Skip to content

Update Ubiquity package

Nick Sullivan edited this page Oct 11, 2015 · 1 revision

The ubiquity package is functional and great but could use a spruce-up. There are many more trust stores out there that could be added to https://github.com/cloudflare/cfssl_trust, and this process should be automated. Instead of keeping the trust stores as flat files containing all of the certificates, it would be more scalable and readable to store each trusted CA certificate separately and annotate it with auto-generated metadata (maybe created with the certinfo command). For each trust store, keep a list of certificate hashes, and a script to extract changes. Since trust stores change over time, there should be some sense of when the trust store is valid.

  • Standardize the naming convention for the certificates so that they contain the subject name, issue date, signature hash function and certificate hash.
  • Write a script that takes a file containing a number of intermediates puts them in the intermediates folder with the proper naming convention
  • Collect each trusted root certificate and give it its own file or folder, name it according to the convention established above, and decorate it with metadata extracted from certinfo for easy reading.
  • Change trust stores from flat files containing certificate to a list of CA certificate files
  • Create scripts to automate the update of the trust stores where possible
  • Add more trust stores (see references below). Focus on the ones with the largest user share as described by http://caniuse.com/

Ref: