There seems to be a problem when parsing certificates in the p11-kit-trust module and we get lots of messages like this: p11-kit: invalid basic constraints certificate extension p11-kit: invalid basic constraints certificate extension p11-kit: invalid basic constraints certificate extension p11-kit: invalid basic constraints certificate extension p11-kit: invalid basic constraints certificate extension p11-kit: invalid basic constraints certificate extension p11-kit: invalid basic constraints certificate extension p11-kit: invalid basic constraints certificate extension p11-kit: invalid basic constraints certificate extension p11-kit: invalid basic constraints certificate extension p11-kit: invalid basic constraints certificate extension p11-kit: invalid basic constraints certificate extension p11-kit: invalid basic constraints certificate extension p11-kit: invalid basic constraints certificate extension p11-kit: invalid basic constraints certificate extension
Created attachment 104255 [details] [review] trust: Print label of certificate when complaining about basic constraints
Created attachment 104256 [details] [review] trust: Don't use invalid public keys for looking up stapled extensions
The latter patch is the one that actually fixes the issue.
Applying patches from above, discussed @ http://lists.freedesktop.org/archives/p11-glue/2014-August/000457.html & pkg'd in http://download.opensuse.org/repositories/home:/lnussel:/branches:/openSUSE:/13.1:/Update/standard/ Upgrading zypper dup --from BUG_freedesktop_82328 ... The following 4 packages are going to change vendor: libp11-kit0 0.20.1-2.1.2 -> 0.20.1-2.3.1 openSUSE -> obs://build.opensuse.org/home:lnussel p11-kit 0.20.1-2.1.2 -> 0.20.1-2.3.1 openSUSE -> obs://build.opensuse.org/home:lnussel p11-kit-devel 0.20.1-2.1.2 -> 0.20.1-2.3.1 openSUSE -> obs://build.opensuse.org/home:lnussel p11-kit-tools 0.20.1-2.1.2 -> 0.20.1-2.3.1 openSUSE -> obs://build.opensuse.org/home:lnussel ... returning the errant *p11-kit files, mv /usr/share/pki/trust/TEMP/*p11-kit \ /usr/share/pki/trust/ testing /usr/sbin/update-ca-certificates -v -f now proceeds without error /usr/sbin/update-ca-certificates -v -f running /usr/lib/ca-certificates/update.d/certbundle.run ... creating /var/lib/ca-certificates/ca-bundle.pem ... running /usr/lib/ca-certificates/update.d/etc_ssl.run ... Updating certificates in /etc/ssl/certs... Doing . ... 0 added, 0 removed. running /usr/lib/ca-certificates/update.d/java.run ... creating /var/lib/ca-certificates/java-cacerts ... running /usr/lib/ca-certificates/update.d/openssl.run ... creating /var/lib/ca-certificates/openssl ...
Thanks for testing. Pushed to stable branch, will merge to master later. Attachment 104255 [details] pushed as c48baeb - trust: Print label of certificate when complaining about basic constraints Attachment 104256 [details] pushed as c6cbda8 - trust: Don't use invalid public keys for looking up stapled extensions
Another related commit: commit dc55d9d5fc5d904f0bc3c06ba3caf64483b18fa9 Author: Stef Walter <stefw@redhat.com> Date: Fri Sep 5 11:29:05 2014 +0200 trust: Produce a proper message for an invalid stapled extension Previously we would output a line like this: p11-kit: 'node != NULL' not true at lookup_extension
Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.