Update LICENSE Approved by: portmgr (blanket)9972eeb730
ca_root_nss -- trusted root certificate from compromised CA eMudhraentered 2026-10-23
no CVE referenced
Port details
security/ca_root_nss 3.132
Root certificate bundle from the Mozilla Project
Port info
- Maintainer
- ports-secteam@FreeBSD.org
- Packages
- latest: 3.132
- Upstream
- up to date
- Last update
- to 3.132 · 2d417a60ba
- Quarterly
- 2026Q4: 3.131.1 · last MFH 4bccc46e0c
- Links
- cgit · VuXML · Report wrong data
Install
- Package
# pkg install ca_root_nssinstalls 3.132 fromlatest; fromquarterly(2026Q4) 3.131.1- Port
# cd /usr/ports/security/ca_root_nss && make install clean- Size
- 241 KiB download · 625 KiB installed
- Depends on
- nothing
- License
- MPL20
- pkg-message
Shown after installing
FreeBSD does not, and can not warrant that the certification authorities whose certificates are included in this package have in any way been audited for trustworthiness or RFC 3647 compliance. Assessment and verification of trust is the complete responsibility of the system administrator. This package installs symlinks to support root certificate discovery for software that either uses other cryptographic libraries than OpenSSL, or use OpenSSL but do not follow recommended practice. If you prefer to do this manually, replace the following symlinks with either an empty file or your site-local certificate bundle. * /etc/ssl/cert.pem * /usr/local/etc/ssl/cert.pem * /usr/local/openssl/cert.pem
Packages by version and architecture
latest
| FreeBSD version | amd64 | aarch64 | i386 |
|---|---|---|---|
| FreeBSD 16 | 3.132 | 3.131 | – |
| FreeBSD 15 | 3.132 | 3.131 | – |
| FreeBSD 14 | 3.131.1 | 3.131 | 3.131.1 |
quarterly (2026Q4)
| FreeBSD version | amd64 | aarch64 | i386 |
|---|---|---|---|
| FreeBSD 15 | 3.131.1 | 3.131 | – |
| FreeBSD 14 | 3.131.1 | 3.131 | 3.132 |
version as in the ports tree (latest) or the most common one (quarterly) · different version · ✗ not built · – no packages for this platform. Package sets that have not been rebuilt for 60 days are left out.
Unaddressed and VuXML only (0)
No unaddressed CVE and nothing reported by
pkg audit for the packaged version 3.132.Fixed (4)
Show 4 fixed
VuXML entries whose affected range the packaged version has left.
mozilla -- multiple vulnerabilitiesentered 2013-01-09
CVE-2012-5829, CVE-2013-0743, CVE-2013-0744, CVE-2013-0745, CVE-2013-0746, CVE-2013-0747, CVE-2013-0748, CVE-2013-0749, CVE-2013-0750, CVE-2013-0751, CVE-2013-0752, CVE-2013-0753, CVE-2013-0754, CVE-2013-0755, CVE-2013-0756, CVE-2013-0757, CVE-2013-0758, CVE-2013-0759, CVE-2013-0760, CVE-2013-0761, CVE-2013-0762, CVE-2013-0763, CVE-2013-0764, CVE-2013-0766, CVE-2013-0767, CVE-2013-0768, CVE-2013-0769, CVE-2013-0770, CVE-2013-0771
no CVE referenced
nss/ca_root_nss -- fraudulent certificates issued by DigiNotar.nlentered 2011-09-03
no CVE referenced
Problem reports (2) · open in Bugzilla, most recently changed first
| PR | Summary | Status | Changed |
|---|---|---|---|
| 290601 | maintainer-feedback? security/ca_root_nss: Clean up | Open | 2025-11-11 |
| 283932 | maintainer-feedback? www/p5-Tiny-HTTP: uses security/ca_root_nss but certctl is useless | New | 2025-04-07 |
Commits (188)
security/nss: update to 3.32.1 Changes: https://developer.mozilla.org/docs/Mozilla/Projects/NSS/NSS_3.32.1_release_notes Changes: https://hg.mozilla.org/projects/nss/shortlog/NSS_3_32_1_RTM ABI: https://abi-laboratory.pro/tracker/timeline/nss/ MFH: 2017Q3 (maybe security, required by firefox-56.0)be8b3c9367
security/nss: update to 3.32 Changes: https://developer.mozilla.org/docs/Mozilla/Projects/NSS/NSS_3.32_release_notes Changes: https://hg.mozilla.org/projects/nss/shortlog/NSS_3_32_RTM ABI: https://abi-laboratory.pro/tracker/timeline/nss/ MFH: 2017Q3 (required by firefox-56.0 scheduled on 2017-09-26)6fd45bd3be
security/nss: update to 3.31 Changes: https://developer.mozilla.org/docs/Mozilla/Projects/NSS/NSS_3.31_release_notes Changes: https://hg.mozilla.org/projects/nss/shortlog/NSS_3_31_RTM ABI: https://abi-laboratory.pro/tracker/timeline/nss/ MFH: 2017Q22874de1620
security/nss: update to 3.30.2 Changes: https://developer.mozilla.org/docs/Mozilla/Projects/NSS/NSS_3.30.2_release_notes Changes: https://hg.mozilla.org/projects/nss/shortlog/NSS_3_30_2_RTM MFH: 2017Q2e3dc70252c
security/nss: update to 3.30.1 Changes: https://developer.mozilla.org/docs/Mozilla/Projects/NSS/NSS_3.30.1_release_notes Changes: https://hg.mozilla.org/projects/nss/shortlog/NSS_3_30_1_RTM MFH: 2017Q26eb52cec18
security/nss: update to 3.30 Changes: https://developer.mozilla.org/docs/Mozilla/Projects/NSS/NSS_3.30_release_notes Changes: https://hg.mozilla.org/projects/nss/shortlog/NSS_3_30_RTM MFH: 2017Q1d9d4e83882
security/nss: update to 3.29.3 Changes: https://developer.mozilla.org/docs/Mozilla/Projects/NSS/NSS_3.29.2_release_notes Changes: https://developer.mozilla.org/docs/Mozilla/Projects/NSS/NSS_3.29.3_release_notes Changes: https://hg.mozilla.org/projects/nss/shortlog/NSS_3_29_3_RTM MFH: 2017Q12948a83544
security/nss: update to 3.29.1 Changes: https://developer.mozilla.org/docs/Mozilla/Projects/NSS/NSS_3.29.1_release_notes Changes: https://hg.mozilla.org/projects/nss/shortlog/NSS_3_29_1_RTM MFH: 2017Q1cf389e1b22
security/nss: update to 3.29 Changes: https://developer.mozilla.org/docs/Mozilla/Projects/NSS/NSS_3.29_release_notes Changes: https://hg.mozilla.org/projects/nss/shortlog/NSS_3_29_RTM MFH: 2017Q109c5ed08f4
security/nss: update to 3.28.1 Changes: https://developer.mozilla.org/docs/Mozilla/Projects/NSS/NSS_3.28.1_release_notes MFH: 2017Q10ed0359e45
security/nss: update to 3.28 Changes: https://developer.mozilla.org/docs/Mozilla/Projects/NSS/NSS_3.28_release_notes MFH: 2016Q4ca3bf2573c
${RM} already has -f.
PR: 213570
Submitted by: mat
Exp-run by: antoine
Sponsored by: Absolighteabbfd75e3security/nss: update to 3.27.1 and define license Changes: https://developer.mozilla.org/docs/Mozilla/Projects/NSS/NSS_3.27.1_release_notes PR: 213312 Submitted by: Vladimir Krstulja <vlad-fbsd@acheronmedia.com> MFH: 2016Q46dc8464d09
security/ca_root_nss: adjust pkg-plist to address leftover directory The port creates /etc/ssl directory with the default option, but until now, did not remove it upon deinstallation. While technically this requires a revbump, rebuilding this port to fix a cleanup step would cause a tremendous amount of fallout and it's not worth the pain IMO. PR: 213121 Approved by: feld (ports-secteam)386a520968
security/nss: update to 3.27 Changes: https://developer.mozilla.org/docs/Mozilla/Projects/NSS/NSS_3.27_release_notesfabce29e33
This uses OpenSSL, use openssl from ports if available. Sponsored by: Absolightf09251fd38
security/nss: update to 3.26 Changes: https://developer.mozilla.org/docs/Mozilla/Projects/NSS/NSS_3.26_release_notes MFH: 2016Q32647accc43
When there is a do-install target, do not use a post-install target, do everything at once. Sometime, rename post-install into a options helper target. I did not fix ports that were such a mess that I could not figure out what they really wanted to do. I also did not change ports that had some version of an auto-plist code in post-install, for the same reason. With hat: portmgr Sponsored by: Absolightf899c758a6
security/nss: update to 3.25 Changes: https://developer.mozilla.org/docs/Mozilla/Projects/NSS/NSS_3.25_release_notesbb2dc31bc5
security/nss: update to 3.22.2 Changes: https://developer.mozilla.org/docs/Mozilla/Projects/NSS/NSS_3.22.2_release_notes Changes: https://hg.mozilla.org/projects/nss/rev/ec7aee1a4c24 MFH: 2016Q1 (maybe security)f424fb7bf7
security/nss: update to 3.22 Changes: https://developer.mozilla.org/docs/Mozilla/Projects/NSS/NSS_3.22_release_notes PR: 207030 Submitted by: Christoph Moench-Tegeder <cmt@burggraben.net>7e6d923605
security/nss: update to 3.21 Temporarily disable gtests as they require C++0x support and install a library that may have conflicting API with devel/googletest. Changes: https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.21_release_notes66a9514680
- Pass maintainership to ports-secteam, with a explicit approval for gecko@ Differential Revision: D264079a0af4672
gecko: catch up with 2015-11-03 release train - Update NSPR to 4.10.10 [1] - Update NSS to 3.20.1 [2] - Update Firefox ESR and libxul to 38.4.0 - Update Firefox to 42.0 [2] - Update SeaMonkey to 2.39 Changes: http://mozilla.6506.n7.nabble.com/ANNOUNCE-NSPR-4-10-10-Release-td346822.html Changes: https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.20.1_release_notes Changes: https://www.mozilla.org/en-US/firefox/42.0/releasenotes/ Changes: http://www.seamonkey-project.org/news#2015-11-08 PR: 204277 [1], 204332 [2], 203099 Submitted by: swills, Christoph Moench-Tegeder MFH: 2015Q4 Security: 9d04936c-75f1-4a2c-9ade-4c1708be5df9a356bf5bac
security/{,ca_root_}nss: update to 3.20
No CA root changes, just chasing NSS version.
Changes: https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.20_release_notes952acc52bcsecurity/{,ca_root_}nss: update to 3.19.3
Changes: https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.19.3_release_notes
MFH: 2015Q38e29d28afc- Update NSS and ca_root_nss to 3.19.2 - Update Firefox and gmp-api to 39.0 - Update Firefox ESR and libxul to 38.1.0 Changes: https://developer.mozilla.org/docs/Mozilla/Projects/NSS/NSS_3.19.2_release_notes Changes: https://www.mozilla.org/firefox/39.0/releasenotes/ Changes: https://www.mozilla.org/firefox/38.1.0/releasenotes/ MFH: 2015Q3 Security: https://vuxml.freebsd.org/freebsd/44d9daee-940c-4179-86bb-6e3ffd617869.htmlef0a0c91f1
security/ca_root_nss: Enable certificate verification (for Base OpenSSL) Enable the ETCSYMLINK option so that SSL certificate verification is enabled by default for OpenSSL in base. This change is the third in a set of changes [1][2] that improves the default configuration and behaviour of client software relying on OpenSSL for SSL/TLS and certificate verification. A symlink is installed which points to the root certificate bundle in the location that OpenSSL in base looks for them, as configured at build time [2]. This allows any and all software utilising SSL_CTX_load_verify_locations function to verify SSL certificates by default after installation of this package. [1] https://svnweb.freebsd.org/changeset/ports/372629 [2] https://svnweb.freebsd.org/changeset/ports/378720 PR: 189811 196357 Requested by: many Submitted by: dreamcat4 gmail com Approved by: maintainer timeout (>1 year)71ee70bfe9
- Update NSS and ca_root_nss to 3.19.1 - Update Firefox to 38.0.5 Changes: https://developer.mozilla.org/docs/Mozilla/Projects/NSS/NSS_3.19.1_release_notes Changes: https://www.mozilla.org/firefox/38.0.5/releasenotes/ MFH: 2015Q2590b9cdbb8
Fix spelling of "certification authority" Approved by: portmgr (bapt), bapt (ports committer)23617c84e7
- Update NSS and ca_root_nss to 3.19 - Update Firefox to 38.0 - Update Firefox ESR and libxul to 31.7.0 - Update Thunderbird to 31.7.0 - Update Enigmail to 1.8.2 Changes: https://developer.mozilla.org/docs/Mozilla/Projects/NSS/NSS_3.19_release_notes Changes: https://www.mozilla.org/firefox/38.0/releasenotes/ Changes: https://www.mozilla.org/firefox/31.7.0/releasenotes/ Changes: http://sourceforge.net/p/enigmail/bugs/search/?q=status%3Afixed+%26%26+_fixed%3A1.8.1 MFH: 2015Q2 Security: https://vuxml.freebsd.org/freebsd/d9b43004-f5fd-4807-b1d7-dbf66455b244.html83847c65aa
- Update NSS to 3.18.1 Changes: https://developer.mozilla.org/docs/Mozilla/Projects/NSS/NSS_3.18.1_release_notes MFH: 2015Q2e79612feb9
- Update OpenH264 to 1.4.0 - Update NSS and ca_root_nss to 3.18 - Update Firefox to 36.0.4 - Update Firefox ESR and libxul to 31.5.3 - Update SeaMonkey to 2.33.1 - Update Enigmail to 1.8 Changes: https://github.com/cisco/openh264/releases/tag/v1.4.0 Changes: https://developer.mozilla.org/docs/Mozilla/Projects/NSS/NSS_3.18_release_notes Changes: https://www.mozilla.org/firefox/36.0.4/releasenotes/ Changes: https://www.mozilla.org/firefox/31.5.3/releasenotes/ Changes: http://www.seamonkey-project.org/releases/seamonkey2.33/ Changes: https://www.enigmail.net/download/changelog.php#enig1.8 MFH: 2015Q1 X-MFH-With: r380090 Security: https://vuxml.freebsd.org/freebsd/76ff65f4-17ca-4d3f-864a-a3d6026194fb.htmlcbca8c3691
security/ca_root_nss: Fix SSL verification for ports OpenSSL consumers Since 2.7.9, Python verifies SSL certificates by default. Currently, even with security/ca_root_nss installed, Python fails certificate verification. Upon investigation, Python uses OpenSSL's standard SSL_CTX_load_verify_locations function to load a list of CA root certificates. Support was added to ca_root_nss for "out of the box" certificate verification for a number of base utilities in r372629 [1], but this did not include support for software that uses OpenSSL's SSL_CTX_load_verify_locations function. [1] https://svnweb.freebsd.org/changeset/ports/372629 OpenSSL defaults (at compile time) to the following paths and filenames for certificate and CAFile lookup: Base: SSL_CERT_DIR=/etc/ssl/certs SSL_CERT_FILE/etc/ssl/cert.pem Ports: SSL_CERT_DIR=/usr/local/openssl/certs SSL_CERT_FILE=/usr/local/openssl/cert.pem This change installs a symlink which points to the root certificate bundle in the location that OpenSSL from ports looks for them. This allows any and all software utilising SSL_CTX_load_verify_locations function to verify SSL certificates by default after installation of this package. Additionally, display a pkg-message to the user about the lack of warranty associated with these certificates. Note: This is *NOT* related to solving for SSL certificate verification for OpenSSL in Base, which is covered in bug 189811. While I'm here: - Add LICENSE - Use options helpers and OPTIONS_SUB - Fix typo in !!! message !!! PR: 196431 Submitted by: koobs Reviewed by: jbeich Approved by: maintainer timeout (1 month)df684039a8
- Update NSPR to 4.10.8 - Update NSS to 3.17.2 - Update Firefox to 35.0.1 Changes: http://mozilla.6506.n7.nabble.com/ANNOUNCE-NSPR-4-10-8-Release-td332365.html Changes: https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.17.4_release_notes Changes: https://www.mozilla.org/en-US/firefox/35.0.1/releasenotes/ Differential Revision: https://reviews.freebsd.org/D1736 Approved by: bapt (mentor)8b2b9d3a6b
Remove useless @cwd90e861bf7a
- Update Thunderbird to 31.3.0 - Update gmp-api to 35.0 - Update openh264 to 1.2 - Update NSS to 3.17.3 - Update Firefox to 34.0.5 - Update Firefox ESR 31.3.0 - Update libxul to 31.3.0 - Improve CONFIGURE_TARGET handling - Always build using client.mk - Switch to clang by default on systems without libc++ (/stable/8 and /stable/9) - Drop lang/python2 dependency, only lang/python27 is required PR: 195559 Submitted by: Jan Beich MFH: 2014Q4 Security: http://vuxml.org/freebsd/7ae61870-9dd2-4884-a2f2-f19bb5784d09.html0ccec1792b
Link in the right place and fix plist9b3bbebd20
Always install ${PREFIX}/etc/ssl/cert.pem symlink to allow both some base applications some root certificates.
Discussed with: des2e22922e47- Update Firefox to 33.0 - Update Firefox ESR to 31.2.0 - Update NSS to 3.17.2 - Update Thunderbird to 31.2.0 - Update libxul to 31.2.0 (and mark as BROKEN) - Disable SSL 3.0 with pref (Upstream bug 1076983) - (workaround) replace USE_GCC=yes with USES=compiler:gcc-c++11-lib in order to fix runtime for PGO and powerpc/powerpc64 on libc++ systems - Add OSS audio fallback for HTML5 audio from upst PR: 194356 Submitted by: Jan Beich Security: http://www.vuxml.org/freebsd/9c1495ac-8d8c-4789-a0f3-8ca6b476619c.html8f7f02ae39
- Update ca_root_nss to 3.17.1 - Update thunderbird to 31.1.2 - Update seamonkey to 2.29.1 - Update firefox to 32.0.3 - Update firefox-esr to 31.1.1 - Update libxul to 24.8.1 Submitted by: Jan Beich Security: http://www.vuxml.org/freebsd/48108fb0-751c-4cbb-8f33-09239ead4b55.html1b3bcb097d
Simplify plist (and avoir @cwd)dbd5070e92
Mozilla upgrades: - Update nspr to 4.10.7 - Update ca_root_nss to 3.17 (mark as NO_ARCH while here) - Update firefox to 32.0 - Update thunderbird to 31.1.0 - Add net-im/linux-instantbird - Update firefox-est to 31.1.0 - Update libxul to 24.8.0 - Update seamonkey to 2.29 Submitted by: Jan Beich for gecko@f4aef6b62c
Update to 3.16.3 Add cpe informations Submitted by: Jan Beich397fa72062
- Update Firefox to 30.0 - Update Firefox ESR to 24.6.0 - Update libxul to 24.6.0 - Update NSS to 3.16.1 - Update NSPR to 4.10.6 - Update Thunderbird to 24.6.0 - Convert USE_BZIP2 to USES - Backport ff31 fix against crashing DEBUG build on newegg.com [1] - Add a note in UPDATING to not build audio/soundtouch with INTEGER_SAMPLES [2] - Use arc4random_buf(3) to generate UUIDs (version 4) - Fix deb PR: ports/189991 [1] PR: ports/189217 [2] PR: ports/189488 [2] Submitted by: bapt [3] Sumbitted by: Jan Beich Security: http://www.vuxml.org/freebsd/888a0262-f0d9-11e3-ba0c-b4b52fce4ce8.html0557b9315d
Convert all :U to :tu and :L to :tl Since FreeBSD 8.4 and FreeBSD 9.1 make(1) do support :tu and :tl as a replacement for :U and :L (which has been marked as deprecated) bmake which is the default on FreeBSD 10+ only support by default :tu/:tl a hack has been added at the time to support :U and :L to ease migration. This hack is now not necessary anymore Note that this makes the ports tree incompatible with make(1) from FreeBSD 8.3 or earlier With hat: portmgr4a4ec28d37
- Update Firefox to 29.0 - Update Firefox ESR to 24.5.0 - Update Thunderbird to 24.5.0 - Update NSS to 3.16 - Use port dependency for soundtouch library - Require recent graphite2 version explicitly [1] - Require gst-libav version that doesn't crash on seeking [2] and doesn't error out on plugin load [3] - Remove gstreamer note in pkg-message for www/firefox, [3] may still happen with www/fire Security: http://www.vuxml.org/freebsd/985d4d6c-cfbd-11e3-a003-b4b52fce4ce8.html PR: ports/187939 [1] PR: ports/188133 [2] PR: ports/181964 [3] PR: ports/188984 [4] Submitted by: Toomas Aas <toomas.aas@raad.tartu.ee> [1] Submitted by: Jakub Lach <jakub_lach@mailplus.pl> [2] Submitted by: Jan Beich [3] and this update! Submitted by: Toni Ballesta <mustelator@yahoo.es> [4] Approved by: portmgr (bdrewery, security update to non-staged port)b6e8f8d98d
- Update Firefox to 28.0 - Update Firefox ESR to 24.4.0 - Update Thunderbird to 24.4.0 - Update NSPR to 4.10.4 - Update NSS to 3.15.5 - Switch GSTREAMER option for non-esr ports to depend on multimedia/gstreamer1 [2] - Switch to Uses/compiler.mk, defaults to lang/gcc47 on 8.x and 9.x - Use port dependencies for libogg, libvorbis, libopus, harfbuzz, graphite2 - Enable readahead in url-classifier, Submitted by: Jan Beich PR: ports/186580 [1] Requested by: kwm [2] Security: http://www.vuxml.org/freebsd/610de647-af8d-11e3-a25b-b4b52fce4ce8.htmlc80e090095
- Update Firefox to 27.0 - Update Firefox ESR to 24.3.0 - Update Thunderbird to 24.3.0 - Update NSPR to 4.10.3 - Update NSS to 3.15.4 - Depend on yasm when building with bundled libvpx or libjpeg-turbo - Prepare gstreamer conditional for upcoming Firefox versions - Improve jemalloc3 conditional - Break build unless alsa-lib port installs new config file - Chase USE_DOS2UNIX deprecation - Temporari Submitted by: Jan Beich Reported by: flo [1] Security: http://www.vuxml.org/freebsd/1753f0ff-8dd5-11e3-9b45-b4b52fce4ce8.html2f24f871a0