9:19 a.m.
For EOL FF versions, how can I remove the co-opted
Diginotar CA certificate? Instructions given by Mozilla
does not remove this certificate.
If the root CA's cannot be manually removed, Is there
a FF rpm that has the fix?
10:28 a.m.
On 09/06/2011 08:24 AM, Fernando Cassia wrote:
On Tue, Sep 6, 2011 at 12:18, Daniel B. Thurman
<dant(a)cdkkt.com> wrote:
> Now... I need to figure out how to do a backport of ca-certificates
> pkg so if anyone has any idea how this can be done, I am all ears...
Well, Wikileaks has proved that you can only hide information for so long.
So why not relax and enjoy the ride while your financial information
and all your transactions are sent almost in the open on the world
wide web? (sarcasm).
JOKE JOKE
FC
NOT funny (har.... har...) ;)
10:21 a.m.
Am 06.09.2011 17:18, schrieb Daniel B. Thurman:
On 09/06/2011 08:08 AM, Pasha R wrote:
> On Tue, Sep 6, 2011 at 5:19 PM, Daniel B. Thurman <dant(a)cdkkt.com> wrote:
>> For EOL FF versions, how can I remove the co-opted
>> Diginotar CA certificate? Instructions given by Mozilla
>> does not remove this certificate.
>>
>> If the root CA's cannot be manually removed, Is there
>> a FF rpm that has the fix?
> Uneducated guess: try running FF as root and then following
> instructions by mozilla
I already explained that the instructions given by Mozilla
does not work. You can try to 'delete' DigiNotar per Mozilla's
instructions, having done that, and going back to check will
show that it still appears. This root CA is a built-in object...
so it cannot be deleted.
Since there are no updates for end-of-life fedora versions, one
may have to backport the ca-certificates packages, since not
only Firefox is affected but many others such as Seamonkey,
Thunderbird, and many other applications, as Kevin Fenzi wrote.
Now... I need to figure out how to do a backport of ca-certificates
pkg so if anyone has any idea how this can be done, I am all ears...
wget
http://kojipkgs.fedoraproject.org/packages/ca-certificates/2011.78/1.fc14...
rpmbuild --rebuild ca-certificates-2011.78-1.fc14.src.rpm
7:28 a.m.
On Tue, 2011-09-06 at 17:21 +0200, Reindl Harald wrote:
Am 06.09.2011 17:18, schrieb Daniel B. Thurman:
> On 09/06/2011 08:08 AM, Pasha R wrote:
>> On Tue, Sep 6, 2011 at 5:19 PM, Daniel B. Thurman <dant(a)cdkkt.com> wrote:
>>> For EOL FF versions, how can I remove the co-opted
>>> Diginotar CA certificate? Instructions given by Mozilla
>>> does not remove this certificate.
>>>
>>> If the root CA's cannot be manually removed, Is there
>>> a FF rpm that has the fix?
>> Uneducated guess: try running FF as root and then following
>> instructions by mozilla
> I already explained that the instructions given by Mozilla
> does not work. You can try to 'delete' DigiNotar per Mozilla's
> instructions, having done that, and going back to check will
> show that it still appears. This root CA is a built-in object...
> so it cannot be deleted.
>
> Since there are no updates for end-of-life fedora versions, one
> may have to backport the ca-certificates packages, since not
> only Firefox is affected but many others such as Seamonkey,
> Thunderbird, and many other applications, as Kevin Fenzi wrote.
>
> Now... I need to figure out how to do a backport of ca-certificates
> pkg so if anyone has any idea how this can be done, I am all ears...
wget
http://kojipkgs.fedoraproject.org/packages/ca-certificates/2011.78/1.fc14...
rpmbuild --rebuild ca-certificates-2011.78-1.fc14.src.rpm
----
I think ca-certificates is only about the OS root certs and all the
mozilla software (FF, TB, SM) do not use the OS certificate store so
this would have no impact. Mozilla software, as part of their heritage
maintain their own certificate store and thus would have to be updated
separately.
That said, I believe I have seen instances where you delete a trusted
root certificate and the first time, it remains in the database but not
trusted and the second time you delete it, it actually finally removes
it. I may be confusing that operation with Apple's Keychain Access
behavior though...
Craig
--
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.
12:54 a.m.
On Tue, Sep 6, 2011 at 7:05 PM, Daniel B. Thurman <dant(a)cdkkt.com> wrote:
On 09/06/2011 08:49 AM, Pasha R wrote:
> On Tue, Sep 6, 2011 at 6:18 PM, Daniel B. Thurman <dant(a)cdkkt.com> wrote:
>> On 09/06/2011 08:08 AM, Pasha R wrote:
>>> On Tue, Sep 6, 2011 at 5:19 PM, Daniel B. Thurman <dant(a)cdkkt.com>
wrote:
>>>> For EOL FF versions, how can I remove the co-opted
>>>> Diginotar CA certificate? Instructions given by Mozilla
>>>> does not remove this certificate.
>>>>
>>>> If the root CA's cannot be manually removed, Is there
>>>> a FF rpm that has the fix?
>>> Uneducated guess: try running FF as root and then following
>>> instructions by mozilla
>> I already explained that the instructions given by Mozilla
>> does not work. You can try to 'delete' DigiNotar per Mozilla's
>> instructions, having done that, and going back to check will
>> show that it still appears. This root CA is a built-in object...
>> so it cannot be deleted.
>>
>> Since there are no updates for end-of-life fedora versions, one
>> may have to backport the ca-certificates packages, since not
>> only Firefox is affected but many others such as Seamonkey,
>> Thunderbird, and many other applications, as Kevin Fenzi wrote.
>>
>> Now... I need to figure out how to do a backport of ca-certificates
>> pkg so if anyone has any idea how this can be done, I am all ears...
>>
>>
> Instructions (almost) worked for me - CA is still displayed, but if
> you press "Edit trust" button, you will see, that all checkboxes are
> unchecked, so it will not be used for anything.
Why do you say: "(almost) worked" ?
Because the certificate is still displayed. Still, I think it is ok if
all trust checkbox are unchecked.
11:10 a.m.
On 09/06/2011 08:52 AM, Tom Horsley wrote:
On Tue, 06 Sep 2011 08:18:34 -0700
Daniel B. Thurman wrote:
> Now... I need to figure out how to do a backport of ca-certificates
> pkg so if anyone has any idea how this can be done, I am all ears...
My approach would be to download the source RPM for the old fedora,
do an rpmbuild -bp, then substitute the certificate data from
the source rpm for the new fedora and pick up the rpmbuild after
the -bp stage to really make the rpms with the patched certs.
I am assuming that I
could edit: ca-bundle.crt, remove
DigiNotar section, then proceed with a rebuild of Firefox?
Does rebuilding of FF (and Thunderbird) pickup ca-bundle.crt
for it's root CA?
11:05 a.m.
On 09/06/2011 08:49 AM, Pasha R wrote:
On Tue, Sep 6, 2011 at 6:18 PM, Daniel B. Thurman
<dant(a)cdkkt.com> wrote:
> On 09/06/2011 08:08 AM, Pasha R wrote:
>> On Tue, Sep 6, 2011 at 5:19 PM, Daniel B. Thurman <dant(a)cdkkt.com> wrote:
>>> For EOL FF versions, how can I remove the co-opted
>>> Diginotar CA certificate? Instructions given by Mozilla
>>> does not remove this certificate.
>>>
>>> If the root CA's cannot be manually removed, Is there
>>> a FF rpm that has the fix?
>> Uneducated guess: try running FF as root and then following
>> instructions by mozilla
> I already explained that the instructions given by Mozilla
> does not work. You can try to 'delete' DigiNotar per Mozilla's
> instructions, having done that, and going back to check will
> show that it still appears. This root CA is a built-in object...
> so it cannot be deleted.
>
> Since there are no updates for end-of-life fedora versions, one
> may have to backport the ca-certificates packages, since not
> only Firefox is affected but many others such as Seamonkey,
> Thunderbird, and many other applications, as Kevin Fenzi wrote.
>
> Now... I need to figure out how to do a backport of ca-certificates
> pkg so if anyone has any idea how this can be done, I am all ears...
>
>
Instructions (almost) worked for me - CA is still displayed, but if
you press "Edit trust" button, you will see, that all checkboxes are
unchecked, so it will not be used for anything.
Why do you say: "(almost)
worked" ?
10:52 a.m.
On Tue, 06 Sep 2011 08:18:34 -0700
Daniel B. Thurman wrote:
Now... I need to figure out how to do a backport of ca-certificates
pkg so if anyone has any idea how this can be done, I am all ears...
My approach would be to download the source RPM for the old fedora,
do an rpmbuild -bp, then substitute the certificate data from
the source rpm for the new fedora and pick up the rpmbuild after
the -bp stage to really make the rpms with the patched certs.
10:49 a.m.
On Tue, Sep 6, 2011 at 6:18 PM, Daniel B. Thurman <dant(a)cdkkt.com> wrote:
On 09/06/2011 08:08 AM, Pasha R wrote:
> On Tue, Sep 6, 2011 at 5:19 PM, Daniel B. Thurman <dant(a)cdkkt.com> wrote:
>> For EOL FF versions, how can I remove the co-opted
>> Diginotar CA certificate? Instructions given by Mozilla
>> does not remove this certificate.
>>
>> If the root CA's cannot be manually removed, Is there
>> a FF rpm that has the fix?
> Uneducated guess: try running FF as root and then following
> instructions by mozilla
I already explained that the instructions given by Mozilla
does not work. You can try to 'delete' DigiNotar per Mozilla's
instructions, having done that, and going back to check will
show that it still appears. This root CA is a built-in object...
so it cannot be deleted.
Since there are no updates for end-of-life fedora versions, one
may have to backport the ca-certificates packages, since not
only Firefox is affected but many others such as Seamonkey,
Thunderbird, and many other applications, as Kevin Fenzi wrote.
Now... I need to figure out how to do a backport of ca-certificates
pkg so if anyone has any idea how this can be done, I am all ears...
Instructions (almost) worked for me - CA is still displayed, but if
you press "Edit trust" button, you will see, that all checkboxes are
unchecked, so it will not be used for anything.
10:37 a.m.
On Tue, 06 Sep 2011 07:19:22 -0700
"Daniel B. Thurman" <dant(a)cdkkt.com> wrote:
For EOL FF versions, how can I remove the co-opted
Diginotar CA certificate? Instructions given by Mozilla
does not remove this certificate.
I think you'll need to build a newer Firefox (and remember for a no
longer supported release the CA certificates are by now I believe not the
only problem you have, and actually probably not the most serious)
So you need a new firefox which will need various other bits updating
which means you can either
- rebuild the needed source rpm packages against your old release
- upgrade either the packageds needed or the box to a supported release
- see if the Centos packages do the job (which for releases close to
their FC origin probably works out)
Remember to make sure the bits firefox assumes are secure (graphics
libraries notably) have also been upgraded with any post FC13 end of
release hole fixes. It very rapidly becomes easier to migrate to a
supported release !
Alan
10:24 a.m.
On Tue, Sep 6, 2011 at 12:18, Daniel B. Thurman <dant(a)cdkkt.com> wrote:
Now... I need to figure out how to do a backport of ca-certificates
pkg so if anyone has any idea how this can be done, I am all ears...
Well, Wikileaks has proved that you can only hide information for so long.
So why not relax and enjoy the ride while your financial information
and all your transactions are sent almost in the open on the world
wide web? (sarcasm).
JOKE JOKE
FC
10:23 a.m.
On 09/06/2011 10:18 AM, Daniel B. Thurman wrote:
On 09/06/2011 08:08 AM, Pasha R wrote:
> On Tue, Sep 6, 2011 at 5:19 PM, Daniel B. Thurman <dant(a)cdkkt.com> wrote:
>> For EOL FF versions, how can I remove the co-opted
>> Diginotar CA certificate? Instructions given by Mozilla
>> does not remove this certificate.
>>
>> If the root CA's cannot be manually removed, Is there
>> a FF rpm that has the fix?
> Uneducated guess: try running FF as root and then following
> instructions by mozilla
I already explained that the instructions given by Mozilla
does not work. You can try to 'delete' DigiNotar per Mozilla's
instructions, having done that, and going back to check will
show that it still appears. This root CA is a built-in object...
so it cannot be deleted.
Since there are no updates for end-of-life fedora versions, one
may have to backport the ca-certificates packages, since not
only Firefox is affected but many others such as Seamonkey,
Thunderbird, and many other applications, as Kevin Fenzi wrote.
Now... I need to figure out how to do a backport of ca-certificates
pkg so if anyone has any idea how this can be done, I am all ears...
Why not just download Firefox from Mozilla and install in either
/usr/local/Firefox or in ~/Firefox.
--
-- Steve
10:18 a.m.
On 09/06/2011 08:08 AM, Pasha R wrote:
On Tue, Sep 6, 2011 at 5:19 PM, Daniel B. Thurman
<dant(a)cdkkt.com> wrote:
> For EOL FF versions, how can I remove the co-opted
> Diginotar CA certificate? Instructions given by Mozilla
> does not remove this certificate.
>
> If the root CA's cannot be manually removed, Is there
> a FF rpm that has the fix?
Uneducated guess: try running FF as root and then following
instructions by mozilla
I already explained that the instructions given by Mozilla
does not work. You can try to 'delete' DigiNotar per Mozilla's
instructions, having done that, and going back to check will
show that it still appears. This root CA is a built-in object...
so it cannot be deleted.
Since there are no updates for end-of-life fedora versions, one
may have to backport the ca-certificates packages, since not
only Firefox is affected but many others such as Seamonkey,
Thunderbird, and many other applications, as Kevin Fenzi wrote.
Now... I need to figure out how to do a backport of ca-certificates
pkg so if anyone has any idea how this can be done, I am all ears...
10:08 a.m.
On Tue, Sep 6, 2011 at 5:19 PM, Daniel B. Thurman <dant(a)cdkkt.com> wrote:
For EOL FF versions, how can I remove the co-opted
Diginotar CA certificate? Instructions given by Mozilla
does not remove this certificate.
If the root CA's cannot be manually removed, Is there
a FF rpm that has the fix?
Uneducated guess: try running FF as root and then following
instructions by mozilla
10 a.m.
On Tue, 06 Sep 2011 07:19:22 -0700
"Daniel B. Thurman" <dant(a)cdkkt.com> wrote:
For EOL FF versions, how can I remove the co-opted
Diginotar CA certificate? Instructions given by Mozilla
does not remove this certificate.
If the root CA's cannot be manually removed, Is there
a FF rpm that has the fix?
Well, of course the first suggestion: upgrade to a supported release?
Failing that, you could look at the changes to the ca-certificates
package and see if you could duplicate them on your release:
http://pkgs.fedoraproject.org/gitweb/?p=ca-certificates.git
Good luck.
kevin
4663
days inactive
4672
days old
14 comments
9 participants
participants (9)
-
Alan Cox -
Craig White -
Dan Thurman -
Fernando Cassia -
Kevin Fenzi -
Pasha R -
Reindl Harald -
SternData -
Tom Horsley