You are not logged in.
Read https://pluralistic.net/2022/11/09/info … ting-trust and saw that we have TrustCor's root certs in /etc/ssl/certs.
Maybe removal is in order?
Offline
So you registered an account to tell us what?
That a random blog think that TrustCor should not be trusted and we should not too?
Why should we trust you?
Do you even know how /etc/ssl/certs got to your system? Basically upstream is Mozilla. And since the issue has originally been brought to them first, they are fully aware of the matter.
To anyone interested in the issue here:
The blog is trash in terms of laying out the facts but it comes down to those two sources:
https://groups.google.com/a/mozilla.org … bBho-VBQAJ
https://www.washingtonpost.com/technolo … nnections/
Neither Mozilla, Apple and Chrome have removed Trustcor from their trusted CA list yet.
But TrustCor is a bit suspicious (to say the least) as a company.
Last edited by Koatao (2022-11-12 22:32:10)
Offline
Lol.
Offline
@squiddo can you confirm the issue is resolved in ca-certificates-mozilla 3.86-1 currently in testing which contains [1] the fix for [2] and the November 30, 2022 expiry deadline has passed.
[1] https://hg.mozilla.org/projects/nss/rev … d01b5d38c9
[2] https://bugzilla.mozilla.org/show_bug.cgi?id=1803453
Offline
Installed ca-certificates-mozilla-3.86-1-x86_64.pkg.tar.zst:
$ sudo pacman -Ss ca-certificates-mozilla
core/ca-certificates-mozilla 3.85-1 [installed: 3.86-1]
Mozilla's set of trusted CA certificates
$ find /etc/ca-certificates/ | grep -i trustcor
/etc/ca-certificates/extracted/cadir/TrustCor_RootCert_CA-2.pem
/etc/ca-certificates/extracted/cadir/TrustCor_RootCert_CA-1.pem
/etc/ca-certificates/extracted/cadir/TrustCor_ECA-1.pemI'm happy to help anyway I can. Is there something else I should look at?
Offline
Looks like the current certdata.txt does not have the CKA_NSS_SERVER_DISTRUST_AFTER set per the bug report.
Offline
The certificates still being present is not an issue provided they are not trusted.
Edit:
Not sure how to verify the trust / trust expiry.
Edit2:
Seems to be more nuanced https://utcc.utoronto.ca/~cks/space/blo … ustProblem
If you want to locally block the certificates copy them to /etc/ca-certificates/trust-source/blocklist then run update-ca-trust.
Last edited by loqs (2022-12-12 04:21:27)
Offline
Thanks for that link -- explains what we're seeing. I will follow your advice. Many thanks!
Offline