mirror of
https://github.com/python/cpython
synced 2026-11-06 09:02:40 +03:00
e9bf2cf84e
The ssl module now rejects TLS certificate chains that contain any of a set of
compromised eMudhra intermediate CA keys. This is an extraordinary measure and
a last line of defense: removing trust is primarily the job of the platform root
store, and the built-in denylist only blocks connections while that update has
not yet reached the OS, a container image, or a bundled trust store in various
Python packages. Entries are added to the denylist only under a very high
threshold.
The denylist matches on the public key (the SHA-256 digest of the RFC-5280
SubjectPublicKeyInfo), so it also covers the cross-signed certificates that
reuse one of the distrusted keys.
---------
(cherry picked from commit
|
||
|---|---|---|
| .. | ||
| capath | ||
| allsans.pem | ||
| badcert.pem | ||
| badkey.pem | ||
| cert3.pem | ||
| distrusted.zip | ||
| ffdh3072.pem | ||
| idnsans.pem | ||
| keycert.passwd.pem | ||
| keycert.pem | ||
| keycert.pem.reference | ||
| keycert2.pem | ||
| keycert3.pem | ||
| keycert3.pem.reference | ||
| keycert4.pem | ||
| keycertecc.pem | ||
| leaf-missing-aki.ca.pem | ||
| leaf-missing-aki.keycert.pem | ||
| make_ssl_certs.py | ||
| nokia.pem | ||
| nosan.pem | ||
| nullbytecert.pem | ||
| nullcert.pem | ||
| pycacert.pem | ||
| pycakey.pem | ||
| revocation.crl | ||
| secp384r1.pem | ||
| selfsigned_pythontestdotnet.pem | ||
| ssl_cert.pem | ||
| ssl_key.passwd.pem | ||
| ssl_key.pem | ||
| talos-2019-0758.pem | ||