Conversation
djc
force-pushed
the
all-certs
branch
3 times, most recently
from
September 4, 2026 13:32
cffcfc7 to
3296986
Compare
djc
changed the title
djc
marked this pull request as ready for review
September 4, 2026 13:32
djc
force-pushed
the
all-certs
branch
3 times, most recently
from
September 4, 2026 13:41
9b9ecfb to
b6fdc4c
Compare
cpu
reviewed
Sep 4, 2026
djc
force-pushed
the
all-certs
branch
2 times, most recently
from
September 4, 2026 14:27
0be9872 to
ce03d2a
Compare
cpu
reviewed
Sep 4, 2026
| let json = rsp.text().await?; | ||
| let data = serde_json::from_str::<AllCertificateRecordsResponse>(&json)?; | ||
| for info in data.data { | ||
| if info.certificate_data.valid_to < today || info.trusted(store) != StoreStatus::Trusted |
Member
There was a problem hiding this comment.
I think the StoreStatus decision might be more complicated. I think for some roots that are trusted, they're marked as "Included" and not "Trusted" (?)
Like:
{
"CCADBUniqueID": "A010979",
"CertificateName": "A-Trust-Root-09",
"CertificateRecordType": "Root Certificate",
"SHA256Fingerprint": "7A38F708A35A31E42E1CF3220F9A2D273E7666354618B2464657D43D8E77ADC2",
"ValidFrom": "2023-02-21",
"ValidTo": "2036-07-14",
"MicrosoftStatus": "Included",
"TLSCapable": true,
"JSONArrayOfAllFullCRLURLs": "[\"http://crl.a-trust.at/crl/A-Trust-Root-09\"]"
}
Member
Author
There was a problem hiding this comment.
Yeah, I've been emailing with @BenWilson-Mozilla and was going to ask about that...
Member
Author
|
@ctz I think you used an earlier version of this PR, before it worked backwards. Perhaps your code should turn into a test in this crate (oh no, you wrote it in Python, didn't you?), like we have in rustls-native-certs? |
Member
|
Here's a big table of all CRLs I can find referenced from fetching every CA's test site, compared against the list produced here.
Not sure of the reasons for the discrepancies yet. |
complexspaces
approved these changes
Sep 4, 2026
Member
Author
|
I changed the code to allow both |
ctz
approved these changes
Sep 7, 2026
ctz
left a comment
ctz
left a comment
Member
There was a problem hiding this comment.
(Haven't rechecked the above analysis, but I'm assuming a) adding more hosts is benign for this use b) the number of actual gaps were small, so any move that involves more hosts will probably fix the entire issue.)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
For
The hosts in CCADB currently don't seem to be giving me CRL host for Google Trust Services...This was because I was filtering on"notBeforeYear": 2026but that ignored a bunch of older, still active roots.List of hosts found
cc @complexspaces