey, const SSLSignatureScheme *peerSchemes, unsigned int peerSchemeCount, - PRBool requireSha1) + PRBool requireSha1, + SSLSignatureScheme *schemePtr) { unsigned int i; PRBool doesRsaPss; @@ -6366,13 +6375,13 @@ ssl_PickSignatureScheme(sslSocket *ss, /* We can't require SHA-1 in TLS 1.3. */ PORT_Assert(!(requireSha1 && isTLS13)); - if (!pubKey || !privKey) { + if (!pubKey || !cert) { PORT_Assert(0); PORT_SetError(SEC_ERROR_LIBRARY_FAILURE); return SECFailure; } - - rv = ssl_PrivateKeySupportsRsaPss(privKey, &doesRsaPss); + rv = ssl_PrivateKeySupportsRsaPss(privKey, cert, ss->pkcs11PinArg, + &doesRsaPss); if (rv != SECSuccess) { return SECFailure; } @@ -6390,7 +6399,7 @@ ssl_PickSignatureScheme(sslSocket *ss, PORT_SetError(SSL_ERROR_UNSUPPORTED_SIGNATURE_ALGORITHM); return SECFailure; } - ss->ssl3.hs.signatureScheme = scheme; + *schemePtr = scheme; return SECSuccess; } @@ -6404,7 +6413,7 @@ ssl_PickSignatureScheme(sslSocket *ss, if (ssl_SignatureSchemeValid(scheme, spkiOid, isTLS13) && ssl_CanUseSignatureScheme(scheme, peerSchemes, peerSchemeCount, requireSha1, doesRsaPss)) { - ss->ssl3.hs.signatureScheme = scheme; + *schemePtr = scheme; return SECSuccess; } } @@ -6462,17 +6471,20 @@ ssl3_PickServerSignatureScheme(sslSocket *ss) cert->serverKeyPair->privKey, ss->xtnData.sigSchemes, ss->xtnData.numSigSchemes, - PR_FALSE /* requireSha1 */); + PR_FALSE /* requireSha1 */, + &ss->ssl3.hs.signatureScheme); } -static SECStatus -ssl_PickClientSignatureScheme(sslSocket *ss, const SSLSignatureScheme *schemes, - unsigned int numSchemes) +SECStatus +ssl_PickClientSignatureScheme(sslSocket *ss, CERTCertificate *clientCertificate, + SECKEYPrivateKey *privKey, + const SSLSignatureScheme *schemes, + unsigned int numSchemes, + SSLSignatureScheme *schemePtr) { - SECKEYPrivateKey *privKey = ss->ssl3.clientPrivateKey; SECStatus rv; PRBool isTLS13 = (PRBool)ss->version >= SSL_LIBRARY_VERSION_TLS_1_3; - SECKEYPublicKey *pubKey = CERT_ExtractPublicKey(ss->ssl3.clientCertificate); + SECKEYPublicKey *pubKey = CERT_ExtractPublicKey(clientCertificate); PORT_Assert(pubKey); @@ -6492,9 +6504,9 @@ ssl_PickClientSignatureScheme(sslSocket *ss, const SSLSignatureScheme *schemes, * older, DSA key size is at most 1024 bits and the hash function must * be SHA-1. */ - rv = ssl_PickSignatureScheme(ss, ss->ssl3.clientCertificate, + rv = ssl_PickSignatureScheme(ss, clientCertificate, pubKey, privKey, schemes, numSchemes, - PR_TRUE /* requireSha1 */); + PR_TRUE /* requireSha1 */, schemePtr); if (rv == SECSuccess) { SECKEY_DestroyPublicKey(pubKey); return SECSuccess; @@ -6502,9 +6514,9 @@ ssl_PickClientSignatureScheme(sslSocket *ss, const SSLSignatureScheme *schemes, /* If this fails, that's because the peer doesn't advertise SHA-1, * so fall back to the full negotiation. */ } - rv = ssl_PickSignatureScheme(ss, ss->ssl3.clientCertificate, + rv = ssl_PickSignatureScheme(ss, clientCertificate, pubKey, privKey, schemes, numSchemes, - PR_FALSE /* requireSha1 */); + PR_FALSE /* requireSha1 */, schemePtr); SECKEY_DestroyPublicKey(pubKey); return rv; } @@ -7690,11 +7702,23 @@ ssl3_CompleteHandleCertificateRequest(sslSocket *ss, PORT_Assert(ss->ssl3.clientPrivateKey == NULL); PORT_Assert(ss->ssl3.clientCertificate == NULL); PORT_Assert(ss->ssl3.clientCertChain == NULL); + /* + * Peer signatures are only available while in the context of + * of a getClientAuthData callback. It is required for proper + * functioning of SSL_CertIsUsable and SSL_FilterClientCertListBySocket + * Calling these functions outside the context of a getClientAuthData + * callback will result in no filtering.*/ + ss->peerSignatureSchemes = signatureSchemes; + ss->peerSignatureSchemeCount = signatureSchemeCount; /* XXX Should pass cert_types and algorithms in this call!! */ rv = (SECStatus)(*ss->getClientAuthData)(ss->getClientAuthDataArg, ss->fd, ca_list, &ss->ssl3.clientCertificate, &ss->ssl3.clientPrivateKey); + /* memory for the signature schemes will go away after the request, + * so don't leave dangling pointers around */ + ss->peerSignatureSchemes = NULL; + ss->peerSignatureSchemeCount = 0; } else { rv = SECFailure; /* force it to send a no_certificate alert */ } @@ -7734,8 +7758,12 @@ ssl3_CompleteHandleCertificateRequest(sslSocket *ss, } if (ss->ssl3.hs.hashType == handshake_hash_record || ss->ssl3.hs.hashType == handshake_hash_single) { - rv = ssl_PickClientSignatureScheme(ss, signatureSchemes, - signatureSchemeCount); + rv = ssl_PickClientSignatureScheme(ss, + ss->ssl3.clientCertificate, + ss->ssl3.clientPrivateKey, + signatureSchemes, + signatureSchemeCount, + &ss->ssl3.hs.signatureScheme); } break; /* not an error */ diff --git a/security/nss/lib/ssl/sslimpl.h b/security/nss/lib/ssl/sslimpl.h index bed5ca3dec..d8945d13c7 100644 --- a/security/nss/lib/ssl/sslimpl.h +++ b/security/nss/lib/ssl/sslimpl.h @@ -1100,6 +1100,10 @@ struct sslSocketStr { /* Anti-replay for TLS 1.3 0-RTT. */ SSLAntiReplayContext *antiReplay; + + /* peer data passed in during getClientAuthData */ + const SSLSignatureScheme *peerSignatureSchemes; + unsigned int peerSignatureSchemeCount; }; struct sslSelfEncryptKeysStr { @@ -1723,6 +1727,8 @@ PRBool ssl3_CipherSuiteAllowedForVersionRange(ssl3CipherSuite cipherSuite, SECStatus ssl3_SelectServerCert(sslSocket *ss); SECStatus ssl_PrivateKeySupportsRsaPss(SECKEYPrivateKey *privKey, + CERTCertificate *cert, + void *pwArg, PRBool *supportsRsaPss); SECStatus ssl_PickSignatureScheme(sslSocket *ss, CERTCertificate *cert, @@ -1730,7 +1736,14 @@ SECStatus ssl_PickSignatureScheme(sslSocket *ss, SECKEYPrivateKey *privKey, const SSLSignatureScheme *peerSchemes, unsigned int peerSchemeCount, - PRBool requireSha1); + PRBool requireSha1, + SSLSignatureScheme *schemPtr); +SECStatus ssl_PickClientSignatureScheme(sslSocket *ss, + CERTCertificate *clientCertificate, + SECKEYPrivateKey *privKey, + const SSLSignatureScheme *schemes, + unsigned int numSchemes, + SSLSignatureScheme *schemePtr); SECOidTag ssl3_HashTypeToOID(SSLHashType hashType); SSLHashType ssl_SignatureSchemeToHashType(SSLSignatureScheme scheme); SSLAuthType ssl_SignatureSchemeToAuthType(SSLSignatureScheme scheme); diff --git a/security/nss/lib/ssl/sslsock.c b/security/nss/lib/ssl/sslsock.c index aa0e76e3ce..495c6ea267 100644 --- a/security/nss/lib/ssl/sslsock.c +++ b/security/nss/lib/ssl/sslsock.c @@ -381,6 +381,10 @@ ssl_DupSocket(sslSocket *os) goto loser; } } + /* The original socket 'owns' the copy of these, so + * just set the target copies to zero */ + ss->peerSignatureSchemes = NULL; + ss->peerSignatureSchemeCount = 0; /* Create security data */ rv = ssl_CopySecurityInfo(ss, os); @@ -468,6 +472,11 @@ ssl_DestroySocketContents(sslSocket *ss) ssl_ClearPRCList(&ss->ssl3.hs.dtlsSentHandshake, NULL); ssl_ClearPRCList(&ss->ssl3.hs.dtlsRcvdHandshake, NULL); + /* data in peer Signature schemes comes from the buffer system, + * so there is nothing to free here. Make sure that's the case */ + PORT_Assert(ss->peerSignatureSchemes == NULL); + PORT_Assert(ss->peerSignatureSchemeCount == 0); + tls13_DestroyESNIKeys(ss->esniKeys); tls13_ReleaseAntiReplayContext(ss->antiReplay); } @@ -2482,6 +2491,8 @@ SSL_ReconfigFD(PRFileDesc *model, PRFileDesc *fd) ss->handshakeCallbackData = sm->handshakeCallbackData; if (sm->pkcs11PinArg) ss->pkcs11PinArg = sm->pkcs11PinArg; + ss->peerSignatureSchemes = NULL; + ss->peerSignatureSchemeCount = 0; return fd; } @@ -4149,6 +4160,8 @@ ssl_NewSocket(PRBool makeLocks, SSLProtocolVariant protocolVariant) ss->esniKeys = NULL; ss->antiReplay = NULL; + ss->peerSignatureSchemes = NULL; + ss->peerSignatureSchemeCount = 0; if (makeLocks) { rv = ssl_MakeLocks(ss); diff --git a/security/nss/lib/ssl/tls13con.c b/security/nss/lib/ssl/tls13con.c index 68c1dfd843..12688f18d0 100644 --- a/security/nss/lib/ssl/tls13con.c +++ b/security/nss/lib/ssl/tls13con.c @@ -1585,7 +1585,8 @@ tls13_SelectServerCert(sslSocket *ss) cert->serverKeyPair->privKey, ss->xtnData.sigSchemes, ss->xtnData.numSigSchemes, - PR_FALSE); + PR_FALSE, + &ss->ssl3.hs.signatureScheme); if (rv == SECSuccess) { /* Found one. */ ss->sec.serverCert = cert; @@ -5808,6 +5809,17 @@ tls13_ClientReadSupportedVersion(sslSocket *ss) return SECFailure; } + /* Any endpoint receiving a Hello message with...ServerHello.legacy_version + * set to 0x0300 (SSL3) MUST abort the handshake with a "protocol_version" + * alert. [RFC8446, Section D.5] + * + * The ServerHello.legacy_version is read into the ss->version field by + * ssl_ClientReadVersion(). */ + if (ss->version == SSL_LIBRARY_VERSION_3_0) { + FATAL_ERROR(ss, SSL_ERROR_RX_MALFORMED_SERVER_HELLO, protocol_version); + return SECFailure; + } + ss->version = SSL_LIBRARY_VERSION_TLS_1_3; return SECSuccess; } diff --git a/security/nss/lib/ssl/tls13subcerts.c b/security/nss/lib/ssl/tls13subcerts.c index 0fca9a7c5e..12e7152abd 100644 --- a/security/nss/lib/ssl/tls13subcerts.c +++ b/security/nss/lib/ssl/tls13subcerts.c @@ -221,7 +221,7 @@ tls13_MaybeSetDelegatedCredential(sslSocket *ss) } priv = ss->sec.serverCert->delegCredKeyPair->privKey; - rv = ssl_PrivateKeySupportsRsaPss(priv, &doesRsaPss); + rv = ssl_PrivateKeySupportsRsaPss(priv, NULL, NULL, &doesRsaPss); if (rv != SECSuccess) { return SECFailure; } diff --git a/security/nss/lib/util/secasn1d.c b/security/nss/lib/util/secasn1d.c index ed237ed72c..14d460a173 100644 --- a/security/nss/lib/util/secasn1d.c +++ b/security/nss/lib/util/secasn1d.c @@ -2743,7 +2743,6 @@ SEC_ASN1DecoderUpdate(SEC_ASN1DecoderContext *cx, sec_asn1d_state *state = NULL; unsigned long consumed; SEC_ASN1EncodingPart what; - sec_asn1d_state *stateEnd = cx->current; if (cx->status == needBytes) cx->status = keepGoing; @@ -2932,7 +2931,7 @@ SEC_ASN1DecoderUpdate(SEC_ASN1DecoderContext *cx, } if (cx->status == decodeError) { - while (state != NULL && stateEnd->parent != state) { + while (state != NULL) { sec_asn1d_free_child(state, PR_TRUE); state = state->parent; } diff --git a/security/nss/mach b/security/nss/mach index ec344c1ec5..b25605b5cb 100644 --- a/security/nss/mach +++ b/security/nss/mach @@ -444,7 +444,8 @@ class covAction(argparse.Action): def runSslGtests(self, outdir): env = { "GTESTFILTER": "*", # Prevent parallel test runs. - "ASAN_OPTIONS": "coverage=1:coverage_dir=" + outdir + "ASAN_OPTIONS": "coverage=1:coverage_dir=" + outdir, + "NSS_DISABLE_UNLOAD": "1" } run_tests("ssl_gtests", env=env, silent=True) diff --git a/security/nss/nss.gyp b/security/nss/nss.gyp index bf8b4d3665..bf1a10b472 100644 --- a/security/nss/nss.gyp +++ b/security/nss/nss.gyp @@ -204,6 +204,7 @@ 'cmd/vfychain/vfychain.gyp:vfychain', 'cmd/vfyserv/vfyserv.gyp:vfyserv', 'cmd/mpitests/mpitests.gyp:mpi_tests', + 'gtests/base_gtest/base_gtest.gyp:base_gtest', 'gtests/certhigh_gtest/certhigh_gtest.gyp:certhigh_gtest', 'gtests/cryptohi_gtest/cryptohi_gtest.gyp:cryptohi_gtest', 'gtests/der_gtest/der_gtest.gyp:der_gtest', diff --git a/security/nss/tests/gtests/gtests.sh b/security/nss/tests/gtests/gtests.sh index 50c0410f0e..408a7e83ad 100644 --- a/security/nss/tests/gtests/gtests.sh +++ b/security/nss/tests/gtests/gtests.sh @@ -98,7 +98,7 @@ gtest_cleanup() } ################## main ################################################# -GTESTS="${GTESTS:-prng_gtest certhigh_gtest certdb_gtest der_gtest pk11_gtest util_gtest freebl_gtest softoken_gtest sysinit_gtest blake2b_gtest smime_gtest mozpkix_gtest}" +GTESTS="${GTESTS:-base_gtest prng_gtest certhigh_gtest certdb_gtest der_gtest pk11_gtest util_gtest freebl_gtest softoken_gtest sysinit_gtest blake2b_gtest smime_gtest mozpkix_gtest}" SOURCE_DIR="$PWD"/../.. gtest_init "$0" gtest_start diff --git a/security/nss/tests/ssl/ssl.sh b/security/nss/tests/ssl/ssl.sh index d8892ed87c..54d7d27432 100644 --- a/security/nss/tests/ssl/ssl.sh +++ b/security/nss/tests/ssl/ssl.sh @@ -723,7 +723,10 @@ ssl_crl_ssl() fi servarg=`echo $sparam | awk '{r=split($0,a,"-r") - 1;print r;}'` pwd=`echo $cparam | grep nss` + # did we select TestUser? user=`echo $cparam | grep TestUser` + # did we explicitly select a cert? + auto=`echo $cparam | grep '\\-n'` _cparam=$cparam case $servarg in 1) if [ -z "$pwd" -o -z "$user" ]; then @@ -732,14 +735,24 @@ ssl_crl_ssl() rev_modvalue=254 fi ;; - 2) rev_modvalue=254 ;; + 2) if [ -z "$auto" ]; then + rev_modvalue=0 + else + rev_modvalue=254 + fi + ;; 3) if [ -z "$pwd" -o -z "$user" ]; then rev_modvalue=0 else rev_modvalue=1 fi ;; - 4) rev_modvalue=1 ;; + 4) if [ -z "$auto" ]; then + rev_modvalue=0 + else + rev_modvalue=1 + fi + ;; esac TEMP_NUM=0 while [ $TEMP_NUM -lt $CRL_GROUP_RANGE ] @@ -747,8 +760,8 @@ ssl_crl_ssl() CURR_SER_NUM=`expr ${CRL_GROUP_BEGIN} + ${TEMP_NUM}` TEMP_NUM=`expr $TEMP_NUM + 1` USER_NICKNAME="TestUser${CURR_SER_NUM}" - cparam=`echo $_cparam | sed -e 's;_; ;g' -e "s/TestUser/$USER_NICKNAME/g" ` - start_selfserv `echo "$sparam" | sed -e 's,_, ,g'` + cparam=`echo $_cparam | sed -e 's;\([^\\]\)_;\1 ;g' -e 's;\\\\_;_;g' -e "s/TestUser/$USER_NICKNAME/g" ` + start_selfserv `echo "$sparam" | sed -e 's;\([^\\]\)_;\1 ;g' -e 's;\\\\_;_;g'` echo "tstclnt -4 -p ${PORT} -h ${HOSTADDR} -f -d ${R_CLIENTDIR} $verbose \\" echo " ${cparam} < ${REQUEST_FILE}" @@ -1130,7 +1143,7 @@ ssl_crl_cache() CURR_SER_NUM=`expr ${CRL_GRP_1_BEGIN} + ${TEMP_NUM}` TEMP_NUM=`expr $TEMP_NUM + 1` USER_NICKNAME="TestUser${CURR_SER_NUM}" - cparam=`echo $_cparam | sed -e 's;_; ;g' -e "s/TestUser/$USER_NICKNAME/g" ` + cparam=`echo $_cparam | sed -e 's;\([^\]\)_;\1 ;g' -e 's;\\_;_;g' -e "s/TestUser/$USER_NICKNAME/g" ` echo "Server Args: $SERV_ARG" echo "tstclnt -4 -p ${PORT} -h ${HOSTADDR} -f -d ${R_CLIENTDIR} $verbose \\" diff --git a/security/nss/tests/ssl/sslauth.txt b/security/nss/tests/ssl/sslauth.txt index 70e498962f..61e4a6c6d4 100644 --- a/security/nss/tests/ssl/sslauth.txt +++ b/security/nss/tests/ssl/sslauth.txt @@ -43,17 +43,18 @@ noECC 0 -r_-r_-r_-E -V_tls1.3:tls1.3_-E_-n_none_-w_nss TLS 1.3 Request don't require client auth on post hs (client does not provide auth) noECC 1 -r_-r_-r_-r_-E -V_tls1.3:tls1.3_-E_-n_none_-w_nss TLS 1.3 Require client auth on post hs (client does not provide auth) noECC 0 -r_-r_-r_-E_-u -V_tls1.3:tls1.3_-E_-n_TestUser_-w_nss TLS 1.3 Request don't require client auth on post hs with session ticket (client auth) + noECC 0 -r_-r_-J_rsa\\_pkcs1\\_sha256 -V_tls1.2:_-w_nss TLS 1.2 Require client auth auto select(RSA) (client auth) # # Use EC cert for client authentication # - ECC 0 -r -V_ssl3:tls1.2_-w_bogus_-n_TestUser-ec TLS Request don't require client auth (EC) (bad password) - ECC 0 -r -V_ssl3:tls1.2_-w_nss_-n_TestUser-ec TLS Request don't require client auth (EC) (client auth) - ECC 254 -r_-r -V_ssl3:tls1.2_-w_bogus_-n_TestUser-ec TLS Require client auth (EC) (bad password) - ECC 0 -r_-r -V_ssl3:tls1.2_-w_nss_-n_TestUser-ec_ TLS Require client auth (EC) (client auth) - ECC 0 -r -V_ssl3:ssl3_-n_TestUser-ec_-w_bogus SSL3 Request don't require client auth (EC) (bad password) - ECC 0 -r -V_ssl3:ssl3_-n_TestUser-ec_-w_nss SSL3 Request don't require client auth (EC) (client auth) - ECC 254 -r_-r -V_ssl3:ssl3_-n_TestUser-ec_-w_bogus SSL3 Require client auth (EC) (bad password) - ECC 0 -r_-r -V_ssl3:ssl3_-n_TestUser-ec_-w_nss SSL3 Require client auth (EC) (client auth) + ECC 0 -r -V_ssl3:tls1.2_-w_bogus_-n_TestUser-ec TLS Request don't require client auth (EC) (bad password) + ECC 0 -r -V_ssl3:tls1.2_-w_nss_-n_TestUser-ec TLS Request don't require client auth (EC) (client auth) + ECC 254 -r_-r -V_ssl3:tls1.2_-w_bogus_-n_TestUser-ec TLS Require client auth (EC) (bad password) + ECC 0 -r_-r -V_ssl3:tls1.2_-w_nss_-n_TestUser-ec_ TLS Require client auth (EC) (client auth) + ECC 0 -r -V_ssl3:ssl3_-n_TestUser-ec_-w_bogus SSL3 Request don't require client auth (EC) (bad password) + ECC 0 -r -V_ssl3:ssl3_-n_TestUser-ec_-w_nss SSL3 Request don't require client auth (EC) (client auth) + ECC 254 -r_-r -V_ssl3:ssl3_-n_TestUser-ec_-w_bogus SSL3 Require client auth (EC) (bad password) + ECC 0 -r_-r -V_ssl3:ssl3_-n_TestUser-ec_-w_nss SSL3 Require client auth (EC) (client auth) ECC 0 -r_-r_-r -V_ssl3:tls1.2_-w_bogus_-n_TestUser-ec TLS Request don't require client auth on 2nd hs (EC) (bad password) ECC 0 -r_-r_-r -V_ssl3:tls1.2_-w_nss_-n_TestUser-ec TLS Request don't require client auth on 2nd hs (EC) (client auth) ECC 1 -r_-r_-r_-r -V_ssl3:tls1.2_-w_bogus_-n_TestUser-ec TLS Require client auth on 2nd hs (EC) (bad password) @@ -62,10 +63,12 @@ ECC 0 -r_-r_-r -V_ssl3:tls1.0_-w_nss_-n_TestUser-ec TLS 1.0 Request don't require client auth on 2nd hs (EC) (client auth) ECC 1 -r_-r_-r_-r -V_ssl3:tls1.0_-w_bogus_-n_TestUser-ec TLS 1.0 Require client auth on 2nd hs (EC) (bad password) ECC 0 -r_-r_-r_-r -V_ssl3:tls1.0_-w_nss_-n_TestUser-ec_ TLS 1.0 Require client auth on 2nd hs (EC) (client auth) - ECC 0 -r_-r_-r -V_ssl3:ssl3_-n_TestUser-ec_-w_bogus SSL3 Request don't require client auth on 2nd hs (EC) (bad password) - ECC 0 -r_-r_-r -V_ssl3:ssl3_-n_TestUser-ec_-w_nss SSL3 Request don't require client auth on 2nd hs (EC) (client auth) - ECC 1 -r_-r_-r_-r -V_ssl3:ssl3_-n_TestUser-ec_-w_bogus SSL3 Require client auth on 2nd hs (EC) (bad password) - ECC 0 -r_-r_-r_-r -V_ssl3:ssl3_-n_TestUser-ec_-w_nss SSL3 Require client auth on 2nd hs (EC) (client auth) + ECC 0 -r_-r_-r -V_ssl3:ssl3_-n_TestUser-ec_-w_bogus SSL3 Request don't require client auth on 2nd hs (EC) (bad password) + ECC 0 -r_-r_-r -V_ssl3:ssl3_-n_TestUser-ec_-w_nss SSL3 Request don't require client auth on 2nd hs (EC) (client auth) + ECC 1 -r_-r_-r_-r -V_ssl3:ssl3_-n_TestUser-ec_-w_bogus SSL3 Require client auth on 2nd hs (EC) (bad password) + ECC 0 -r_-r_-r_-r -V_ssl3:ssl3_-n_TestUser-ec_-w_nss SSL3 Require client auth on 2nd hs (EC) (client auth) + ECC 0 -r_-r_-J_ecdsa\\_secp256r1\\_sha256 -V_tls1.2:_-w_nss TLS 1.2 Require client auth auto select(EC) (client auth) + ECC 0 -r_-r_-J_ecdsa\\_secp256r1\\_sha256,ecdsa\\_secp384r1\\_sha384 -V_tls1.3:_-w_nss TLS 1.3 Require client auth auto select (EC) (client auth) # # SNI Tests #