Hi,
Sri Lanka Cert is gonna implement local Root CA. How we can submit this Root CA with Fedora?
I could not find enough information on this.
Regards,
Hi,
On Wednesday, 24 April 2019 at 08:05, Danishka Navin wrote:
Sri Lanka Cert is gonna implement local Root CA. How we can submit this Root CA with Fedora?
I could not find enough information on this.
The best path would be to get it included in Mozilla's root CA trust store, which Fedora consumes.
https://wiki.mozilla.org/CA/Application_Process
https://blog.mozilla.org/security/2019/02/14/why-does-mozilla-maintain-our-o...
https://apps.fedoraproject.org/packages/ca-certificates/
https://fedoraproject.org/wiki/CA-Certificates
Regards, Dominik
On Wed, Apr 24, 2019 at 12:46 PM Dominik 'Rathann' Mierzejewski < dominik@greysector.net> wrote:
Hi,
On Wednesday, 24 April 2019 at 08:05, Danishka Navin wrote:
Sri Lanka Cert is gonna implement local Root CA. How we can submit this Root CA with Fedora?
I could not find enough information on this.
The best path would be to get it included in Mozilla's root CA trust store, which Fedora consumes.
Thanks Dominik.
I have already a passwed relavent information and asked to create a ticket against NSS product and 'CA Certificate Root Program' component.
https://wiki.mozilla.org/CA/Application_Process
https://blog.mozilla.org/security/2019/02/14/why-does-mozilla-maintain-our-o...
https://apps.fedoraproject.org/packages/ca-certificates/
https://fedoraproject.org/wiki/CA-Certificates
Regards, Dominik -- Fedora https://getfedora.org | RPM Fusion http://rpmfusion.org There should be a science of discontent. People need hard times and oppression to develop psychic muscles. -- from "Collected Sayings of Muad'Dib" by the Princess Irulan _______________________________________________ devel mailing list -- devel@lists.fedoraproject.org To unsubscribe send an email to devel-leave@lists.fedoraproject.org Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org
Hello, Danishka Navin.
Wed, 24 Apr 2019 14:12:44 +0530 you wrote:
I have already a passwed relavent information and asked to create a ticket against NSS product and 'CA Certificate Root Program' component.
Mozilla will never accept CA certificates for government MITM.
-- Sincerely, Vitaly Zaitsev (vitaly@easycoding.org)
On Wed, 2019-04-24 at 09:15 +0200, Dominik 'Rathann' Mierzejewski wrote:
Hi,
On Wednesday, 24 April 2019 at 08:05, Danishka Navin wrote:
Sri Lanka Cert is gonna implement local Root CA. How we can submit this Root CA with Fedora?
I could not find enough information on this.
The best path would be to get it included in Mozilla's root CA trust store, which Fedora consumes.
It is not just the best path but basically it is the only path. Fedora does not maintain its own list of trusted root CA but it directly consumes the Mozilla's list.
On Wed, 2019-04-24 at 11:35 +0530, Danishka Navin wrote:
Hi,
Sri Lanka Cert is gonna implement local Root CA. How we can submit this Root CA with Fedora?
I could not find enough information on this.
you can do one custom ca-certificates-2018.2.26-2.fc29.noarch package and add your certificate to ca-truted in you system or you just need copy you ca to /etc/pki/ca-trust/source/anchors and run update-ca-trust
I used or as reference [1] [1] https://ask.fedoraproject.org/en/question/37820/confusion-with-rpm-fusions-s...
Best regards,
On Wed, Apr 24, 2019 at 6:02 PM Sérgio Basto sergio@serjux.com wrote:
On Wed, 2019-04-24 at 11:35 +0530, Danishka Navin wrote:
Hi,
Sri Lanka Cert is gonna implement local Root CA. How we can submit this Root CA with Fedora?
I could not find enough information on this.
you can do one custom ca-certificates-2018.2.26-2.fc29.noarch package and add your certificate to ca-truted in you system
Its about officially distributed using formal channels, i.e: Operating Systems and Browsers. This is not about testing locally. I mean it required to be in ca-certificates-2018.2.26-2.fc29.noarch package by default.
or you just need copy you ca to /etc/pki/ca-trust/source/anchors and run update-ca-trust
I used or as reference [1] [1]
https://ask.fedoraproject.org/en/question/37820/confusion-with-rpm-fusions-s...
Best regards,
Sérgio M. B.
devel mailing list -- devel@lists.fedoraproject.org To unsubscribe send an email to devel-leave@lists.fedoraproject.org Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org
On Thu, Apr 25, 2019 at 1:42 PM Danishka Navin danishka@gmail.com wrote:
On Wed, Apr 24, 2019 at 6:02 PM Sérgio Basto sergio@serjux.com wrote:
On Wed, 2019-04-24 at 11:35 +0530, Danishka Navin wrote:
Hi,
Sri Lanka Cert is gonna implement local Root CA. How we can submit this Root CA with Fedora?
I could not find enough information on this.
you can do one custom ca-certificates-2018.2.26-2.fc29.noarch package and add your certificate to ca-truted in you system
Its about officially distributed using formal channels, i.e: Operating Systems and Browsers. This is not about testing locally. I mean it required to be in ca-certificates-2018.2.26-2.fc29.noarch package by default.
That package comes from Mozilla's collection. If Mozilla approves it, Fedora will pick it up as soon as an updated ca-certificates package is released. That said, it sounds like the intent of that CA is for a government-mandated man-in-the-middle attack to monitor secure traffic. It is highly unlikely that will be accepted by Mozilla.
On Fri, Apr 26, 2019 at 2:06 AM Stephen Gallagher sgallagh@redhat.com wrote:
On Thu, Apr 25, 2019 at 1:42 PM Danishka Navin danishka@gmail.com wrote:
On Wed, Apr 24, 2019 at 6:02 PM Sérgio Basto sergio@serjux.com wrote:
On Wed, 2019-04-24 at 11:35 +0530, Danishka Navin wrote:
Hi,
Sri Lanka Cert is gonna implement local Root CA. How we can submit this Root CA with Fedora?
I could not find enough information on this.
you can do one custom ca-certificates-2018.2.26-2.fc29.noarch package
and add your certificate to ca-truted in you system
Its about officially distributed using formal channels, i.e: Operating
Systems and Browsers.
This is not about testing locally. I mean it required to be in ca-certificates-2018.2.26-2.fc29.noarch
package by default.
That package comes from Mozilla's collection. If Mozilla approves it, Fedora will pick it up as soon as an updated ca-certificates package is released. That said, it sounds like the intent of that CA is for a government-mandated man-in-the-middle attack to monitor secure traffic. It is highly unlikely that will be accepted by Mozilla.
Seems government is working with Chinese tech people to run mass online surveillance system. http://www.themorning.lk/china-styled-mass-online-surveillance/
But I am not clear how Root CA can use to SSL MITM attack instead of user cert.
On Mon, May 20, 2019 at 8:53 AM Danishka Navin danishka@gmail.com wrote:
Seems government is working with Chinese tech people to run mass online surveillance system. http://www.themorning.lk/china-styled-mass-online-surveillance/
But I am not clear how Root CA can use to SSL MITM attack instead of user cert.
If you trust a root CA for signing websites, then they can sign a new certificate for google.com, then modify DNS to send you to a non-Google server presenting their certificate, signed by the corrupt CA. They'd decrypt all of your traffic, read it, re-encrypt it with the real google.com cert and pass it along. You would still see the website you expect to, but in the middle all of your traffic is exposed to the man-in-the-middle server.
On Mon, May 20, 2019 at 9:20 AM Stephen Gallagher sgallagh@redhat.com wrote:
On Mon, May 20, 2019 at 8:53 AM Danishka Navin danishka@gmail.com wrote:
Seems government is working with Chinese tech people to run mass online surveillance system. http://www.themorning.lk/china-styled-mass-online-surveillance/
But I am not clear how Root CA can use to SSL MITM attack instead of user cert.
If you trust a root CA for signing websites, then they can sign a new certificate for google.com, then modify DNS to send you to a non-Google server presenting their certificate, signed by the corrupt CA. They'd decrypt all of your traffic, read it, re-encrypt it with the real google.com cert and pass it along. You would still see the website you expect to, but in the middle all of your traffic is exposed to the man-in-the-middle server.
It's typically detectable by delays because the SSL connection occurs twice, but given the clients are in China, well, some delays are not shocking.
On Wed, 2019-04-24 at 11:35 +0530, Danishka Navin wrote:
Hi,
Sri Lanka Cert is gonna implement local Root CA. How we can submit this Root CA with Fedora?
I could not find enough information on this.
You can do one custom ca-certificates.noarch package and add your certificate to ca-truted in your system.
or you just need copy your ca cert to /etc/pki/ca-trust/source/anchors and run update-ca-trust
I used or as reference [1]
[1] https://ask.fedoraproject.org/en/question/37820/confusion-with-rpm-fusions-s...
cd /etc/pki/ca-trust/source/anchors wget http://www.cacert.org/certs/root.crt update-ca-trust
Best regards,
-
Danishka Navin -
Dominik 'Rathann' Mierzejewski -
Nico Kadel-Garcia -
Stephen Gallagher -
Sérgio Basto -
Tomas Mraz -
Vitaly Zaitsev