Why is ca-root-nss.crt included in certctl output?

I

ismglz

Looking at the generated /etc/ssl/certs/ hash directory, I find the following two links:
Code: 
lrwxr-xr-x  1 root  wheel    53B May 22 14:42 cd8c0d63.0 -> ../../../usr/share/certs/trusted/AC_RAIZ_FNMT-RCM.pem
lrwxr-xr-x  1 root  wheel    46B May 22 14:42 cd8c0d63.1 -> ../../../usr/local/share/certs/ca-root-nss.crt
My interpretation is that ca-root-nss.crt is mapped to the same certificate as AC_RAIZ_FNMT-RCM.pem. No other certificates in the ca-file type ca-root-nss.crt is mapped as no other hash links maps to it.

I know that I can exclude it by changing the environment TRUSTPATH to exclude the installation directory of the ca-root-nss package but as this file is also installed as a link /etc/ssl/cert.pem this means that if I exclude it, the two trust paths CAfile=/etc/ssl/cert.pem and CAdir=/etc/ssl/certs/ differs, specifically any local certs added via /usr/local/etc/ssl/certs/ is only in the CAdir path.

I know that the portsecurity/ca_root_nss describes replacing the the different cert.pem files so the port does not overwrite them but that is after the installation and my trip up users as certctl is run after freebsd-update so a host may end up in this split situation if the user don't recognise this comment. If certctl should take precedence then it needs a refresh command that also overrates the /etc/ssl/cert.pem.

Why is this so? Am I missing something?
Either if the certificates of ca-root-nss.crt should be included, it should be split up before being hashed by certctl or the the port and base system needs to hash this out, maybe with a flavour of ca-root-nss that do not install the links.

These two things just feels like the are pulling in different directions.

So, what is the thought on this?
Are everyone using custom scripts to solve this, especially regarding pushing the host ca data to Java?
 
My interpretation is that ca-root-nss.crt is mapped to the same certificate as AC_RAIZ_FNMT-RCM.pem
Click to expand...
Your interpretation is wrong.
Why is this so? Am I missing something?
Either if the certificates of ca-root-nss.crt should be included, it should be split up before being hashed by certctl or the the port and base system needs to hash this out, maybe with a flavour of ca-root-nss that do not install the links
Click to expand...
Because openssl doesn't care if a file contains one cert or just a bunch of certs in one file.
OpenSSL works in mysterious ways. Meaning: it's a mess without consistent logic.
 
I don't think you are correct, I have tested (and after your answer, retested) that my interpretation is correct. The only tool I have is openssl on a pristine FreeBSD 13.2-RELEASE which has run certctl rehash as part of freebsd-update. The /etc/ssl/certs/ is populated, no /etc/ssl/cert.pem exists.
My simple test was to try and connect to port 636 on our internal AD, that has certificates signed by an internal CA.

Command lines tested:
1: openssl s_client -connect ad.xx.yyyyyyy.com:636
2: openssl s_client -connect ad.xx.yyyyyyy.com:636 -CApath /etc/ssl/certs/
3: openssl s_client -connect ad.xx.yyyyyyy.com:636 -CAfile /etc/ssl/cert.pem

A: On a clean install, with no ports except sudo and xe-guest, I get return code 20, unable to get local issuer certificate on all three commands. This I find OK, as I have not installed our CA certificate anywhere on the host.

B: Installing security/ca_root_nss, /etc/ssl/certs/ not changed, /etc/ssl/cert.pem a link to /usr/local/share/certs/ca-root-nss.crt.
All three commands still return code 20, unable to get local issuer certificate.

C: Adding our CA certificate at the end of /usr/local/share/certs/ca-root-nss.crt.
Commands 1 and 3 returns 0 (ok), command 2 still returns 20, unable to get local issuer certificate.

D: Running certctl rehash so /usr/local/share/certs/ca-root-nss.crt is added to the /etc/ssl/certs/ as a hash link.
Commands 1 and 3 returns code 0 (ok), command 2 still returns 20, unable to get local issuer certificate.

E: Move our CA cert from end to start of /usr/local/share/certs/ca-root-nss.crt and rerun certctl rehash.
All three commands return code 0 (ok)

So openssl will only read all certificates from a file if it's added via the CAfile operation, not if it's pointed to as an hash link in a CApath operation.

Any comments?
 
ismglz said:
Code: 
../../../usr/share/certs/trusted/AC_RAIZ_FNMT-RCM.pem
lrwxr-xr-x 1 root wheel 46B May 22 14:42 cd8c0d63.1 -> ../../../usr/local/share/certs/ca-root-nss.crt
Click to expand...

ismglz said:
My interpretation is that ca-root-nss.crt is mapped to the same certificate as AC_RAIZ_FNMT-RCM.pem
Click to expand...
That interpretation can't be true, since those are two symlinks pointing to two different files.

Additionally, the openssl binary is weird and not really representative of what the OS does. It also looks up all kinds of stuff from openssl.cnf. It is not related to what certctl does. Which btw has a good manpage.

Other than that, I don't get your point. Can you write in one sentence what you're actually trying to achieve?
 
You must log in or register to reply here.
Back
Top