2

I can't seem to find where the default list of trusted CA's are on my fedora (23) build. Every time I thought I got close I found a README warning me that the file I was looking at would get overwritten if the command update-ca-trust was ran. And this was verified by me when I was making java keystore edits to /usr/lib/jvm/java-1.8.0-openjdk-1.8.0.92-1.b14.fc23.x86_64/jre/lib/security/cacerts (my deletions were added back in)

The README's did reference me to look: /usr/share/pki/ca-trust-source/ and /etc/pki/ca-trust/source/ however both seem to be deadends, as every crt file I ran an openssl x509 to inspect on didn't list all the root ca's.

An example of one of the default "trusted" root CA's that I would like to remove:

Alias name: chinainternetnetworkinformationcenterevcertificatesroot
Creation date: Jul 5, 2016
Entry type: trustedCertEntry

Owner: CN=China Internet Network Information Center EV Certificates Root, O=China Internet Network Information Center, C=CN
Issuer: CN=China Internet Network Information Center EV Certificates Root, O=China Internet Network Information Center, C=CN
Serial number: 489f0001
Valid from: Tue Aug 31 03:11:25 EDT 2010 until: Sat Aug 31 03:11:25 EDT 2030
Certificate fingerprints:
     MD5:  55:5D:63:00:97:BD:6A:97:F5:67:AB:4B:FB:6E:63:15
     SHA1: 4F:99:AA:93:FB:2B:D1:37:26:A1:99:4A:CE:7F:F0:05:F2:93:5D:1E
     SHA256: 1C:01:C6:F4:DB:B2:FE:FC:22:55:8B:2B:CA:32:56:3F:49:84:4A:CF:C3:2B:7B:E4:B0:FF:59:9F:9E:8C:7A:F7
     Signature algorithm name: SHA1withRSA
     Version: 3
  • In CentOS(6) which is mostly like Fedora, with ca-certificates.noarch 2015.2.4-65.0.1.el6_6 I have that cert in /usr/share/pki/ca-trust-source/ca-bundle.trust.crt at lines 4913-5000. – dave_thompson_085 Jul 6 '16 at 5:06
  • Remember that the files contain many certificates, while openssl x509 will only show the first one found. You'd have to split the file to view all of them. – garethTheRed Jul 6 '16 at 5:51
  • Thanks to both @dave_thompson_085 and @garethTheRed, I think I have the proper file tracked down /usr/share/pki/ca-trust-source/ca-bundle.trust.crt. I'm going to make my edits and I report back if they worked. – userWCB Jul 6 '16 at 13:26
  • The Ubuntu version of this question has an answer for Debian-derived systems. I'd be stunned if it was at all applicable to Fedora, but perhaps other readers may appreciate the link. – Adam Katz Jul 14 '16 at 22:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.