Bug 557859

Summary:	nss breaks curl/ssl with setup-nsssysinit.sh on
Product:	[Fedora] Fedora	Reporter:	Kevin Fenzi <kevin>
Component:	nss	Assignee:	Kamil Dudka <kdudka>
Status:	CLOSED DUPLICATE	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	medium	Docs Contact:
Priority:	low
Version:	12	CC:	emaldona, kdudka, kengert
Target Milestone:	---
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2010-01-22 18:25:34 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Kevin Fenzi 2010-01-22 17:58:06 UTC

After upgrading to nss-3.12.5-7.fc12.x86_64 in updates-testing, fedora-packager-setup no longer works. It seems if 'setup-nsssysinit.sh on' it no longer works. Turning that off makes it work. 

Here's curl output from each case: 

setup-nsssysinit.sh off: 

ohm(kevin)[~] curl -svo/dev/null --cacert $HOME/.fedora-upload-ca.cert --cert $HOME/.fedora.cert https://koji.fedoraproject.org
* About to connect() to koji.fedoraproject.org port 443 (#0)
*   Trying 209.132.181.7... connected
* Connected to koji.fedoraproject.org (209.132.181.7) port 443 (#0)
* Initializing NSS with certpath: /etc/pki/nssdb
*   CAfile: /home/kevin/.fedora-upload-ca.cert
  CApath: none
* NSS: client certificate: PEM Token #1:.fedora.cert
* 	subject: E=kevin,CN=kevin,OU=Fedora User Cert,O=Fedora Project,ST=North Carolina,C=US
* 	start date: Aug 19 16:11:20 2009 GMT
* 	expire date: Feb 15 16:11:20 2010 GMT
* 	common name: kevin
* 	issuer: E=admin,CN=Fedora Project CA,OU=Fedora Project CA,O=Fedora Project,L=Raleigh,ST=North Carolina,C=US
* SSL connection using TLS_DHE_RSA_WITH_AES_256_CBC_SHA
* Server certificate:
* 	subject: E=buildsys,CN=koji.fedoraproject.org,OU=Buildsys,O=Fedora Project,ST=North Carolina,C=US
* 	start date: Aug 20 15:17:06 2008 GMT
* 	expire date: Aug 18 15:17:06 2018 GMT
* 	common name: koji.fedoraproject.org
* 	issuer: E=admin,CN=Fedora Project CA,OU=Fedora Project CA,O=Fedora Project,L=Raleigh,ST=North Carolina,C=US
> GET / HTTP/1.1
> User-Agent: curl/7.19.7 (x86_64-redhat-linux-gnu) libcurl/7.19.7 NSS/3.12.4.5 zlib/1.2.3 libidn/1.9 libssh2/1.2
> Host: koji.fedoraproject.org
> Accept: */*
> 
< HTTP/1.1 302 Found
< Date: Fri, 22 Jan 2010 17:55:29 GMT
< Server: Apache/2.2.3 (Red Hat)
< Location: https://koji.fedoraproject.org/koji
< Content-Length: 308
< Connection: close
< Content-Type: text/html; charset=iso-8859-1
< 
{ [data not shown]
* Closing connection #0

setup-nsssysinit.sh on: 

ohm(kevin)[~] curl -svo/dev/null --cacert $HOME/.fedora-upload-ca.cert --cert $HOME/.fedora.cert https://koji.fedoraproject.org
* About to connect() to koji.fedoraproject.org port 443 (#0)
*   Trying 209.132.181.7... connected
* Connected to koji.fedoraproject.org (209.132.181.7) port 443 (#0)
* Initializing NSS with certpath: /etc/pki/nssdb
*   CAfile: /home/kevin/.fedora-upload-ca.cert
  CApath: none
* Bad certificate received. Subject = 'E=buildsys,CN=koji.fedoraproject.org,OU=Buildsys,O=Fedora Project,ST=North Carolina,C=US', Issuer = 'E=admin,CN=Fedora Project CA,OU=Fedora Project CA,O=Fedora Project,L=Raleigh,ST=North Carolina,C=US'
* NSS error -8182
* Closing connection #0
* Peer certificate cannot be authenticated with known CA certificates

I'm not sure where it defaulted to on, but this broke with the nss update. 

Happy to provide more info, etc.

Comment 1 Kamil Dudka 2010-01-22 18:25:34 UTC

The reproducer from comment #0 does not seem to be the simplest one.  I am able to achieve the same result with the following command:

$ curl -sv https://bugzilla.redhat.com
* About to connect() to bugzilla.redhat.com port 443 (#0)
*   Trying 10.4.127.4... connected
* Connected to bugzilla.redhat.com (10.4.127.4) port 443 (#0)
* Initializing NSS with certpath: /etc/pki/nssdb
*   CAfile: /etc/pki/tls/certs/ca-bundle.crt
  CApath: none
* Bad certificate received. Subject = 'CN=bugzilla.redhat.com,OU=Information Systems,O=Red Hat Inc,L=Raleigh,ST=North Carolina,C=US', Issuer = 'OU=Equifax Secure Certificate Authority,O=Equifax,C=US'
* NSS error -8182
* Closing connection #0
* Peer certificate cannot be authenticated with known CA certificates


It looks exactly like bug 545779, what actually means the bug has been not fixed by the update.  Therefore I am closing it as duplicate to keep the patches etc. at one place for the next iteration.

*** This bug has been marked as a duplicate of bug 545779 ***