manually adding root certificates

Hi,

does anyone here have experience with adding CA certificates to Debian?
My ISP is using "USERTrust Legacy Secure Server CA" as its issuer and
that CA does not appear to be included in ca-certificates.

I have not been able to find the corresponding certifcate via UTN's
(now Comodo's) website, I had to use a search engine to point me to
tbs-x509.com to find the certificate. So much for trustworthiness...
any way, the certificate appears legit since it does complete the
certificate chain:

:~/tst$ openssl s_client -connect pop3.concepts.nl:995 -showcerts
-CApath .
depth=2 /C=US/O=Entrust.net/OU=www.entrust.net/CPS incorp. by ref. (limits liab.)/OU=(c) 1999 Entrust.net Limited/CN=Entrust.net Secure Server Certification Authority
verify return:1
depth=1 /C=US/ST=UT/L=Salt Lake City/O=The USERTRUST Network/CN=USERTrust Legacy Secure Server CA
verify return:1
depth=0 /C=NL/postalCode=4817 KK/ST=Noord-Brabant/L=Breda/street=St Ignatiusstraat 265/O=Concepts ICT/OU=Techniek/OU=Comodo PremiumSSL Legacy/CN=pop3.concepts.nl
verify return:1
[..]
Verify return code: 0 (ok)

Now, according to /usr/share/doc/ca-certificates/README.Debian I should
be able to drop this certificate in /usr/local/share/ca-certificates,
run update-ca-certificates and be done with it. But this does not
appear to be sufficient, because I still get this:

:~/tst$ openssl s_client -connect pop3.concepts.nl:995 -showcerts
depth=0 /C=NL/postalCode=4817 KK/ST=Noord-Brabant/L=Breda/street=St Ignatiusstraat 265/O=Concepts ICT/OU=Techniek/OU=Comodo PremiumSSL Legacy/CN=pop3.concepts.nl
verify error:num=20:unable to get local issuer certificate
verify return:1
depth=0 /C=NL/postalCode=4817 KK/ST=Noord-Brabant/L=Breda/street=St Ignatiusstraat 265/O=Concepts ICT/OU=Techniek/OU=Comodo PremiumSSL Legacy/CN=pop3.concepts.nl
verify error:num=27:certificate not trusted
verify return:1
depth=0 /C=NL/postalCode=4817 KK/ST=Noord-Brabant/L=Breda/street=St Ignatiusstraat 265/O=Concepts ICT/OU=Techniek/OU=Comodo PremiumSSL Legacy/CN=pop3.concepts.nl
verify error:num=21:unable to verify the first certificate
verify return:1
[..]
Verify return code: 21 (unable to verify the first certificate)


Oddly enough (for me at least), when I manually specify the CApath to
the system default, it does work:
:~/tst$ openssl s_client -connect pop3.concepts.nl:995 -showcerts -CApath /etc/ssl/certs/
depth=2 /C=US/O=Entrust.net/OU=www.entrust.net/CPS incorp. by ref. (limits liab.)/OU=(c) 1999 Entrust.net Limited/CN=Entrust.net Secure Server Certification Authority
verify return:1
depth=1 /C=US/ST=UT/L=Salt Lake City/O=The USERTRUST Network/CN=USERTrust Legacy Secure Server CA
verify return:1
depth=0 /C=NL/postalCode=4817 KK/ST=Noord-Brabant/L=Breda/street=St Ignatiusstraat 265/O=Concepts ICT/OU=Techniek/OU=Comodo PremiumSSL Legacy/CN=pop3.concepts.nl
verify return:1

:~/tst$ openssl verify /etc/ssl/certs/USERTrustLegacySecureServerCA.pem
/etc/ssl/certs/USERTrustLegacySecureServerCA.pem: OK


--
To UNSUBSCRIBE, email to debian-user-REQUEST@xxxxxxxxxxxxxxxx
with a subject of "unsubscribe". Trouble? Contact listmaster@xxxxxxxxxxxxxxxx
Archive: http://lists.debian.org/20110724173510.7644006c@xxxxxxxxxxxxxxxxx

Relevant Pages

  • Re: Unable to use stunnel with tin...
    ... Looks like you got an odd version of stunnel. ... was getting the certificate written correctly. ... Next verify you can connect to the server. ...
    (comp.os.linux.setup)
  • RE: Verifying X509Certificate signature
    ... issue--with that sort of data I know what data to pass to Verify. ... As you said that you want some information about verifying X509 certificate ... Microsoft MSDN Online Support Lead ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Re: Are ++ and -- operators really more efficient
    ... But you still need a way to verify that it's the right key. ... the signature contains a URL indicating ... where the certificate can be found. ... (This idea that public keys represent principals -- ...
    (comp.lang.c)
  • RE: Verifying X509Certificate signature
    ... I've got that you actually want to verify the signed certificate. ... Joe has mentioned, this is something related to verify the certificate ... cert store to retrieve key info in cert and do some RSA signing and ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Re: how can we restrict what certificate WSE will use?
    ... > X509SecurityTokenManager to verify the request is from a trusted client. ... > certificate to build a valid signature and encrypted data section. ...
    (microsoft.public.dotnet.framework.webservices.enhancements)