ssl/ca-global: add ANSSI and CNNIC to the blacklist

diff --git a/modules/ssl/files/ca-certificates-global.conf b/modules/ssl/files/ca-certificates-global.conf
index e6dece8..c97220f 100644 (file)
--- a/modules/ssl/files/ca-certificates-global.conf
+++ b/modules/ssl/files/ca-certificates-global.conf
@@ -13,3 +13,10 @@
 !mozilla/WoSign.crt
 !mozilla/CA_WoSign_ECC_Root.crt
 !mozilla/Certification_Authority_of_WoSign_G2.crt
+
+# https://wiki.mozilla.org/CA/Additional_Trust_Changes#CNNIC
+!mozilla/CNNIC_ROOT.crt
+!mozilla/China_Internet_Network_Information_Center_EV_Certificates_Root.crt
+
+# https://wiki.mozilla.org/CA/Additional_Trust_Changes#ANSSI
+!mozilla/IGC_A.crt