Description of problem: after upgrade p11-kit-0.23.15-1.fc28.x86_64 and p11-kit-trust-0.23.15-1.fc28.x86_64 the Google Chrome 73 beta dies and after restart it was unable to load any page showing NET::ERR_CERT_AUTHORITY_INVALID error. Also Chrome 72 stable was dead. Firefox 63.0.3 was ok all the time. Version-Release number of selected component (if applicable): p11-kit-0.23.10-1.fc28.x86_64 or p11-kit-trust-0.23.15-1.fc28.x86_64 is broken How reproducible: upgrade p11-kit-0.23.10-1.fc28.x86_64, it will ugprade also the p11-kit-trust-0.23.15-1.fc28.x86_64 and the chrome network is broken Steps to Reproduce: 1. upgrade package 2. start chrome 3. open https://www.google.com/ Actual results: NET::ERR_CERT_AUTHORITY_INVALID Expected results: page loaded Additional info: chrome startup: ./chrome --disable-extensions p11-kit: 'ret >=0' not true at loader_load_directory ... p11-kit: 'ret >=0' not true at loader_load_directory [11146:11212:0211/214214.350453:ERROR:cert_verify_proc_nss.cc(974)] CERT_PKIXVerifyCert for www.gstatic.com failed err=-8179 [11146:11159:0211/214214.351127:ERROR:ssl_client_socket_impl.cc(962)] handshake failed; returned -1, SSL error code 1, net_error -202 p11-kit: 'ret >=0' not true at loader_load_directory [11146:11169:0211/214214.354508:ERROR:cert_verify_proc_nss.cc(974)] CERT_PKIXVerifyCert for clientservices.googleapis.com failed err=-8179 [11146:11159:0211/214214.355135:ERROR:ssl_client_socket_impl.cc(962)] handshake failed; returned -1, SSL error code 1, net_error -202 p11-kit: 'ret >=0' not true at loader_load_directory [11146:11172:0211/214214.358845:ERROR:cert_verify_proc_nss.cc(974)] CERT_PKIXVerifyCert for accounts.google.com failed err=-8179 [11146:11159:0211/214214.359285:ERROR:ssl_client_socket_impl.cc(962)] handshake failed; returned -1, SSL error code 1, net_error -202 p11-kit: 'ret >=0' not true at loader_load_directory [11146:11173:0211/214214.363410:ERROR:cert_verify_proc_nss.cc(974)] CERT_PKIXVerifyCert for www.google.com failed err=-8179 [11146:11159:0211/214214.363927:ERROR:ssl_client_socket_impl.cc(962)] handshake failed; returned -1, SSL error code 1, net_error -202 [11146:11159:0211/214214.364163:ERROR:ssl_client_socket_impl.cc(962)] handshake failed; returned -1, SSL error code 1, net_error -202 [11146:11159:0211/214214.364564:ERROR:ssl_client_socket_impl.cc(962)] handshake failed; returned -1, SSL error code 1, net_error -202 [11146:11159:0211/214215.284927:ERROR:ssl_client_socket_impl.cc(962)] handshake failed; returned -1, SSL error code 1, net_error -202 [11146:11159:0211/214217.908678:ERROR:ssl_client_socket_impl.cc(962)] handshake failed; returned -1, SSL error code 1, net_error -202 [11146:11159:0211/214219.123594:ERROR:ssl_client_socket_impl.cc(962)] handshake failed; returned -1, SSL error code 1, net_error -202 p11-kit: 'ret >=0' not true at loader_load_directory ... p11-kit: 'ret >=0' not true at loader_load_directory [11146:11169:0211/214224.173239:ERROR:cert_verify_proc_nss.cc(974)] CERT_PKIXVerifyCert for ssl.gstatic.com failed err=-8179 [11146:11159:0211/214224.173529:ERROR:ssl_client_socket_impl.cc(962)] handshake failed; returned -1, SSL error code 1, net_error -202 [11146:11159:0211/214224.173628:ERROR:ssl_client_socket_impl.cc(962)] handshake failed; returned -1, SSL error code 1, net_error -202 [11146:11159:0211/214226.872145:ERROR:ssl_client_socket_impl.cc(962)] handshake failed; returned -1, SSL error code 1, net_error -202 [11146:11159:0211/214232.668509:ERROR:ssl_client_socket_impl.cc(962)] handshake failed; returned -1, SSL error code 1, net_error -202 [11146:11159:0211/214232.669021:ERROR:ssl_client_socket_impl.cc(962)] handshake failed; returned -1, SSL error code 1, net_error -202
Could you run chrome under P11_KIT_DEBUG=trust to get more information?
Hello Daiki, it seems I was able to find the reason: after running the chrome as $ P11_KIT_DEBUG=trust /usr/bin/google-chrome-beta the p11-kit was complaining about (p11-kit:20884) loader_load_file: failed to parse: /usr/share/pki/ca-trust-source/anchors/private-ca.cer The /usr/share/pki/ca-trust-source/anchors/private-ca.cer was an root-owned certificate with -rw------- access rights. After changing access rights to -rw-r--r-- everything is ok now. The older version (p11-kit-0.23.10-1.fc28.x86_64) was fine about unreadable file. Greetings to Brno! Best regards, a.
Thank you; this looks like a regression after: https://github.com/p11-glue/p11-kit/pull/206 in particular this commit: https://github.com/p11-glue/p11-kit/pull/206/commits/e7deb704f4385fabe50d81bcc7c6478c928ca38e
https://github.com/p11-glue/p11-kit/pull/215
p11-kit-0.23.15-2.fc29 has been pushed to the Fedora 29 testing repository. If problems still persist, please make note of it in this bug report. See https://fedoraproject.org/wiki/QA:Updates_Testing for instructions on how to install test updates. You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2019-563a9058ee
p11-kit-0.23.15-2.fc28 has been pushed to the Fedora 28 testing repository. If problems still persist, please make note of it in this bug report. See https://fedoraproject.org/wiki/QA:Updates_Testing for instructions on how to install test updates. You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2019-04bcb2f1b9
p11-kit-0.23.15-2.fc29 has been pushed to the Fedora 29 stable repository. If problems still persist, please make note of it in this bug report.
p11-kit-0.23.15-2.fc28 has been pushed to the Fedora 28 stable repository. If problems still persist, please make note of it in this bug report.