Bug 2785

There were changes that went into the code the checks validity of certificates. Can you check again with R14.0.5 or Slavek's PSB?

Created attachment 2891 [details]
Certificate details screenshot

No change in behavior.

ok, thanks for the feedback.

/etc/trinity/ksslcalist could be generated using a script like this:
#!/bin/sh
for f in /etc/ssl/certs/*.pem; do
        printf "[%s]\nx509=" "$(openssl x509 -noout -subject -nameopt compat -in $f | sed 's/^subject=//')"
        fgrep -v -- ----- "$f" | tr -d '\n'
        printf "\ncode=true\nemail=true\nsite=true\n\n"
done >ksslcalist

Note that the "code", "email" and "site" parameters are hardcoded and not read from the certificate - I don't know how to get them.

The script could be added to /etc/ca-certificates/update.d/ (at least in Debian) to update ksslcalist automatically on any certificate updates.

Thanks, we will have a look :-)

Found some ksslcalist code in newer kssl sources which explains the site, email and code parameters:

    $subj = `openssl x509 -in $file -inform DER -noout -subject`;
    $_ = $subj;
    # We don't trust this anymore, so we keep our own copy
    if ( /TrustCenter/ ) {
        continue;
    }
    if ( /[Oo]bject/ || /[Cc]ode/ ) {
        $codeSubj = 1;
    } else {
        $codeSubj = 0;
    }
    $subj =~ s|\n$||;
    $subj =~ s/^subject= //;
    $purpose = `openssl x509 -in $file -inform DER -noout -purpose`;
    print BDL "\n";
    print BDL "[$subj]\n";
    print BDL "x509=$pem\n";
    #
    $_ = $purpose;
    if ( /server CA : Yes\n/ || /client CA : Yes\n/ || (/Any Purpose CA : Yes\n/ && (/client : Yes\n/ || /server : Yes\n/ ))) {
       $v_site="true";
    } else {
       $v_site="false";
    }
    #
    if ( /MIME signing CA : Yes\n/ || /MIME encryption CA : Yes\n/ ) {
       $v_email="true";
    } else {
       $v_email="false";
    }
    #
    if ( /Any Purpose CA : Yes\n/ && $codeSubj == 1) {
       $v_code="true";
    } else {
       $v_code="false";
    }

    # are some certificates really broken?
    if ($v_code == "false" && $v_email == "false") {
        $v_site = "true";
    }

    print BDL "site=$v_site\n";
    print BDL "email=$v_email\n";
    print BDL "code=$v_code\n";