Blame SOURCES/ca-legacy.8.txt

3c42f9
////
3c42f9
Copyright (C) 2013 Red Hat, Inc.
3c42f9
3c42f9
This program is free software; you can redistribute it and/or modify
3c42f9
it under the terms of the GNU General Public License as published by
3c42f9
the Free Software Foundation; either version 2 of the License, or
3c42f9
(at your option) any later version.
3c42f9
3c42f9
This program is distributed in the hope that it will be useful,
3c42f9
but WITHOUT ANY WARRANTY; without even the implied warranty of
3c42f9
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
3c42f9
GNU General Public License for more details.
3c42f9
////
3c42f9
3c42f9
3c42f9
ca-legacy(8)
3c42f9
============
3c42f9
:doctype: manpage
3c42f9
:man source: ca-legacy
3c42f9
3c42f9
3c42f9
NAME
3c42f9
----
3c42f9
ca-legacy - Manage the system configuration for legacy CA certificates
3c42f9
3c42f9
3c42f9
SYNOPSIS
3c42f9
--------
3c42f9
*ca-legacy* ['COMMAND']
3c42f9
3c42f9
3c42f9
DESCRIPTION
3c42f9
-----------
3c42f9
ca-legacy(8) is used to include or exclude a set of legacy Certificate Authority (CA)
3c42f9
certificates in the system's list of trusted CA certificates.
3c42f9
3c42f9
The list of CA certificates and trust flags included in the ca-certificates package
3c42f9
are based on the decisions made by Mozilla.org according to the Mozilla CA policy.
3c42f9
3c42f9
Occasionally, removal or distrust decisions made by Mozilla.org might be incompatible with the requirements
3c42f9
or limitations of some applications that also use the CA certificates list in the Linux environment.
3c42f9
3c42f9
The ca-certificates package might keep some CA certificates included and trusted by default,
3c42f9
as long as it is seen necessary by the maintainers, despite the fact that they have
3c42f9
been removed by Mozilla. These certificates are called legacy CA certificates.
3c42f9
3c42f9
The general requirements to keep legacy CA certificates included and trusted might change over time,
3c42f9
for example if functional limitations of software packages have been resolved.
3c42f9
Future versions of the ca-certificates package might reduce the set of legacy CA certificates
3c42f9
that are included and trusted by default.
3c42f9
3c42f9
The ca-legacy(8) command can be used to override the default behaviour.
3c42f9
3c42f9
The mechanisms to individually trust or distrust CA certificates as described in update-ca-trust(8) still apply.
3c42f9
3c42f9
3c42f9
COMMANDS
3c42f9
--------
3c42f9
*check*::
3c42f9
    The current configuration will be shown.
3c42f9
3c42f9
*default*::
3c42f9
    Configure the system to use the default configuration, as recommended
3c42f9
    by the package maintainers.
3c42f9
3c42f9
*disable*::
3c42f9
    Configure the system to explicitly disable legacy CA certificates.
3c42f9
    Using this configuration, the system will use the set of
3c42f9
    included and trusted CA certificates as released by Mozilla.
3c42f9
3c42f9
*install*::
3c42f9
    The configuration file will be read and the system configuration
3c42f9
    will be set accordingly. This command is executed automatically during
3c42f9
    upgrades of the ca-certificates package.
3c42f9
3c42f9
3c42f9
FILES
3c42f9
-----
3c42f9
/etc/pki/ca-trust/ca-legacy.conf::
3c42f9
	A configuration file that will be used and modified by the ca-legacy command.
3c42f9
    The contents of the configuration file will be read on package upgrades.
3c42f9
3c42f9
AUTHOR
3c42f9
------
3c42f9
Written by Kai Engert.