webpki-root-certs
Advanced tools
This is a crate containing Mozilla's trusted root certificates in self-signed X.509 certificate format.
If you are using webpki or rustls you should prefer webpki-roots - it is
more space efficient and easier to use.
This crate is inspired by certifi.io and uses the data provided by the Common CA Database (CCADB).
The webpki and rustls ecosystem represent trust anchors with the
webpki::TrustAnchor type, containing only the data used as inputs for the RFC
5280 certificate path validation algorithm. In some instances (e.g. when
interacting with native platform certificate verifiers) it may be required to
provide trust anchors as full X.509 self-signed certificates.
Compared to webpki-roots this crate contains the full self-signed certificate
DER data for each trust anchor is included in webpki_roots.
The underlying data is used via the CCADB Data Usage Terms (see LICENSE).
The data in this crate is a derived work of the CCADB data.
Sources are generated in an integration test, in tests/codegen.rs. The test
will fail if the sources are out of date relative to upstream, and update
src/lib.rs if so. The code is generated in deterministic order so changes
to the source should only result from upstream changes.
FAQs
Unknown package
We found that webpki-root-certs demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
/Security News
A malicious NuGet package impersonating Sicoob exfiltrated client IDs, PFX passwords, and banking certificates through Sentry telemetry.
Security News
Feross Aboukhadijeh joins TBPN to discuss Socket's $60M Series C, 500%+ ARR growth, AI's impact on open source, and the rise in supply chain attacks.
Security News
OSV withdrew 157 OSV malware reports after automated false positives incorrectly flagged trusted npm and PyPI packages, sending bad records into tools that rely on OSV data.
