Thread: [SECURITY] Another compromised Certificate Authority
View Single Post
peterleinchen's Avatar
peterleinchen is offline peterleinchen
2013-01-06 , 14:00
Posts: 4,118 | Thanked: 8,901 times | Joined on Aug 2010 @ Ruhrgebiet, Germany
#9
Originally Posted by casketizer View Post
Is it a coincidence this cert is the first in the Certmanager list?
No, it is due to the cert name begins with "(".
You may check with
Code:
dbus-send --system --type=method_call --dest=com.nokia.osso_browser /com/nokia/osso_browser/request com.nokia.osso_browser.load_url string:"chrome://pippki/content/certManager.xul"
Originally Posted by casketizer View Post
Can certs be revoked manually on N900?
Yes, there is such possibility. I will put a script (produced at DigiNotar times) at the end of post.

Originally Posted by rainisto View Post
if you want the 'proper' way to remove it, then the right command would be:
opensh -c "acmcli -C aegis-certman-common-ca::CertCACommonAdd -lc common-ca -r d937b34e05fdd9cf9f1216aeb6892feb253a881c"
For N900 users, please refer to below script.
For N9 users, do we need to delete that CA also from browser? (but according to open mentioned bug, there is no such possibility?)


Simple script/guide to remove fraudulent CAs:
Code:
#!/bin/sh
#removing fraudulent CAs

echo enter the cert\(ifier\) You are looking for:
read cert
cmcli -T common-ca -L | grep "$cert"

echo now copy the full cert ID ...
read nothing

echo and give it as input \(for removal\)
read certID

if [ `id -u` != 0 ] ; then
    sudo cp /etc/certs/common-ca/$certID.pem /etc/certs/common-ca/$certID.pem.old
    sudo cmcli -c common-ca -r $certID
else
    cp /etc/certs/common-ca/$certID.pem /etc/certs/common-ca/$certID.pem.old
    cmcli -c common-ca -r $certID
fi

echo now open microb and goto
echo chrome://pippki/content/certManager.xul 
echo and delete the cert also there in the CA manager
read nothing

dbus-send --system --type=method_call --dest=com.nokia.osso_browser /com/nokia/osso_browser/request com.nokia.osso_browser.load_url string:"chrome://pippki/content/certManager.xul"

--edit
BUT, one more question arises here:
I do see two certificate IDs for TÜRKTRUST
~ $ cmcli -T common-ca -L | grep "TÜRK"
c126ef0d847fc578cabfa616229289c42af952e7 TÜRKTRUST Elektronik Sertifika Hizmet Sağlayıcısı
d937b34e05fdd9cf9f1216aeb6892feb253a881c TÜRKTRUST Elektronik Sertifika Hizmet Sağlayıcısı
and also in browsers
chrome://pippki/content/certManager.xul
they do appear twice.
So maybe for harmattan users, you also check bettwer twice?

I have no idea, why we do have them twice. Or if we need to block/delete both. Or if only one is fraudulent ...
__________________
SIM-Switcher, automated SIM switching with a Double (Dual) SIM adapter
--
Thank you all for voting me into the Community Council 2014-2016!

Please consider your membership / supporting Maemo e.V. and help to spread this by following/copying this link to your TMO signature:
[MC eV] Maemo Community eV membership application, http://talk.maemo.org/showthread.php?t=94257

editsignature, http://talk.maemo.org/profile.php?do=editsignature
Last edited by peterleinchen; 2013-01-06 at 15:25.
 

The Following 3 Users Say Thank You to peterleinchen For This Useful Post: