mk-ca-bundle.md (3598B)
1 --- 2 c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al. 3 SPDX-License-Identifier: curl 4 Title: mk-ca-bundle 5 Section: 1 6 Source: mk-ca-bundle 7 See-also: 8 - curl (1) 9 Added-in: n/a 10 --- 11 12 # NAME 13 14 mk-ca-bundle - convert Mozilla's certificate bundle to PEM format 15 16 # SYNOPSIS 17 18 mk-ca-bundle [options] [output] 19 20 # DESCRIPTION 21 22 This tool downloads the *certdata.txt* file from Mozilla's source tree over 23 HTTPS, then parses it and extracts the included certificates into PEM format. 24 By default, only CA root certificates trusted to issue SSL server 25 authentication certificates are extracted. These are then processed with the 26 OpenSSL command line tool to produce the final ca-bundle output file. 27 28 The default *output* name is **ca-bundle.crt**. By setting it to '-' (a single 29 dash) you get the output sent to STDOUT instead of a file. 30 31 The PEM format this scripts uses for output makes the result readily available 32 for use by just about all OpenSSL or GnuTLS powered applications, such as curl 33 and others. 34 35 # OPTIONS 36 37 The following options are supported: 38 39 ## -b 40 41 backup an existing version of *output* 42 43 ## -d [name] 44 45 specify which Mozilla tree to pull *certdata.txt* from (or a custom URL). 46 Valid names are: **aurora**, **beta**, **central**, **Mozilla**, **nss**, 47 **release** (default). They are shortcuts for which source tree to get the 48 certificate data from. 49 50 ## -f 51 52 force rebuild even if *certdata.txt* is current (Added in version 1.17) 53 54 ## -i 55 56 print version info about used modules 57 58 ## -k 59 60 Allow insecure data transfer. By default (since 1.27) this command fails if 61 the HTTPS transfer fails. This overrides that decision (and opens for 62 man-in-the-middle attacks). 63 64 ## -l 65 66 print license info about *certdata.txt* 67 68 ## -m 69 70 (Added in 1.26) Include meta data comments in the output. The meta data is 71 specific information about each certificate that is stored in the original 72 file as comments and using this option makes those comments get passed on to 73 the output file. The meta data is not parsed in any way by mk-ca-bundle. 74 75 ## -n 76 77 Do not download *certdata.txt* - use the existing. 78 79 ## -p [purposes]:[levels] 80 81 list of Mozilla trust purposes and levels for certificates to include in 82 output. Takes the form of a comma separated list of purposes, a colon, and a 83 comma separated list of levels. The default is to include all certificates 84 trusted to issue SSL Server certificates (*SERVER_AUTH:TRUSTED_DELEGATOR*). 85 86 Valid purposes are: **ALL**, **DIGITAL_SIGNATURE**, **NON_REPUDIATION**, 87 **KEY_ENCIPHERMENT**, **DATA_ENCIPHERMENT**, **KEY_AGREEMENT**, 88 **KEY_CERT_SIGN**, **CRL_SIGN**, **SERVER_AUTH** (default), **CLIENT_AUTH**, 89 **CODE_SIGNING**, **EMAIL_PROTECTION**, **IPSEC_END_SYSTEM**, 90 **IPSEC_TUNNEL**, **IPSEC_USER**, **TIME_STAMPING**, **STEP_UP_APPROVED** 91 92 Valid trust levels are: **ALL**, **TRUSTED_DELEGATOR** (default), **NOT_TRUSTED**, 93 **MUST_VERIFY_TRUST**, **TRUSTED** 94 95 ## -q 96 97 be really quiet (no progress output at all) 98 99 ## -t 100 101 include plain text listing of certificates 102 103 ## -s [algorithms] 104 105 A comma separated list of signature algorithms with which to hash/fingerprint 106 each certificate and output when run in plain text mode. 107 108 Valid algorithms are: 109 ALL, NONE, MD5 (default), SHA1, SHA256, SHA384, SHA512 110 111 ## -u 112 113 unlink (remove) *certdata.txt* after processing 114 115 ## -v 116 117 be verbose and print out processed certificate authorities 118 119 # EXIT STATUS 120 121 Returns 0 on success. Returns 1 if it fails to download data. 122 123 # FILE FORMAT 124 125 The file format used by Mozilla for this trust information is documented here: 126 127 https://p11-glue.freedesktop.org/doc/storing-trust-policy/storing-trust-existing.html