Note: This is a public test instance of Red Hat Bugzilla. The data contained within is a snapshot of the live data so any changes you make will not be reflected in the production Bugzilla. Email is disabled so feel free to test any aspect of the site that you want. File any problems you find or give feedback at bugzilla.redhat.com.

Bug 1418739

Summary:	ca-certificates must set the nss-mozilla-ca-policy pkcs#11 attribute for Mozilla CAs
Product:	[Fedora] Fedora	Reporter:	Kai Engert (:kaie) (inactive account) <kengert>
Component:	ca-certificates	Assignee:	Kai Engert (:kaie) (inactive account) <kengert>
Status:	CLOSED ERRATA	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	rawhide	CC:	dueno, jorton, kengert, pwouters, tmraz
Target Milestone:	---	Keywords:	Reopened
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:	ca-certificates-2017.2.11-5.fc26 ca-certificates-2017.2.11-1.1.fc25 ca-certificates-2017.2.11-1.1.fc24	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2017-04-13 23:51:43 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1418734, 1418741
Bug Blocks:	1400293

Description Kai Engert (:kaie) (inactive account) 2017-02-02 15:28:14 UTC

To fix bug 1400293, we must enable Firefox to distinguish between Mozilla CAs and other, locally installed CAs.

We want to achieve this by using a new pkcs#11 attribute, nss-mozilla-ca-policy, which is set only for Mozilla approved CAs.

This bug requests to enhance the ca-certificates package to set this new attribute.

This depends on new p11-kit that supports the attribute.

This also requires that we change the way how ca-certificates passes data to p11-kit-trust, because the BEGIN TRUSTED CERTIFICATE file format isn't flexible, and doesn't support adding new attributes. I'll file a separate bug for that, because I want to do these changes in separate steps.

Comment 1 Kai Engert (:kaie) (inactive account) 2017-02-23 18:46:25 UTC

fixed in rawhide

Comment 2 Fedora Update System 2017-04-05 12:34:19 UTC

ca-certificates-2017.2.11-1.1.fc25 has been submitted as an update to Fedora 25. https://bodhi.fedoraproject.org/updates/FEDORA-2017-a11057f70e

Comment 3 Fedora Update System 2017-04-05 12:37:19 UTC

ca-certificates-2017.2.11-1.1.fc24 has been submitted as an update to Fedora 24. https://bodhi.fedoraproject.org/updates/FEDORA-2017-3753e75f72

Comment 4 Fedora Update System 2017-04-05 19:54:35 UTC

ca-certificates-2017.2.11-1.1.fc24 has been pushed to the Fedora 24 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2017-3753e75f72

Comment 5 Fedora Update System 2017-04-05 19:54:52 UTC

ca-certificates-2017.2.11-1.1.fc25 has been pushed to the Fedora 25 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2017-a11057f70e

Comment 6 Fedora Update System 2017-04-13 11:50:59 UTC

ca-certificates-2017.2.11-1.1.fc24 has been submitted as an update to Fedora 24. https://bodhi.fedoraproject.org/updates/FEDORA-2017-3753e75f72

Comment 7 Fedora Update System 2017-04-13 15:20:26 UTC

ca-certificates-2017.2.11-1.1.fc24 has been pushed to the Fedora 24 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2017-3753e75f72

Comment 8 Fedora Update System 2017-04-13 23:51:43 UTC

ca-certificates-2017.2.11-1.1.fc25 has been pushed to the Fedora 25 stable repository. If problems still persist, please make note of it in this bug report.

Comment 9 Fedora Update System 2017-04-19 22:18:12 UTC

ca-certificates-2017.2.11-1.1.fc24 has been pushed to the Fedora 24 stable repository. If problems still persist, please make note of it in this bug report.