Commit Graph

7 Commits

Author SHA1 Message Date
Dion Hulse
57d0720db7 HTTP: Partially revert [34283] which removed the 1024bit certificates from our trust store.
Most browsers no longer trust 1024bit certificates, or certificates signed by them, instead verifying them by a trusted intermediate or a cross-sign from another trusted certificate.

Unfortunately, as it turns out, OpenSSL prior to 1.0.1g cannot correctly handle certificates chains such as this, even if one of the intermediates is trusted.
The solution is that we need to continue to trust the 1024bit legacy root certificates forthe foreseeable future

This adds the following certificates back into our trust store:
{{{
GTE CyberTrust Global Root
Thawte Server CA
Thawte Premium Server CA
Verisign Class 3 Public Primary Certification Authority
Verisign Class 3 Public Primary Certification Authority - G2
ValiCert Class 1 VA
ValiCert Class 2 VA
RSA Root Certificate 1
Entrust.net Secure Server CA
Equifax Secure Global eBusiness CA
Equifax Secure eBusiness CA 1
America Online Root Certification Authority 1
America Online Root Certification Authority 2
NetLock Business (Class B) Root
NetLock Express (Class C) Root
Verisign Class 3 Public Primary Certification Authority
}}}

Props rmccue.
Merges [35919] to the 4.4 branch.
Fixes #34935.

Built from https://develop.svn.wordpress.org/branches/4.4@35921


git-svn-id: http://core.svn.wordpress.org/branches/4.4@35885 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2015-12-14 05:25:26 +00:00
Dion Hulse
9f61845204 HTTP: Update the Root Certificate bundle.
See #30434

Built from https://develop.svn.wordpress.org/trunk@34283


git-svn-id: http://core.svn.wordpress.org/trunk@34247 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2015-09-18 08:43:26 +00:00
Dion Hulse
26b85eb9b3 WP_HTTP: Revert r30491 which updated the bundled root certificates. There's a report that this is breaking under certain PHP/OpenSSL versions (which we've encountered before), and we're safer with a slighty out of date CA bundle than breaking HTTPS communication on affected sites.
See #30434

Built from https://develop.svn.wordpress.org/trunk@30765


git-svn-id: http://core.svn.wordpress.org/trunk@30755 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2014-12-07 03:13:22 +00:00
Dion Hulse
330ab9d484 Update the bundled root CA's used for outgoing HTTPS requests.
Fixes #30434

Built from https://develop.svn.wordpress.org/trunk@30491


git-svn-id: http://core.svn.wordpress.org/trunk@30480 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2014-11-21 03:03:22 +00:00
Dion Hulse
d55eb3901c WP_HTTP: Update the Root Certificate bundle used for SSL communication by WP_HTTP.
This file has been generated from the latest mozilla release NSS.
Fixes #27017

Built from https://develop.svn.wordpress.org/trunk@27307


git-svn-id: http://core.svn.wordpress.org/trunk@27160 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2014-02-27 02:33:14 +00:00
Dion Hulse
a40b05fc0b Move a certificate higher in the file (end to start) so that PHP 5.2.x (OpenSSL 0.9.8j and earlier) can parse the file correctly. See #25007
Built from https://develop.svn.wordpress.org/trunk@25569


git-svn-id: http://core.svn.wordpress.org/trunk@25487 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2013-09-23 13:59:11 +00:00
Dion Hulse
3ac572867e WP_HTTP: Replacing the Fsockopen & Streams Transports with a new Streams transport which fully supports HTTPS communication.
This changeset also bundles ca-bundle.crt from the Mozilla project to allow for us to verify SSL certificates on hosts which have an incomplete, outdated, or invalid local SSL configuration.
Props rmccue for major assistance getting this this far. See #25007 for discussion, also Fixes #16606 

Built from https://develop.svn.wordpress.org/trunk@25224


git-svn-id: http://core.svn.wordpress.org/trunk@25194 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2013-09-04 04:49:12 +00:00