2

I have a FreeBSD-11 Mate desktop from which I am attempting to connect to an internal WebDaV resource that uses a privately issued certificate. When the file browser / connect to server dialogue box is provided the server name, protocol (https/webdav), user name and password then I get this message box:

The site's identity can't be verified:
    The signing certificate authority is not known.

Certificate information:
    Identity: webdav.hamilton.harte-lyne.ca
    Verified by: CA HLL ISSUER 01
    Expires: 04/09/19
    Fingerprint (SHA1): DB 66 1F BE 27 47 3B D6 50 1B AE 4A 5E 07 3B E5 91 A4 DC 60

Are you really sure you would like to continue?

When I answer Yes then I see this message:

HTTP Error: Unacceptable TLS certificate

I have added our private CA root and issuer certificates to the KDE SSL Preferences for the user in question. But I cannot determine what it is about our certificate that the file browser does not like. We do not have this problem from our CentOS-6 Linux users nor our MS Windows7pro users. These can all connect without problem. So this is specific to FreeBSD.

Is there any way of discovering exactly what FreeBSD does not like about the certificate? Is the error logged anywhere?

4
  • Who issued you this cert? Did you create it yourself? – Rob Jul 26 '17 at 17:39
  • The question clearly states that we operate our own private CA. All of our certificates, including the one in question, are issued by our private CA's. – James B. Byrne Jul 26 '17 at 18:06
  • What software do you use to connect to WebDAV? – arrowd Jul 26 '17 at 18:26
  • I am trying to connect from the file browser which is provided by the mate desktop. – James B. Byrne Jul 26 '17 at 18:37
0

This issue was resolved by adding our root certificates to the file /usr/local/share/certs/ca-root-nss.crt. The caveat being that this file is overwritten every time the provisioning package ca_root_nss is updated and so the private certificates have to be added again thereafter.

3
  • This is why I asked if you issued the certs because you had to concatenate the certificates like you did. I don't know why you think the certs will be overwritten when you upgrade ca_root_nss. Has this happened before? I would be surprised but it's been too long for me to say why. – Rob Jul 26 '17 at 21:32
  • I knew that I had to concatenate our certificates with the trusted root certificate store. My problem was that I did not know which store the file browser application was using. Mate itself has its own certificate store which is used by Konqueror, but which is separately maintained. This infers that it has a more general use than simply for the web browser application. – James B. Byrne Jul 27 '17 at 14:01
  • The the problem with the file '/usr/local/share/certs/ca-root-nss.crt' is that it is always overwritten when the provisioning pkg is upgraded on FreeBSD. Unless this exact file contains the trusted root chain for the server certificate then the server connection authentication attempt fails in the file browser application. So our root certs have to be added after each upgrade. – James B. Byrne Jul 27 '17 at 14:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.