Bug 1418739

Summary:	ca-certificates must set the nss-mozilla-ca-policy pkcs#11 attribute for Mozilla CAs
Product:	[Fedora] Fedora	Reporter:	Kai Engert (:kaie) (inactive account) <kengert>
Component:	ca-certificates	Assignee:	Kai Engert (:kaie) (inactive account) <kengert>
Status:	CLOSED ERRATA	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	rawhide	CC:	dueno, jorton, kengert, pwouters, tmraz
Target Milestone:	---	Keywords:	Reopened
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:	ca-certificates-2017.2.11-5.fc26 ca-certificates-2017.2.11-1.1.fc25 ca-certificates-2017.2.11-1.1.fc24	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2017-04-13 23:51:43 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1418734, 1418741
Bug Blocks:	1400293

Description Kai Engert (:kaie) (inactive account) 2017-02-02 15:28:14 UTC

To fix bug 1400293, we must enable Firefox to distinguish between Mozilla CAs and other, locally installed CAs.

We want to achieve this by using a new pkcs#11 attribute, nss-mozilla-ca-policy, which is set only for Mozilla approved CAs.

This bug requests to enhance the ca-certificates package to set this new attribute.

This depends on new p11-kit that supports the attribute.

This also requires that we change the way how ca-certificates passes data to p11-kit-trust, because the BEGIN TRUSTED CERTIFICATE file format isn't flexible, and doesn't support adding new attributes. I'll file a separate bug for that, because I want to do these changes in separate steps.

Comment 1 Kai Engert (:kaie) (inactive account) 2017-02-23 18:46:25 UTC

fixed in rawhide

Comment 2 Fedora Update System 2017-04-05 12:34:19 UTC

ca-certificates-2017.2.11-1.1.fc25 has been submitted as an update to Fedora 25. https://bodhi.fedoraproject.org/updates/FEDORA-2017-a11057f70e

Comment 3 Fedora Update System 2017-04-05 12:37:19 UTC

ca-certificates-2017.2.11-1.1.fc24 has been submitted as an update to Fedora 24. https://bodhi.fedoraproject.org/updates/FEDORA-2017-3753e75f72

Comment 4 Fedora Update System 2017-04-05 19:54:35 UTC

ca-certificates-2017.2.11-1.1.fc24 has been pushed to the Fedora 24 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2017-3753e75f72

Comment 5 Fedora Update System 2017-04-05 19:54:52 UTC

ca-certificates-2017.2.11-1.1.fc25 has been pushed to the Fedora 25 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2017-a11057f70e

Comment 6 Fedora Update System 2017-04-13 11:50:59 UTC

ca-certificates-2017.2.11-1.1.fc24 has been submitted as an update to Fedora 24. https://bodhi.fedoraproject.org/updates/FEDORA-2017-3753e75f72

Comment 7 Fedora Update System 2017-04-13 15:20:26 UTC

ca-certificates-2017.2.11-1.1.fc24 has been pushed to the Fedora 24 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2017-3753e75f72

Comment 8 Fedora Update System 2017-04-13 23:51:43 UTC

ca-certificates-2017.2.11-1.1.fc25 has been pushed to the Fedora 25 stable repository. If problems still persist, please make note of it in this bug report.

Comment 9 Fedora Update System 2017-04-19 22:18:12 UTC

ca-certificates-2017.2.11-1.1.fc24 has been pushed to the Fedora 24 stable repository. If problems still persist, please make note of it in this bug report.