From: Lee <ler762@gmail.com>
To: cygwin@cygwin.com
Subject: Re: gpg ca-cert-file=[which file???]
Date: Sun, 16 Jul 2017 17:16:00 -0000 [thread overview]
Message-ID: <CAD8GWsuMuda5O2X-1N_q8TpZ_wZQBhEEJpfdA1eQO+x1iDLH5A@mail.gmail.com> (raw)
In-Reply-To: <okesn6$agb$1@blaine.gmane.org>
On 7/16/17, René Berber wrote:
> On 7/15/2017 11:56 PM, Lee wrote:
> [snip]
>> I'm guessing the "keyserver-options ca-cert-file=" needs to be
>> pointing at the ca-certificate package root store - but damnifiknow
>> where it is :(
>
> https://cygwin.com/cgi-bin2/package-cat.cgi?file=x86_64%2Fca-certificates%2Fca-certificates-2.14-1&grep=cacert
>
> That lists what is being installed, and where.
>
> The tls-ca-bundle files contain the root certificates.
Thanks - that gets me a bit further down the rabbit hole.
I used
keyserver-options ca-cert-file=/etc/pki/tls/cert.pem
which the ca-certificates bundle shows as a 0 byte file pointing to
/etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem
which is also a 0 byte file??
but there's several README files, so let's take a look
/etc/pki/ca-trust/extracted/pem/README
Distrust information cannot be represented in this file format,
and distrusted certificates are missing from these files.
oops. distrusted certs are missing, so I probably don't want to use
keyserver-options ca-cert-file=/etc/pki/tls/cert.pem
/etc/pki/ca-trust/source/README
Please refer to the update-ca-trust(8) manual page for additional information.
ok... man update-ca-trust
FILES
/etc/pki/tls/certs/ca-bundle.trust.crt
Classic filename, file contains a list of CA certificates in
the extended BEGIN/END TRUSTED CERTIFICATE file format,
which includes trust (and/or distrust) flags specific to
certificate usage. This file is a symbolic link that refers
to the consolidated output created by the update-ca-trust command.
cool.. that sounds like what I want
/etc/pki/tls/certs/ca-bundle.trust.crt is a link to
/etc/pki/ca-trust/extracted/openssl/ca-bundle.trust.crt
so let's fix my gpg.conf:
$ grep "^keyserver" ~/.gnupg/gpg.conf
keyserver hkps://pgp.mit.edu/
keyserver-options check-cert=on
keyserver-options
ca-cert-file=/etc/pki/ca-trust/extracted/openssl/ca-bundle.trust.crt
temporarily remove my list of public keys
$ mv ~/.gnupg/pubring.gpg ~/.gnupg/orig-pubring.gpg
start wireshark & give it a try
$ gpg --auto-key-locate keyserver --keyserver-options
auto-key-retrieve --verify BIND9.9.10-P1.x64.zip.asc
gpg: keyring `/home/Lee/.gnupg/pubring.gpg' created
gpg: assuming signed data in `BIND9.9.10-P1.x64.zip'
gpg: Signature made Mon, Jun 5, 2017 2:31:57 PM EDT
gpg: using RSA key 0xF1B11BF05CF02E57
gpg: requesting key 0xF1B11BF05CF02E57 from hkps server pgp.mit.edu
gpg: key 0xF1B11BF05CF02E57: public key "Internet Systems Consortium,
Inc. (Signing key, 2017-2018) <codesign@isc.org>" imported
gpg: no ultimately trusted keys found
gpg: Total number processed: 1
gpg: imported: 1 (RSA: 1)
gpg: Good signature from "Internet Systems Consortium, Inc. (Signing
key, 2017-2018) <codesign@isc.org>"
gpg: WARNING: This key is not certified with a trusted signature!
gpg: There is no indication that the signature belongs to the owner.
Primary key fingerprint: BE0E 9748 B718 253A 28BB 89FF F1B1 1BF0 5CF0 2E57
yay! I got the public key using TLS
$ cd /etc/pki/ca-trust/extracted/openssl
$ grep DigiNotar ca-bundle.trust.crt
# Explicitly Distrust DigiNotar Cyber CA
# Explicitly Distrust DigiNotar Cyber CA 2nd
# Explicitly Distrust DigiNotar Root CA
# Explicitly Distrust DigiNotar Services 1024 CA
# Explicitly Distrusted DigiNotar PKIoverheid
# Explicitly Distrusted DigiNotar PKIoverheid G2
yay!
$ grep CNNIC ca-bundle.trust.crt
# CNNIC ROOT
oops..
https://wiki.mozilla.org/CA/Additional_Trust_Changes
CNNIC
Mozilla currently recommends not trusting any certificates issued by
this CA after 1st April 2015. This covers two roots in our store -
"CNNIC ROOT" and "China Internet Network Information Center EV
Certificates Root".
back to man update-ca-trust
... and I'm lost :(
It looks like there's some certs in
/etc/pki/ca-trust/extracted/openssl/ca-bundle.trust.crt that I don't
want to trust.. but how to tell which ones & how to set
distrust/blacklist trust flags on them? or maybe I need to copy them
to /etc/pki/ca-trust/source/blacklist/ ???
Anyone have any pointers on how to distrust certs in
ca-bundle.trust.crt (assuming that _is_ the file I should be using) or
even how to show exactly what's in there?
$ grep "#" ca-bundle.trust.crt
shows lots of comments but
$ openssl x509 -in ca-bundle.trust.crt -noout -subject -dates
just shows me the first cert :(
Thanks
Lee
--
Problem reports: http://cygwin.com/problems.html
FAQ: http://cygwin.com/faq/
Documentation: http://cygwin.com/docs.html
Unsubscribe info: http://cygwin.com/ml/#unsubscribe-simple
next prev parent reply other threads:[~2017-07-16 16:38 UTC|newest]
Thread overview: 10+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-07-15 19:04 Lee
2017-07-15 20:34 ` Jim Garrison via cygwin
2017-07-15 23:07 ` Lee
2017-07-16 4:56 ` René Berber
2017-07-16 5:14 ` Lee
2017-07-16 8:07 ` René Berber
2017-07-16 17:16 ` Lee [this message]
2017-07-16 21:07 ` René Berber
2017-07-17 13:40 ` Lee
2017-07-18 18:19 ` Lee
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=CAD8GWsuMuda5O2X-1N_q8TpZ_wZQBhEEJpfdA1eQO+x1iDLH5A@mail.gmail.com \
--to=ler762@gmail.com \
--cc=cygwin@cygwin.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).