Blame SOURCES/ca-legacy.conf

13173e
# The upstream Mozilla.org project tests all changes to the root CA
13173e
# list with the NSS (Network Security Services) library.
13173e
#
13173e
# Occassionally, changes might cause compatibility issues with
13173e
# other cryptographic libraries, such as openssl or gnutls.
13173e
#
13173e
# The package maintainers of the CA certificates package might decide
13173e
# to temporarily keep certain (legacy) root CA certificates trusted,
13173e
# until incompatibility issues can be resolved.
13173e
# 
13173e
# Using this configuration file it is possible to opt-out of the
13173e
# compatibility choices made by the package maintainer.
13173e
#
13173e
# legacy=default :
13173e
#   This configuration uses the choices made by the package maintainer.
13173e
#   It may keep root CA certificate as trusted, which the upstream 
13173e
#   Mozilla.org project has already marked as no longer trusted.
13173e
#   The set of CA certificates that are being kept enabled may change
13173e
#   between package versions.
13173e
#
13173e
# legacy=disable :
13173e
#   Follow all removal decisions made by Mozilla.org
13173e
#
13173e
legacy=default