Remove all root CA files (beyond test CAs including private key)

from the OpenSSL distribution.

1 files changed, 8 insertions, 0 deletions

diff --git a/CHANGES b/CHANGES
index 411e69b204..e14c405abb 100644
--- a/CHANGES
+++ b/CHANGES
@@ -686,6 +686,14 @@
 
  Changes between 0.9.8g and 0.9.8h  [xx XXX xxxx]
 
+  *) Remove root CA certificates of commercial CAs:
+
+     The OpenSSL project does not recommend any specific CA and does not
+     have any policy with respect to including or excluding any CA.
+     Therefore it does not make any sense to ship an arbitrary selection
+     of root CA certificates with the OpenSSL software.
+     [Lutz Jaenicke]
+
   *) RSA OAEP patches to fix two separate invalid memory reads.
      The first one involves inputs when 'lzero' is greater than
      'SHA_DIGEST_LENGTH' (it would read about SHA_DIGEST_LENGTH bytes