Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

Recently, the CAcert root certificates have been removed from Debian (more precisely, from the ca-certificates package). Since I want to keep them, I backed up the directory

/usr/share/ca-certificates/cacert.org/

containing two .crt files before the upgrade and copied it to

/usr/local/share/ca-certificates/cacert.org/

afterwards. Then I ran update-ca-certificates:

# update-ca-certificates 
Updating certificates in /etc/ssl/certs... 2 added, 0 removed; done.
Running hooks in /etc/ca-certificates/update.d....
Adding debian:cacert.org_class3.pem
Adding debian:cacert.org_root.pem
done.
done.

It looks like all went well. However, Firefox (Iceweasel) still refuses certificates signed by CAcert as untrusted.

Is there anything I missed? Do I have to do something special to make Firefox actually re-read the system certificates?

share|improve this question
    
I would say ==> cyberciti.biz/faq/firefox-adding-trusted-ca –  Kiwy Apr 3 at 12:00
    
Sure. However, I'd like to add it as a system-wide setting. The mechanics for this obviously exist; I'm just not sure how to use it properly. –  user3426575 Apr 3 at 12:04
    
As far as I know firefox does not use the trusted keystore of the sstem but it's own trusted keystore. but it seems possible with this article wiki.mozilla.org/NSS_Shared_DB_Howto –  Kiwy Apr 3 at 12:05

1 Answer 1

Firefox works after a clean installation. If certificate database in cert8.db is deleted, it is regenerated on next Firefox start. This strongly suggests that there is a system-wide default storage of CA certs.

Firefox's source code shows that built-in CA certs are in fact hard-coded into firefox executable. They reside in security/nss/lib/ckfw/builtins/certdata.txt

So there is no way to install a certificate system-wide. Beware that patching source code may bring up issues with intellectual property rights.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.