|
 |
d77b68 |
////
|
|
|
d77b68 |
Copyright (C) 2013 Red Hat, Inc.
|
|
|
d77b68 |
|
|
|
d77b68 |
This program is free software; you can redistribute it and/or modify
|
|
|
d77b68 |
it under the terms of the GNU General Public License as published by
|
|
|
d77b68 |
the Free Software Foundation; either version 2 of the License, or
|
|
|
d77b68 |
(at your option) any later version.
|
|
|
d77b68 |
|
|
|
d77b68 |
This program is distributed in the hope that it will be useful,
|
|
|
d77b68 |
but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
|
d77b68 |
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
|
d77b68 |
GNU General Public License for more details.
|
|
|
d77b68 |
////
|
|
|
d77b68 |
|
|
|
d77b68 |
|
|
|
d77b68 |
ca-legacy(8)
|
|
|
d77b68 |
============
|
|
|
d77b68 |
:doctype: manpage
|
|
|
d77b68 |
:man source: ca-legacy
|
|
|
d77b68 |
|
|
|
d77b68 |
|
|
|
d77b68 |
NAME
|
|
|
d77b68 |
----
|
|
|
d77b68 |
ca-legacy - Manage the system configuration for legacy CA certificates
|
|
|
d77b68 |
|
|
|
d77b68 |
|
|
|
d77b68 |
SYNOPSIS
|
|
|
d77b68 |
--------
|
|
|
d77b68 |
*ca-legacy* ['COMMAND']
|
|
|
d77b68 |
|
|
|
d77b68 |
|
|
|
d77b68 |
DESCRIPTION
|
|
|
d77b68 |
-----------
|
|
|
d77b68 |
ca-legacy(8) is used to include or exclude a set of legacy Certificate Authority (CA)
|
|
|
d77b68 |
certificates in the system's list of trusted CA certificates.
|
|
|
d77b68 |
|
|
|
d77b68 |
The list of CA certificates and trust flags included in the ca-certificates package
|
|
|
d77b68 |
are based on the decisions made by Mozilla.org according to the Mozilla CA policy.
|
|
|
d77b68 |
|
|
|
d77b68 |
Occasionally, removal or distrust decisions made by Mozilla.org might be incompatible with the requirements
|
|
|
d77b68 |
or limitations of some applications that also use the CA certificates list in the Linux environment.
|
|
|
d77b68 |
|
|
|
d77b68 |
The ca-certificates package might keep some CA certificates included and trusted by default,
|
|
|
d77b68 |
as long as it is seen necessary by the maintainers, despite the fact that they have
|
|
|
d77b68 |
been removed by Mozilla. These certificates are called legacy CA certificates.
|
|
|
d77b68 |
|
|
|
d77b68 |
The general requirements to keep legacy CA certificates included and trusted might change over time,
|
|
|
d77b68 |
for example if functional limitations of software packages have been resolved.
|
|
|
d77b68 |
Future versions of the ca-certificates package might reduce the set of legacy CA certificates
|
|
|
d77b68 |
that are included and trusted by default.
|
|
|
d77b68 |
|
|
|
d77b68 |
The ca-legacy(8) command can be used to override the default behaviour.
|
|
|
d77b68 |
|
|
|
d77b68 |
The mechanisms to individually trust or distrust CA certificates as described in update-ca-trust(8) still apply.
|
|
|
d77b68 |
|
|
|
d77b68 |
|
|
|
d77b68 |
COMMANDS
|
|
|
d77b68 |
--------
|
|
|
d77b68 |
*check*::
|
|
|
d77b68 |
The current configuration will be shown.
|
|
|
d77b68 |
|
|
|
d77b68 |
*default*::
|
|
|
d77b68 |
Configure the system to use the default configuration, as recommended
|
|
|
d77b68 |
by the package maintainers.
|
|
|
d77b68 |
|
|
|
d77b68 |
*disable*::
|
|
|
d77b68 |
Configure the system to explicitly disable legacy CA certificates.
|
|
|
d77b68 |
Using this configuration, the system will use the set of
|
|
|
d77b68 |
included and trusted CA certificates as released by Mozilla.
|
|
|
d77b68 |
|
|
|
d77b68 |
*install*::
|
|
|
d77b68 |
The configuration file will be read and the system configuration
|
|
|
d77b68 |
will be set accordingly. This command is executed automatically during
|
|
|
d77b68 |
upgrades of the ca-certificates package.
|
|
|
d77b68 |
|
|
|
d77b68 |
|
|
|
d77b68 |
FILES
|
|
|
d77b68 |
-----
|
|
|
d77b68 |
/etc/pki/ca-trust/ca-legacy.conf::
|
|
|
d77b68 |
A configuration file that will be used and modified by the ca-legacy command.
|
|
|
d77b68 |
The contents of the configuration file will be read on package upgrades.
|
|
|
d77b68 |
|
|
|
d77b68 |
AUTHOR
|
|
|
d77b68 |
------
|
|
|
d77b68 |
Written by Kai Engert.
|