Merge pull request #4100 from sonalkr132/update-certs

Add GlobalSign Root CA - R3 cert and remove outdated certs (cherry picked from commit 9bb7da6)
rubygems · Dec 7, 2020 · 9979b65 · 9979b65
1 parent 8cc6165
commit 9979b65
Show file tree

Hide file tree

Showing 7 changed files with 30 additions and 79 deletions.
diff --git a/Manifest.txt b/Manifest.txt
@@ -477,9 +477,7 @@ lib/rubygems/spec_fetcher.rb
 lib/rubygems/specification.rb
 lib/rubygems/specification_policy.rb
 lib/rubygems/ssl_certs/.document
-lib/rubygems/ssl_certs/index.rubygems.org/GlobalSignRootCA.pem
-lib/rubygems/ssl_certs/rubygems.global.ssl.fastly.net/DigiCertHighAssuranceEVRootCA.pem
-lib/rubygems/ssl_certs/rubygems.org/AddTrustExternalCARoot.pem
+lib/rubygems/ssl_certs/rubygems.org/GlobalSignRootCA_R3.pem
 lib/rubygems/stub_specification.rb
 lib/rubygems/syck_hack.rb
 lib/rubygems/test_case.rb

diff --git a/lib/rubygems/ssl_certs/index.rubygems.org/GlobalSignRootCA.pem b/lib/rubygems/ssl_certs/index.rubygems.org/GlobalSignRootCA.pem
diff --git a/lib/rubygems/ssl_certs/rubygems.global.ssl.fastly.net/DigiCertHighAssuranceEVRootCA.pem b/lib/rubygems/ssl_certs/rubygems.global.ssl.fastly.net/DigiCertHighAssuranceEVRootCA.pem
diff --git a/lib/rubygems/ssl_certs/rubygems.org/AddTrustExternalCARoot.pem b/lib/rubygems/ssl_certs/rubygems.org/AddTrustExternalCARoot.pem
diff --git a/lib/rubygems/ssl_certs/rubygems.org/GlobalSignRootCA_R3.pem b/lib/rubygems/ssl_certs/rubygems.org/GlobalSignRootCA_R3.pem
@@ -0,0 +1,21 @@
+-----BEGIN CERTIFICATE-----
+MIIDXzCCAkegAwIBAgILBAAAAAABIVhTCKIwDQYJKoZIhvcNAQELBQAwTDEgMB4G
+A1UECxMXR2xvYmFsU2lnbiBSb290IENBIC0gUjMxEzARBgNVBAoTCkdsb2JhbFNp
+Z24xEzARBgNVBAMTCkdsb2JhbFNpZ24wHhcNMDkwMzE4MTAwMDAwWhcNMjkwMzE4
+MTAwMDAwWjBMMSAwHgYDVQQLExdHbG9iYWxTaWduIFJvb3QgQ0EgLSBSMzETMBEG
+A1UEChMKR2xvYmFsU2lnbjETMBEGA1UEAxMKR2xvYmFsU2lnbjCCASIwDQYJKoZI
+hvcNAQEBBQADggEPADCCAQoCggEBAMwldpB5BngiFvXAg7aEyiie/QV2EcWtiHL8
+RgJDx7KKnQRfJMsuS+FggkbhUqsMgUdwbN1k0ev1LKMPgj0MK66X17YUhhB5uzsT
+gHeMCOFJ0mpiLx9e+pZo34knlTifBtc+ycsmWQ1z3rDI6SYOgxXG71uL0gRgykmm
+KPZpO/bLyCiR5Z2KYVc3rHQU3HTgOu5yLy6c+9C7v/U9AOEGM+iCK65TpjoWc4zd
+QQ4gOsC0p6Hpsk+QLjJg6VfLuQSSaGjlOCZgdbKfd/+RFO+uIEn8rUAVSNECMWEZ
+XriX7613t2Saer9fwRPvm2L7DWzgVGkWqQPabumDk3F2xmmFghcCAwEAAaNCMEAw
+DgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFI/wS3+o
+LkUkrk1Q+mOai97i3Ru8MA0GCSqGSIb3DQEBCwUAA4IBAQBLQNvAUKr+yAzv95ZU
+RUm7lgAJQayzE4aGKAczymvmdLm6AC2upArT9fHxD4q/c2dKg8dEe3jgr25sbwMp
+jjM5RcOO5LlXbKr8EpbsU8Yt5CRsuZRj+9xTaGdWPoO4zzUhw8lo/s7awlOqzJCK
+6fBdRoyV3XpYKBovHd7NADdBj+1EbddTKJd+82cEHhXXipa0095MJ6RMG3NzdvQX
+mcIfeg7jLQitChws/zyrVQ4PkX4268NXSb7hLi18YIvDQVETI53O9zJrlAGomecs
+Mx86OyXShkDOOyyGeMlhLxS67ttVb9+E7gUJTb0o2HLO02JQZR7rkpeDMdmztcpH
+WD9f
+-----END CERTIFICATE-----
diff --git a/test/rubygems/test_bundled_ca.rb b/test/rubygems/test_bundled_ca.rb
@@ -46,11 +46,15 @@ def test_accessing_rubygems
     assert_https('rubygems.org')
   end
 
-  def test_accessing_fastly
-    assert_https('rubygems.global.ssl.fastly.net')
+  def test_accessing_www_rubygems
+    assert_https('www.rubygems.org')
+  end
+
+  def test_accessing_staging
+    assert_https('staging.rubygems.org')
   end
 
   def test_accessing_new_index
-    assert_https('fastly.rubygems.org')
+    assert_https('index.rubygems.org')
   end
 end if defined?(OpenSSL::SSL)
diff --git a/util/update_bundled_ca_certificates.rb b/util/update_bundled_ca_certificates.rb
@@ -5,16 +5,13 @@
 
 URIS = [
   URI('https://rubygems.org'),
+  URI('https://www.rubygems.org'),
   URI('https://index.rubygems.org'),
   URI('https://staging.rubygems.org'),
-  URI('https://fastly.rubygems.org'),
-  URI('https://rubygems.global.ssl.fastly.net'),
 ].freeze
 
 HOSTNAMES_TO_MAP = [
-  'rubygems.global.ssl.fastly.net',
   'rubygems.org',
-  'index.rubygems.org',
 ].freeze
 
 def connect_to(uri, store)