Fedora Account System
Red Hat Associate
Red Hat Customer
In #1134602, a verisign CA certificate was removed from the trusted TLS list, but was present in the trusted email list. That however, resulted in gnutls still seeing the certificate when verifying using the p11-kit trust module. What is needed is the availability of an API that implements the external trust policy (stapled extensions) as in: http://p11-glue.freedesktop.org/doc/storing-trust-policy/storing-trust-pkcs11.html (or something equivalent)
Patch upstream. Needs some basic testing.
Thanks Stef. can there be some branch on upstream with that change to try working on an implementation. Patch https://bugs.freedesktop.org/attachment.cgi?id=105744 doesn't apply cleanly in p11-kit master or stable.
Here you go: http://cgit.freedesktop.org/p11-glue/p11-kit/log/?h=wip/pkcs11x
Created attachment 935595 [details] patch to compile patch to compile
I realized that there is no predefined set of extensions in [0]. Which extensions may be present in a p11-kit trust module, and is there some way to list them? I mean is it only the "Extended Key Usage" that you set (and if yes, which are the available values in it?). [0]. http://p11-glue.freedesktop.org/doc/storing-trust-policy/storing-trust-pkcs11.html
(In reply to Nikos Mavrogiannopoulos from comment #4) > Created attachment 935595 [details] > patch to compile Thanks. Fixed up the commit upstream. (In reply to Nikos Mavrogiannopoulos from comment #5) Replied in the p11-glue mailing list: http://lists.freedesktop.org/archives/p11-glue/2014-September/000472.html
Patches merged to git master upstream. Continuing discussion about refining the documentation and clarifying teh concepts.
p11-kit-0.21.3-1.fc21 has been submitted as an update for Fedora 21. https://admin.fedoraproject.org/updates/p11-kit-0.21.3-1.fc21
Package p11-kit-0.21.3-1.fc21: * should fix your issue, * was pushed to the Fedora 21 testing repository, * should be available at your local mirror within two days. Update it with: # su -c 'yum update --enablerepo=updates-testing p11-kit-0.21.3-1.fc21' as soon as you are able to. Please go to the following url: https://admin.fedoraproject.org/updates/FEDORA-2014-10942/p11-kit-0.21.3-1.fc21 then log in and leave karma (feedback).
p11-kit-0.21.3-1.fc21 has been pushed to the Fedora 21 stable repository. If problems still persist, please make note of it in this bug report.