This port simply contains a list of SSL Certificate Authority root
certificates. Such a list performs a similar role for SSL Certificate
verfication that the root cache does for DNS servers.
This list originally came from mod_ssl (where it was ca-bundle.crt. They
originally got their list from Netscape Communicator/Navigator),
but will be maintained separately. The maintainer will apply strict
criteria to suggestions for additions to this list (in concert with
the FreeBSD security officer). CAs wishing to be added will need
to assure the FreeBSD user community that their certification procedures
are sufficiently secure to render their certificates trustworthy.
Retire the ca-roots ports, which expired long ago.
The port is deprecated since it is not supported by the FreeBSD
Security Officer anymore. The reason for this is that the ca-roots
port makes promises with regard to CA verification which the current
Security Officer (and deputy) do not want to make.
For people who need a general root certificate list see the
security/ca_root_ns, but note that the difference in guarantees with
regard to which CAs are included in ca_root_ns vs. ca-roots. The
ca_root_ns port basically makes no guarantees other than that the
certificates comes from the Mozilla project.
Note that the ca-roots MOVED file entry on purpose does not point at
ca_root_ns due to the change in CA guarantees.
With hat: security-officer
Deprecated and set one month expiration since it's not supported by
the FreeBSD Security Officer anymore.
The current ca-roots port makes promises with regard to CA verification
which the current Security Officer (and deputy) do not want to make.
With hat: so
Discussed with: cperciva (some time ago)
Release all my ports.
kris made it clear that by his measure I'm not doing my job as a port
maintainer. Far be it from me to be an obstruction to the project.
