Note: This is a beta release of Red Hat Bugzilla 5.0. The data contained within is a snapshot of the live data so any changes you make will not be reflected in the production Bugzilla. Also email is disabled so feel free to test any aspect of the site that you want. File any problems you find or give feedback here.
Bug 1691417 - [RFE] update ca-certificates RPM on RHEL 7
Summary: [RFE] update ca-certificates RPM on RHEL 7
Status: NEW
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: ca-certificates
Version: 7.7
Hardware: Unspecified
OS: Unspecified
Target Milestone: rc
: ---
Assignee: Bob Relyea
QA Contact: BaseOS QE Security Team
Depends On:
TreeView+ depends on / blocked
Reported: 2019-03-21 14:58 UTC by wclark
Modified: 2019-04-03 15:48 UTC (History)
0 users

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Last Closed:
Target Upstream Version:

Attachments (Terms of Use)

System ID Priority Status Summary Last Updated
Red Hat Bugzilla 1692589 None NEW [RFE] request to have Mozilla CA root certificate bundle update to latest on RHEL 6 2019-04-03 15:42:22 UTC

Internal Links: 1692589

Description wclark 2019-03-21 14:58:13 UTC
This issue arose out of a support case

What problem/issue/behavior are you having trouble with?  What do you expect to see?

We need to update our CA root trusts to include Sectigo.  Comodo is included in the ca-certificates RPM on our servers, and upon investigation, this RPM has not changed in our synced repo in about a year:

$ yum info ca-certificates
Loaded plugins: product-id, search-disabled-repos
Installed Packages
Name        : ca-certificates
Arch        : noarch
Version     : 2018.2.22
Release     : 70.0.el7_5
Size        : 951 k
Repo        : installed
From repo   : rhel-7-base-rpms-paychex-versioned-201806
Summary     : The Mozilla CA root certificate bundle
URL         :
License     : Public Domain
Description : This package contains the set of CA certificates chosen by the
            : Mozilla Foundation for use with the Internet PKI.

Mozilla does include the Sectigo root trusts in their store:

Are we not syncing the right thing to get package updated, or when will the Sectigo root trust be added to this package?

We can see on the package browser that this is indeed the most recent version of the package for RHEL 7, although there is a version in the RHEL 8 beta RPMs.

Could we have the latest ca-certificates from Mozilla shipped with RHEL 7 as well?

Comment 3 wclark 2019-03-26 00:55:22 UTC
I have also opened the corresponding BZ to have the ca-certificates RPM on RHEL 6 updated with the latest CA root certificate bundle from Mozilla

Note You need to log in before you can comment on or make changes to this bug.