Up – Package index » ca-certs » CHANGESRemove extended-validation.badssl.com test case (which used a digicert signed certificate that got its website trust bit removed in NSS 3.123) @mtelvers and others https://github.com/ocaml/opam-repository/pull/29852#issuecomment-4386895683 Support DragonFlyBSD (#39 @mneumann) Add OCAML_EXTRA_CA_CERTS env variable (#30 @art-w) macOS: add additional keychain path /Library/Keychains/System.keychain (#28 @ajbt200128) Demote log levels of trust anchor parsing failures (now on the debug level), log a single warning message how many failures occured (#36 @Julow) Use X509.Certificate.fold_decode_pem, available in x509 1.0.0 (#34 #35 @art-w @hannesm) Remove usage of cstruct, update to x509 1.0.0 and mirage-crypto 1.0.0 API (#32 @dinosaure @hannesm) Remove astring dependency (#26 @hannesm) Respect the environment variable SSL_CERT_FILE as well (suggested in #22 by @Konubinix, fixed in #23 by @hannesm, ok'ed by @sternenseemann) Update tests for recent alpine releases (#24 @hannesm, likely fixes #21) Filter trailing certificate (if the data does not contain "-----BEGIN CERTIFICATE-----", it won't be a certificate) (#19 @hannesm) Avoid deprecated functions from fmt (#19 @hannesm) Remove rresult dependency (#19 @hannesm) Update GitHub actions (#19 @hannesm) Update to X.509 0.13.0 API (#18, @hannesm) Respect NIX_SSL_CERT_FILE environment variable to support NixOS builds (reported by @sternenseemann in #16, fix in #17 by @hannesm) Add Windows support (#14, @emillon) Allow some certificates to fail decoding (#11, reported by @mattpallissard in mirleft/ocaml-x509#137) Revise API, avoid temporary file creation on macos Revise test suite to not connect to the network (to please opam's sandbox), instead use hardcoded certificate chains. Tested on macos, Debian GNU/Linux, Ubuntu, Gentoo, Alpine, CentOS/RHEL 7, OpenSUSE, FreeBSD, OpenBSD Initial release