The upstream Mozilla CA certificates list version 2.1, as released by Mozilla with NSS 3.16.4, removed trust for several old roots, which are considered to have weak keys.
The related upstream bugs are: https://bugzilla.mozilla.org/show_bug.cgi?id=936304 https://bugzilla.mozilla.org/show_bug.cgi?id=986005
Unfortunately we see issues with software that uses OpenSSL/GnuTLS after these removals with many popular web sites.
The issue (or one out of several possible issues) is that web sites may be configured to send multiple intermediate CA certificates, intended for maximum compatibility with client software. One intermediate points to one of the removed CA certificates, and another second points to a newer root. The problem is that OpenSSL/GnuTLS don't search for an alternative trusted root, after being unable to construct a trust chain for the topmost intermediate CA certificate sent by the servers.
In order to allow more time to implement enhancements or workarounds, the CA-certificates package will temporarily add back trust to the related root CA certificates.
Updates may require up to 24 hours to propagate to mirrors. If the following command doesn't work, please retry later:
sudo dnf upgrade --refresh --advisory=FEDORA-2014-11172Please login to add feedback.
This update has been submitted for testing by kengert. This critical path update has not yet been approved for pushing to the stable repository. It must first reach a karma of 2, consisting of 0 positive karma from proventesters, along with 2 additional karma from the community. Or, it must spend 14 days in testing without any negative feedback
AutoQA: depcheck test PASSED on i386. Result log: http://autoqa.fedoraproject.org/report/1gxuc (results are informative only)
AutoQA: depcheck test PASSED on x86_64. Result log: http://autoqa.fedoraproject.org/report/1gxud (results are informative only)
work c:
Critical path update approved
This update is currently being pushed to the Fedora 21 testing updates repository.
This update has been pushed to testing
looks fine here
Works for me
This update has reached the stable karma threshold and will be pushed to the stable updates repository
AutoQA: upgradepath test PASSED on noarch. Result log: http://autoqa.fedoraproject.org/report/1hbkf (results are informative only)
This update is currently being pushed to the Fedora 21 stable updates repository.
This update has been pushed to stable