installs 3.132 from latest; from quarterly (2026Q4) 3.131.1
Port
# cd /usr/ports/security/ca_root_nss && make install clean
Size
241 KiB download · 625 KiB installed
Depends on
nothing
License
MPL20
pkg-message
Shown after installing
FreeBSD does not, and can not warrant that the certification authorities
whose certificates are included in this package have in any way been
audited for trustworthiness or RFC 3647 compliance.
Assessment and verification of trust is the complete responsibility of
the system administrator.
This package installs symlinks to support root certificate discovery
for software that either uses other cryptographic libraries than
OpenSSL, or use OpenSSL but do not follow recommended practice.
If you prefer to do this manually, replace the following symlinks with
either an empty file or your site-local certificate bundle.
* /etc/ssl/cert.pem
* /usr/local/etc/ssl/cert.pem
* /usr/local/openssl/cert.pem
Packages by version and architecture
latest
FreeBSD version
amd64
aarch64
i386
FreeBSD 16
3.132
3.131
–
FreeBSD 15
3.132
3.131
–
FreeBSD 14
3.131.1
3.131
3.131.1
quarterly (2026Q4)
FreeBSD version
amd64
aarch64
i386
FreeBSD 15
3.131.1
3.131
–
FreeBSD 14
3.131.1
3.131
3.132
version as in the ports tree (latest) or the most common one (quarterly) · different version · ✗ not built · – no packages for this platform. Package sets that have not been rebuilt for 60 days are left out.
Unaddressed and VuXML only (0)
No unaddressed CVE and nothing reported by pkg audit for the packaged version 3.132.
Fixed (4)
Show 4 fixed
VuXML entries whose affected range the packaged version has left.
maintainer-feedback? www/p5-Tiny-HTTP: uses security/ca_root_nss but certctl is useless
New
2025-04-07
Commits (188)
Florian Smeets (flo) · 3.15.3.1
Update to nspr 4.10.2 Update to nss 3.15.3.1 Update firefox-esr and thunderbird to 24.2.0 Update firefox to 26.0 Update seamonkey to 2.23
- catch up with directory renames since USES=webplugins was introduced;
fixes plugins not being automatically enabled after install
- linux-firefox and linux-seamonkey can play HTML5 audio [2][3] and
measure about:memory usage, again
- dom.ipc.plugins.enabled->true no longer crash linux-firefox which makes
some flash sites work again; as there's no nspluginwrapper in-between
the infamous "youtube issue" never occurs
- install DEBUG with symbols [3] and describe the option better [4]
- enable dumping about:memory upon kill -65, kill -66 and GC/CC log
upon kill -67 to a file under /tmp directory; linux-firefox uses
kill -34, kill -35 and kill -36 respectively
PR: ports/183861 [1]
PR: ports/184006 [2]
PR: ports/169896 [3]
PR: ports/184285 [3]
PR: ports/184286 [4]
Security: dd116b19-64b3-11e3-868f-0025905a4771
In collaboration with: Jan Beich <jbeich@tormail.org>
Update extraction script to:
- Only look at CKA_TRUST_SERVER_AUTH, _EMAIL_PROTECTION, and
_CODE_SIGNING attributes.
- Omit certificates that do not have any explicit trust value in these
three attributes; at least one of the purposes must mark the
certificate a trusted delegator.
- Validate that the trust is one of three known trust values, to become
aware of syntax changes in certdata.txt. If it is an unknown token,
abort with an error stating that the script must be updated.
- Check that we have at least 25 certificates in the output or abort.
This removes these two certificates that have "unknown"
(CKT_NSS_MUST_VERIFY_TRUST) in all three tokens, making them unfit as
trust anchors:
1 C=DE, O=TC TrustCenter GmbH, OU=TC TrustCenter Universal CA,
CN=TC TrustCenter Universal CA III
2 C=US, ST=UT, L=Salt Lake City, O=The USERTRUST Network,
OU=http://www.usertrust.com,
CN=UTN-USERFirst-Network Applications
164 trusted certificates remain.
- update firefox to 21.0 - update firefox-esr and thunderbird to 17.0.6 - WEBRTC now supports PULSEAUDIO - make linux-firefox work with plugins again (e.g. quakelive)
Security: 4a1ca8a4-bd82-11e2-b7a0-d43d7e0c7c02
In collaboration with: Jan Beich <jbeich@tormail.org>
Support WITH_DEBUG=yes to get more debug output from the bundle creation, to verbosely print omitted and included certificates.
Approved by: flo@ on "as long as you fix it if it breaks" condition
- update firefox, thunderbird, linux-firefox and linux-thunderbird to 17.0.2 - update firefox-esr, thunderbird-esr and libxul to 10.0.12 - update linux-seamonkey to 2.15
Security: http://www.vuxml.org/freebsd/a4ed6632-5aa9-11e2-8fcb-c8600054b392.html
Update to 3.14.1.with.ckbi.1.93
This was released to revoke certificates that were used for MITM. For
details see:
https://blog.mozilla.org/security/2013/01/03/revoking-trust-in-two-turktrust-certficates/
- Update www/firefox{,-i18n} to 16.0.2 - Update seamonkey to 2.13.2 - Update ESR ports and libxul to 10.0.10 - Update nspr to 4.9.3 - Update nss to 3.14 - with GNOMEVFS2 option build its extension, too [1] - make heap-committed and heap-dirty reporters work in about:memory - properly mark QT4 as experimental (needs love upstream) - *miscellaneous cleanups and fixups*
mail/thunderbird will be updated once the tarballs are available.
PR: ports/173052 [1]
Security: 6b3b1b97-207c-11e2-a03f-c8600054b392
Feature safe: yes
In collaboration with: Jan Beich <jbeich@tormail.org>
- Update firefox-esr, thunderbird-esr, linux-firefox and linux-thunderbird to 10.0.8 - Update firefox and thunderbird to 16.0 - Update seamonkey to 2.13 - Update all -i18n ports respectively - switch firefox 16.0 and seamonkey 2.13 to ALSA by default for better latency during pause and seeking with HTML5 video - remove fedisableexcept() hacks, obsolete since FreeBSD 4.0 - support system hunspell
PR: ports/171534 [1]
PR: ports/171566 [2]
PR: ports/172164 [3]
PR: ports/172201 [4]
Discussed with: ale, beat, Jan Beich [5]
Approved by: ale [6]
In collaboration with: Jan Beich <jbeich@tormail.org>
Security: 6e5a9afd-12d3-11e2-b47d-c8600054b392
Feature safe: yes
Approved by: portmgr (beat)
- update firefox and thunderbird to 15.0 - update firefox-esr, thunderbird-esr, linux-thunderbird and linux-firefox to 10.0.7 - update seamonkey and linux-seamonkey to 2.12 - update nss to 3.13.6 - update bsdipc code (posix_spawn, SysV shared memory) - rename patches to easily track those not (yet) submitted upstream - reduce package size, except for www/libxul[1] - restore default objdir to what
Obtained from: OpenBSD ports[1]
PR: ports/159831, ports/160933, ports/170467[3], ports/170236 [4]
Submitted by: avilla [4]
In collaboration with: Jan Beich <jbeich@tormail.net> Who did most of the hard
work.
Just overwrite the link if it still exists. That way we are sure that the link points to the correct file and there is no reason trying to protect the link as it would be deleted on deinstall anyway.
Suggested by: dougb
make sure installation does not fail if for whatever reason the symlink in /etc/ssl is still there on (re)install phase with ETCSYMLINK option set.
Submitted by: mi
Change extract program: - Also work with HEAD (1.79) version of Mozilla's certdata.txt, reported by Daniel Stenberg. - Add BSD 2-clause license. - Die when certificates without trust block appear.
Security update: use newer Mozilla Builtin-Trust store to revoke DigiNotar.nl trust.
Security fix: the modssl ca-bundle.pl script did not process
"untrusted" marks on certificates. Drop it and write a new
script in its place that does that.
Synch up with security/nss port to 3.12.11.
Not asking for maintainer approval because of multiple
timeouts in response to related PRs vs. security/[ca_root_]nss.
Increase the size and verbosity of the comment that the versions used in this port should track security/nss and www/apache13-modssl.
No functional impact.
o Fix port OPTION ETCSYMLINK which was not creating the proper link. Instead of pointing to the crt file, it was pointing to the directory. o Bump PORTREVISION
PR: ports/121782
Submitted by: lioux
Point hat to: brooks
Add an option (defaulting to off since messing with files outside PREFIX is to be avoided) to link the installed certificate bundle to /etc/ssh/cert.pem
Chase nss version to 3.11.9 and modssl to 2.8.31-1.3.41. This includes the changes:
Bug 411299, Add Identrust, Truktrust, SwissSign Roots
Bug 229335, Remove certificates that expired in August 2004 from tree