Arch Linux

saronno

Member

Registered: 2009-10-02

Posts: 219

Issues with certificates with both Firefox and chromium

I tried everything ... I reinstalled both of them.
I canceled the profile and made new ones.
I check with all my other computer if they have issues with certificates: no problem at all.
Checked the date, is ok.

Finally I checked what is installed on the system related to the problem ..

# pacman -Q|egrep '(openssl|curl|ca-cert)'
ca-certificates 20140325-1
ca-certificates-java 20140324-3
curl 7.37.1-1
lib32-curl 7.37.1-1
lib32-openssl 1.0.1.i-1
openssl 1.0.1.i-1
python2-pyopenssl 0.14-3

or if there is an issued with a library ..

#  ldd `which curl`
	linux-vdso.so.1 (0x00007fffd2a48000)
	libcurl.so.4 => /usr/lib/libcurl.so.4 (0x00007f8a1c4d9000)
	libz.so.1 => /usr/lib/libz.so.1 (0x00007f8a1c2c3000)
	libpthread.so.0 => /usr/lib/libpthread.so.0 (0x00007f8a1c0a5000)
	libc.so.6 => /usr/lib/libc.so.6 (0x00007f8a1bcf7000)
	libssh2.so.1 => /usr/lib/libssh2.so.1 (0x00007f8a1bace000)
	libssl.so.1.0.0 => /usr/lib/libssl.so.1.0.0 (0x00007f8a1b860000)
	libcrypto.so.1.0.0 => /usr/lib/libcrypto.so.1.0.0 (0x00007f8a1b44e000)
	libgssapi_krb5.so.2 => /usr/lib/libgssapi_krb5.so.2 (0x00007f8a1b203000)
	libkrb5.so.3 => /usr/lib/libkrb5.so.3 (0x00007f8a1af22000)
	libk5crypto.so.3 => /usr/lib/libk5crypto.so.3 (0x00007f8a1acf0000)
	libcom_err.so.2 => /usr/lib/libcom_err.so.2 (0x00007f8a1aaec000)
	/lib64/ld-linux-x86-64.so.2 (0x00007f8a1c747000)
	libdl.so.2 => /usr/lib/libdl.so.2 (0x00007f8a1a8e8000)
	libkrb5support.so.0 => /usr/lib/libkrb5support.so.0 (0x00007f8a1a6db000)
	libkeyutils.so.1 => /usr/lib/libkeyutils.so.1 (0x00007f8a1a4d7000)
	libresolv.so.2 => /usr/lib/libresolv.so.2 (0x00007f8a1a2c0000)

I try to use a virtual machine on the same machine with ubuntu installed: no problem.

Any idea?

Last edited by saronno (2014-08-15 12:37:44)

saronno

Member

Registered: 2009-10-02

Posts: 219

Re: Issues with certificates with both Firefox and chromium

no one?

ewaller

Administrator

From: Pasadena, CA

Registered: 2009-07-13

Posts: 20,722

Re: Issues with certificates with both Firefox and chromium

So, what are the issues?

---

Nothing is too wonderful to be true, if it be consistent with the laws of nature -- Michael Faraday
The shortest way to ruin a country is to give power to demagogues.— Dionysius of Halicarnassus
---
How to Ask Questions the Smart Way

saronno

Member

Registered: 2009-10-02

Posts: 219

Re: Issues with certificates with both Firefox and chromium

So, what are the issues?

I don't understant why I getting error like that:

It's just an example.
As I said previously with chromium is the same.

saronno

Member

Registered: 2009-10-02

Posts: 219

Re: Issues with certificates with both Firefox and chromium

# curl -v https://areaclienti187.telecomitalia.it
* Rebuilt URL to: https://areaclienti187.telecomitalia.it/
* Hostname was NOT found in DNS cache
*   Trying 62.77.57.164...
* Connected to areaclienti187.telecomitalia.it (62.77.57.164) port 443 (#0)
* successfully set certificate verify locations:
*   CAfile: /etc/ssl/certs/ca-certificates.crt
  CApath: none
* SSLv3, TLS handshake, Client hello (1):
* SSLv3, TLS handshake, Server hello (2):
* SSLv3, TLS handshake, CERT (11):
* SSLv3, TLS handshake, Server finished (14):
* SSLv3, TLS handshake, Client key exchange (16):
* SSLv3, TLS change cipher, Client hello (1):
* SSLv3, TLS handshake, Finished (20):
* SSLv3, TLS change cipher, Client hello (1):
* SSLv3, TLS handshake, Finished (20):
* SSL connection using TLSv1.0 / AES128-SHA
* Server certificate:
* 	 subject: C=IT; ST=Italy; L=Pomezia; O=Telecomitalia; OU=ADM.AP.PM.WO; CN=areaclienti187.telecomitalia.it; emailAddress=luigi.mazzi@guest.telecomitalia.it
* 	 start date: 2013-10-08 10:06:37 GMT
* 	 expire date: 2014-10-08 10:06:37 GMT
* 	 common name: areaclienti187.telecomitalia.it (matched)
* 	 issuer: C=IT; O=I.T. Telecom; OU=Servizi di certificazione; CN=I.T. Telecom Global CA
* 	 SSL certificate verify ok.

With curl no problem at all.

Last edited by saronno (2014-08-15 19:10:09)

saronno

Member

Registered: 2009-10-02

Posts: 219

Re: Issues with certificates with both Firefox and chromium

I wonder if there could be any relation to this:
https://mailman.archlinux.org/pipermail … 25977.html

saronno

Member

Registered: 2009-10-02

Posts: 219

Re: Issues with certificates with both Firefox and chromium

I tried to download the nightly build of firefox.
It works fine, even with the existing profile.

A problem with the certificate chain of the officiale (x64) package?

saronno

Member

Registered: 2009-10-02

Posts: 219

Re: Issues with certificates with both Firefox and chromium

As I said, same thing with chromium ...

saronno

Member

Registered: 2009-10-02

Posts: 219

Re: Issues with certificates with both Firefox and chromium

I closed firefox. I deleted cert8.db from the profile.

I launched firefox nightly build .... cert8.db was created.
I tried to connect .... everything fine.

I closed firefox nightly build.
Launch normal firefox .... I tried to connect ... same old story ... "not trusted"

So, again:
- curl, openssl ... everything fine.
- firefox nightly build is ok.
- firefox official package has problems ... chromium too.
- It's not a problem related to cert8.db .... it has to be something else. Because even if cert8.db is generated by firefox nightly build,
using it with the official package give problems.

Maybe a library?

Last edited by saronno (2014-08-17 11:46:17)

saronno

Member

Registered: 2009-10-02

Posts: 219

Re: Issues with certificates with both Firefox and chromium

Probably I found something ...

https://bugs.archlinux.org/task/39729
https://bugs.debian.org/cgi-bin/bugrepo … bug=743667

the point is that it should be resolved ... infact I have GTE CyberTrust Global Root in /usr/share/ca-certificates/mozilla

Maybe I need something more to update the certificates?

saronno

Member

Registered: 2009-10-02

Posts: 219

Re: Issues with certificates with both Firefox and chromium

Added manually the cert in both browser. Problem solved (at least for GTE CyberTrust ...)

Is there any script to make this automatically?

Maybe the firefox and chromium official package doesn't update the cert automatically ...
something like update-ca-certificates for openssl ...

In other words what I am saying is that the GTE cert was missing ... then they
readded the cert but somehow firefox and chromium doesn't notice the readded GTE cert.

Maybe they missed to use certutil or something like that ...

certutil -A -n "nickname" -t c -d "." [ -a ] -i new.ca.cert

for every certificate or at least for the previously missing one.

Last edited by saronno (2014-08-17 14:07:48)

iohanes

Member

Registered: 2013-02-03

Posts: 13

Re: Issues with certificates with both Firefox and chromium

Thanks, for the help. Now I have the same issue.
Have you found the solution?