{"id":19388311,"url":"https://github.com/mk-fg/ca-certificates-whitelist-filter","last_synced_at":"2026-05-10T06:35:31.261Z","repository":{"id":214460633,"uuid":"736580634","full_name":"mk-fg/ca-certificates-whitelist-filter","owner":"mk-fg","description":"Tool to filter system-wide trusted Web PKI TLS Certificate Authorities in linux distros on a whitelist-basis","archived":false,"fork":false,"pushed_at":"2024-06-16T23:34:35.000Z","size":26,"stargazers_count":1,"open_issues_count":0,"forks_count":0,"subscribers_count":2,"default_branch":"master","last_synced_at":"2025-01-07T08:45:41.393Z","etag":null,"topics":["certificates","cryptography","linux","python","security","sysadmin","tls","tool","trust","web-pki","x509"],"latest_commit_sha":null,"homepage":"","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"wtfpl","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/mk-fg.png","metadata":{"files":{"readme":"README.rst","changelog":null,"contributing":null,"funding":null,"license":"COPYING","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2023-12-28T09:41:35.000Z","updated_at":"2024-06-16T23:34:38.000Z","dependencies_parsed_at":"2023-12-30T20:30:59.430Z","dependency_job_id":"cb0ecbec-6cc1-40a2-9e83-47602ebcaae6","html_url":"https://github.com/mk-fg/ca-certificates-whitelist-filter","commit_stats":null,"previous_names":["mk-fg/ca-certificates-whitelist-filter"],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mk-fg%2Fca-certificates-whitelist-filter","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mk-fg%2Fca-certificates-whitelist-filter/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mk-fg%2Fca-certificates-whitelist-filter/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mk-fg%2Fca-certificates-whitelist-filter/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/mk-fg","download_url":"https://codeload.github.com/mk-fg/ca-certificates-whitelist-filter/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":240549434,"owners_count":19819131,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["certificates","cryptography","linux","python","security","sysadmin","tls","tool","trust","web-pki","x509"],"created_at":"2024-11-10T10:12:26.156Z","updated_at":"2026-05-10T06:35:31.255Z","avatar_url":"https://github.com/mk-fg.png","language":"Python","funding_links":[],"categories":[],"sub_categories":[],"readme":"ca-certificates-whitelist-filter\n''''''''''''''''''''''''''''''''\n\nRather simple script to process p11-kit_ Certificate Authority bundles\nfor \"ca-certificates\" package in linux distros, and only leave explicitly\nwhitelisted certs there, removing the rest.\n\nThis allows to control which TLS Certificate Authorities are trusted\nby all applications and tools system-wide on a whitelist-basis.\n\nModern Web PKI requires only a few CAs for almost all websites (as of 2023),\nand others on that list are unlikely to be used in non-bogus ways, so nothing\nbeyond few top CAs is realistically worth \"trusting\" for every TLS connection.\np11-kit only allows blacklisting CAs, which doesn't work for \"these few and no\nothers\" approach, and is not safe against junk-CAs added upstream in the future.\n\nDespite same name between linux distributions, ca-certificates package tends\nto be somewhat custom per-distro (e.g. in Arch_, Fedora_, OpenSUSE_),\nso maybe scripts in some of those might not have this issue, and allow\nwhitelisting already in their wrapper tools - make sure to check there first.\n\nNote that there are other ways to address the issue of having too many\nuntrustworthy or unnecessary CAs, with always some more in the works,\nso I'd recommend also looking into alternative options for a specific use-case,\nas this is a rather blunt approach.\n\nRelated `\"Trimming-down list of trusted TLS ca-certificates\" blog post`_\ngoes into a bit more detail of what this script is meant to do.\n\nFor a good example of the kind of spoofing this might help against - see e.g.\n`CloudFlare 1.1.1.1 DNS TLS cert mis-issuance incident by some obscure CA in 2025`_.\n\nRepository URLs:\n\n- https://github.com/mk-fg/ca-certificates-whitelist-filter\n- https://codeberg.org/mk-fg/ca-certificates-whitelist-filter\n- https://fraggod.net/code/git/ca-certificates-whitelist-filter\n\n.. _p11-kit: https://p11-glue.github.io/p11-glue/\n.. _Arch: https://gitlab.archlinux.org/archlinux/packaging/packages/ca-certificates\n.. _Fedora: https://src.fedoraproject.org/rpms/ca-certificates/tree/rawhide\n.. _OpenSUSE: https://github.com/openSUSE/ca-certificates\n.. _\"Trimming-down list of trusted TLS ca-certificates\" blog post:\n  https://blog.fraggod.net/2023/12/28/trimming-down-list-of-trusted-tls-ca-certificates-system-wide-using-a-whitelist-approach.html\n.. _CloudFlare 1.1.1.1 DNS TLS cert mis-issuance incident by some obscure CA in 2025:\n  https://arstechnica.com/security/2025/09/mis-issued-certificates-for-1-1-1-1-dns-service-pose-a-threat-to-the-internet/\n\n\nUsage\n-----\n\nIt is a python 3.8+ script, with an optional dependency on `cryptography.io module`_,\nonly used for printing certificate fingerprints and attributes nicely in ``-l/--list``\nor ``-L/--list-all`` modes (will be simply omitted without the module).\n\nTo work in normal mode, script requires a whitelist file, and changes files in\n\"ca-certificates/trust-source\" directory (``/usr/share/ca-certificates/trust-source/``\nby default).\n\nWhitelist filters CAs by \"label:\" attribute from p11-kit bundles, allows using\nshell-glob wildcards, #-comments, and can look something like this::\n\n  Baltimore CyberTrust Root # CloudFlare\n  ISRG Root X* # Let's Encrypt\n  GlobalSign * # Google\n  DigiCert *\n  Sectigo *\n  Go Daddy *\n  Microsoft *\n  USERTrust *\n\nThese labels can be listed using ``-L/--list-all`` tool option, for example:\n``./ca-certs-whitelist-filter -L``\n\nIf `\"cryptography\" python module`_ is installed, it will also list X.509 cert\nfingerprints and all attributes (organizationName, commonName, countryName, etc).\n\nTo actually do the filtering, script should be run with ``-w/--whitelist`` option::\n\n  ./ca-certs-whitelist-filter -w my-roots.conf\n\n(add optional trust-dir argument to use local test-dir instead of system-wide one)\n\nScript makes a backup of the original CA bundles, and can be re-run without\nclobbering the backups, to further filter remaining CAs in the produced bundle.\n\nBrowsers like firefox use this bundle dir directly, so should pick the change\nup immediately in both old and new tabs, while other apps might also need running\n``update-ca-trust`` distro script to export those into e.g. ``/etc/ssl/cert.pem``\nfor OpenSSL and other libs/tools.\n\nIt is intended to be run automatically on linux from a package manager hook like\nthis (Arch Linux pacman hook example)::\n\n  [Trigger]\n  Operation = Install\n  Operation = Upgrade\n  Operation = Remove\n  Type = Path\n  Target = usr/share/ca-certificates/trust-source/*\n\n  [Action]\n  Description = Filtering ca-certificates...\n  When = PostTransaction\n  Exec = /usr/local/bin/ca-certs-whitelist-filter -w /etc/ca-certificates/whitelist.conf\n\nSo that this filtering policy will get re-applied automatically on all package\nupdates that install/update/remove ca-certificates bundles.\n\nTo work properly, such hook must either be invoked before other hook(s) that run\n``update-ca-trust`` or similar export-script, or hook should run that itself as well.\n\n.. _cryptography.io module: https://cryptography.io\n.. _\"cryptography\" python module: https://cryptography.io\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmk-fg%2Fca-certificates-whitelist-filter","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fmk-fg%2Fca-certificates-whitelist-filter","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmk-fg%2Fca-certificates-whitelist-filter/lists"}