Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.bugs.dist > #952990 > unrolled thread

Bug#926388: let Firefox trust /etc/ssl/certs/ca-certificates.crt

Back to article view | Back to linux.debian.bugs.dist

Contents

  Bug#926388: let Firefox trust /etc/ssl/certs/ca-certificates.crt Mike Gabriel <mike.gabriel@das-netzwerkteam.de> - 2019-04-04 12:40 +0200
    Bug#926388: let Firefox trust /etc/ssl/certs/ca-certificates.crt Wolfgang Schweer <w.schweer@gmx.de> - 2019-04-04 14:40 +0200
      Bug#926388: let Firefox trust /etc/ssl/certs/ca-certificates.crt Mike Gabriel <mike.gabriel@das-netzwerkteam.de> - 2019-04-04 15:10 +0200
        Bug#926388: let Firefox trust /etc/ssl/certs/ca-certificates.crt Wolfgang Schweer <w.schweer@gmx.de> - 2019-04-04 17:30 +0200
          Bug#926388: let Firefox trust /etc/ssl/certs/ca-certificates.crt Mike Gabriel <mike.gabriel@das-netzwerkteam.de> - 2019-04-04 23:50 +0200

#952990 — Bug#926388: let Firefox trust /etc/ssl/certs/ca-certificates.crt

[Multipart message — attachments visible in raw view] — view raw

Package: debian-edu-config
Severity: wishlist

Hi,

today I have played with Firefox and custom CA certificate import into  
the browser. This over-all sucks. Firefox does not consider the  
system-wide CA cert store as trustworthy by default.

However, there is a simple solution to this: the trust cryptography  
module in p11-kit-modules.

For this, to be doable on Debian Edu sites, we need to add this content:

```
library=/usr/lib/x86_64-linux-gnu/pkcs11/p11-kit-trust.so
name=PKCS#11 Trust Module
NSS=trustOrder=100
```

to debian-edu-config's file  
etc/skel/.mozilla/firefox/debian-edu.default/pkcs11.txt

With this file in place in fresh mozilla profiles, Firefox will  
activate the pkcs11 trust module and trust CA certificates in  
/etc/ssl/certs/ca-certificates.crt.

A similar solution must be found for chromium.

Mike
-- 

DAS-NETZWERKTEAM
c\o Technik- und Ökologiezentrum Eckernförde
Mike Gabriel, Marienthaler str. 17, 24340 Eckernförde
mobile: +49 (1520) 1976 148
landline: +49 (4354) 8390 139

GnuPG Fingerprint: 9BFB AEE8 6C0A A5FF BF22  0782 9AF4 6B30 2577 1B31
mail: mike.gabriel@das-netzwerkteam.de, http://das-netzwerkteam.de

[toc] | [next] | [standalone]

#953005

[Multipart message — attachments visible in raw view] — view raw

Moin Mike,

On Thu, Apr 04, 2019 at 10:31:54AM +0000, Mike Gabriel wrote:
> to debian-edu-config's file
> etc/skel/.mozilla/firefox/debian-edu.default/pkcs11.txt
 
While this was valid for Stretch, in Buster /etc/skel isn't used 
anymore. Certificate related configuration is done in gosa-create.
(Works for Firefox-ESR, Thunderbird, Konqueror and Chromium).

See also:
https://wiki.debian.org/DebianEdu/Documentation/Buster/Features#Other_changes_compared_to_the_previous_release
for SSL/TLS related changes.

There's also a tool (share/debian-edu-config/tools/update-cert-dbs) 
which will be called upon upgrades from Stretch to configure this for 
existing user accounts.

Wolfgang

[toc] | [prev] | [next] | [standalone]

#953013

[Multipart message — attachments visible in raw view] — view raw

HI Wolfgang,

On  Do 04 Apr 2019 14:19:31 CEST, Wolfgang Schweer wrote:

> Moin Mike,
>
> On Thu, Apr 04, 2019 at 10:31:54AM +0000, Mike Gabriel wrote:
>> to debian-edu-config's file
>> etc/skel/.mozilla/firefox/debian-edu.default/pkcs11.txt
>
> While this was valid for Stretch, in Buster /etc/skel isn't used
> anymore. Certificate related configuration is done in gosa-create.
> (Works for Firefox-ESR, Thunderbird, Konqueror and Chromium).
>
> See also:
> https://wiki.debian.org/DebianEdu/Documentation/Buster/Features#Other_changes_compared_to_the_previous_release
> for SSL/TLS related changes.
>
> There's also a tool (share/debian-edu-config/tools/update-cert-dbs)
> which will be called upon upgrades from Stretch to configure this for
> existing user accounts.
>
> Wolfgang

While the above named approach and scripts are good for handling the  
DebianEdu root-CA, it cannot be used for site-specific adaptations.

Of course, I could have copied and adapted update-cert-dbs to my  
purpose, but for generic CA rollouts, I find the pkcs11.txt approach  
much more elegant.

Btw, for Chrome/Chromium, pkcs11.txt as given above in the bug report  
needs to be placed into ~/.pki/nssdb/pkcs11.txt.

I needed this as I set up an e2guardian with SSL MitM and https deep  
package introspection (I know, this can be seen as "URGH..."). I also  
had a user-specific import script, but that did not scale well with  
many users on site. Handling this via pkcs11.txt and the trust pki  
module came in much smarter.

Feel free to keep this bug open for bullseye, so we can re-discuss  
this approach or close it. (In IT-Zukunft Schule, we will use it).

Greets,
Mike
-- 

DAS-NETZWERKTEAM
c\o Technik- und Ökologiezentrum Eckernförde
Mike Gabriel, Marienthaler str. 17, 24340 Eckernförde
mobile: +49 (1520) 1976 148
landline: +49 (4354) 8390 139

GnuPG Fingerprint: 9BFB AEE8 6C0A A5FF BF22  0782 9AF4 6B30 2577 1B31
mail: mike.gabriel@das-netzwerkteam.de, http://das-netzwerkteam.de

[toc] | [prev] | [next] | [standalone]

#953026

[Multipart message — attachments visible in raw view] — view raw

On Thu, Apr 04, 2019 at 01:03:50PM +0000, Mike Gabriel wrote:
> Feel free to keep this bug open for bullseye, so we can re-discuss this
> approach or close it.

Yes, let's consider this for bullseye.

Just for the record:

[ pkcs11.txt ]
On a 64-bit PC Buster system this is working ok:
> library=/usr/lib/x86_64-linux-gnu/pkcs11/p11-kit-trust.so
> name=PKCS#11 Trust Module
> NSS=trustOrder=100

To get it working for a mixed 64-bit / 32-bit setup this content 
seems to work:
library=/usr/lib/x86_64-linux-gnu/pkcs11/p11-kit-trust.so
library=/usr/lib/i386-linux-gnu/pkcs11/p11-kit-trust.so
name=PKCS#11 Trust Module
NSS=trustOrder=100

For already existing accounts:

[ Firefox-ESR ]
Checking the existence and then removing 
~/.mozilla/firefox/debian-edu.default/{cert8.db,key3.db,cert9.db,key4.db}
after replacing the exsting pkcs11.txt file seems to work.

[ Thunderbird ]
Similar to Firefox-ESR; location:
~/.thunderbird/debian-edu.default/{cert8.db,key3.db,cert9.db,key4.db}

[ Chromium, Konqueror, and others using PKI ]
Check the existence and then remove
~/.pki/{cert9.db,key4.db}
after replacing the exsting pkcs11.txt file


Wolfgang

[toc] | [prev] | [next] | [standalone]

#953079

[Multipart message — attachments visible in raw view] — view raw

Hi Wolfgang.

On  Do 04 Apr 2019 17:18:38 CEST, Wolfgang Schweer wrote:

> On Thu, Apr 04, 2019 at 01:03:50PM +0000, Mike Gabriel wrote:
>> Feel free to keep this bug open for bullseye, so we can re-discuss this
>> approach or close it.
>
> Yes, let's consider this for bullseye.

Yep.

> Just for the record:
>
> [ pkcs11.txt ]
> On a 64-bit PC Buster system this is working ok:
>> library=/usr/lib/x86_64-linux-gnu/pkcs11/p11-kit-trust.so
>> name=PKCS#11 Trust Module
>> NSS=trustOrder=100

Nice.

> To get it working for a mixed 64-bit / 32-bit setup this content
> seems to work:
> library=/usr/lib/x86_64-linux-gnu/pkcs11/p11-kit-trust.so
> library=/usr/lib/i386-linux-gnu/pkcs11/p11-kit-trust.so
> name=PKCS#11 Trust Module
> NSS=trustOrder=100

Nice add-on information.

> For already existing accounts:
>
> [ Firefox-ESR ]
> Checking the existence and then removing
> ~/.mozilla/firefox/debian-edu.default/{cert8.db,key3.db,cert9.db,key4.db}
> after replacing the exsting pkcs11.txt file seems to work.

That is not necessary IMHO. If pkcs11.txt exists, the above text  
config block needs to be appended to it. If it does not exist, copying  
over the above pkcs11.txt is sufficient.

> [ Thunderbird ]
> Similar to Firefox-ESR; location:
> ~/.thunderbird/debian-edu.default/{cert8.db,key3.db,cert9.db,key4.db}

Same here. The .db files can stay. If pkcs11.txt exists, append the  
above config block.

> [ Chromium, Konqueror, and others using PKI ]
> Check the existence and then remove
> ~/.pki/{cert9.db,key4.db}
> after replacing the exsting pkcs11.txt file

Same here. Again, not replacing pkcs11.txt, but appending to it, if it  
exists. The .db files can stay.

Mike
-- 

DAS-NETZWERKTEAM
c\o Technik- und Ökologiezentrum Eckernförde
Mike Gabriel, Marienthaler str. 17, 24340 Eckernförde
mobile: +49 (1520) 1976 148
landline: +49 (4354) 8390 139

GnuPG Fingerprint: 9BFB AEE8 6C0A A5FF BF22  0782 9AF4 6B30 2577 1B31
mail: mike.gabriel@das-netzwerkteam.de, http://das-netzwerkteam.de

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.bugs.dist

csiph-web