Active Topics

 


Page 3 of 5 12 3 45
Reply
Thread Tools
Pigro is offline Pigro
2011-09-01 , 11:05
Posts: 433 | Thanked: 274 times | Joined on Jan 2010
#21
Originally Posted by Rob1n View Post
Looks like the correct process (works for me anyway) is to remove the certificate from the Root CA store by doing (as root):
Code:
cmcli -c common-ca -r 8868bfe08e35c43b386b62f7283b8481c80cd74d
I found the ID for the certificate there using:
Code:
cmcli -T common-ca -L | grep DigiNotar
You can then remove the certificate from the microb certificate store using the certificate manager as I suggested earlier.
I removed the certificate from the Root CA store as you advised, which went fine. I then tried to remove from MicroB via the certificate mgmt interface - but there was no entry for DigiNotar present. I assume that is OK and I need take no further action?
__________________
n900: "with power comes responsibility".

If you buy a niche, highly modifiable smartphone and proceed to mess it up by blindly screwing around, don't just blame the phone, also blame yourelf.
 
lidow is offline lidow
2011-09-01 , 11:38
Posts: 151 | Thanked: 93 times | Joined on Sep 2009 @ sofia, bulgaria
#22
Originally Posted by Rob1n View Post
No idea how that's happened - it won't actually let you remove the certificate anyway (it appears to work, but re-opening the certificate manager shows it back again).
Strange, the xul method works ok for me. I remove the certificate, press save and I cannot find it anymore. Even with cmcli, nothing is displayed, searched both the string and parts of the id. Nothing.

When I try to access https://diginotar.com/, I receive "Secure Connection Failed" error message.

I did several restarts. All I did was to remove it with xul method described by Rob1n.
 

The Following User Says Thank You to lidow For This Useful Post:
Rob1n is offline Rob1n
2011-09-01 , 11:51
Posts: 3,617 | Thanked: 2,412 times | Joined on Nov 2009 @ Cambridge, UK
#23
Originally Posted by Pigro View Post
I removed the certificate from the Root CA store as you advised, which went fine. I then tried to remove from MicroB via the certificate mgmt interface - but there was no entry for DigiNotar present. I assume that is OK and I need take no further action?
That should be okay then, yes - you can check by going to https://www.diginotar.com/. If you get a security error then the certificate has been completely removed.
 

The Following 2 Users Say Thank You to Rob1n For This Useful Post:
peterleinchen's Avatar
peterleinchen is offline peterleinchen
2011-09-02 , 13:51
Posts: 4,118 | Thanked: 8,901 times | Joined on Aug 2010 @ Ruhrgebiet, Germany
#24
Looks like every N900 reacts unique here

I have used the mgmt interface, removed the DigiNotar cert and/but after a browser restart the DigiNotar cert was again present.
Then used the cmcli method and the DigiNotar still shows up in browser, but I get the security issue; so assuming everything is Okay.

Hey rob1n,
thanks for explanation.
Originally Posted by Rob1n View Post
There was (at least) one other CA hacked recently and some faulty certificates issued, yes. This was spotted within days and all certificates were revoked though, whereas it took DigiNotar several months to spot the hack, and they failed to revoke many of the issued certificates.
Just one more (maybe dumb) question
those hacked CAs were 'cleaned' via an update of browsers (FF. IE, ...), right? Which we never got/will ever get.
Or what do You mean with 'revoked'?
 
lancewex is offline lancewex
2011-09-02 , 14:14
Posts: 661 | Thanked: 690 times | Joined on Jul 2007
#25
So for those of us who don't understand these things you are doing to remove the old certificates--are we just screwed?
 
Rob1n is offline Rob1n
2011-09-02 , 15:11
Posts: 3,617 | Thanked: 2,412 times | Joined on Nov 2009 @ Cambridge, UK
#26
Originally Posted by peterleinchen View Post
Just one more (maybe dumb) question
those hacked CAs were 'cleaned' via an update of browsers (FF. IE, ...), right? Which we never got/will ever get.
Or what do You mean with 'revoked'?
There's a number of major Certificate Authorities (CAs) which issue certificates. Their CA certificates will be installed on the N900 (or with FF, IE, etc), and if you run into any not pre-loaded, they can be manually added. The browser developers will work on vetting any new ones and add them to the set sent out with new browser versions - this is where we're likely to miss out with the N900 as Nokia are very unlikely to be sending out any new lists. There's not many new ones added though, so it just means the user has to decide whether or not to trust them before adding the certificate.

The CA certificates are then used by the CAs to sign certificates for web sites, user authentication, applications, etc. When you visit a web site, it sends you the signed certificate and the browser will verify that the signature matches one of the loaded CAs (if not you get the security error).

A CA can later decide to revoke a site's certificate, in which case it gets added to a list of revoked certificates. The browser is supposed to then verify that any certificates it receives don't appear on this list, but this behaviour is sadly not very robust (some just don't check and many will, if they fail to get a response, just assume it's okay).

So previously hacked CAs have just revoked all the certificates. Removal of the CA from the trusted list is a major step, and means that no sites using their certificates will show as trusted any more. For the really major CAs (Comodo, Verisign, Thawte, etc), this is just not a reasonable option. Fortunately DigiNotar is a very small scale outfit, and blocking them will affect very few sites.
 

The Following User Says Thank You to Rob1n For This Useful Post:
Rob1n is offline Rob1n
2011-09-02 , 15:20
Posts: 3,617 | Thanked: 2,412 times | Joined on Nov 2009 @ Cambridge, UK
#27
Originally Posted by lancewex View Post
So for those of us who don't understand these things you are doing to remove the old certificates--are we just screwed?
You're not screwed, no - you're pretty unlikely (outside Iran) to run into one of these fraudulent certificates. It's probably worth making the effort to follow the instructions though - they're not overly complex, even for casual users.
  1. Install rootsh from App Manager (if not installed)
  2. Launch X Terminal
  3. Type "root" and press Enter
  4. Type "cmcli -c common-ca -r 8868bfe08e35c43b386b62f7283b8481c80cd74d" and press Enter
  5. Close X Terminal and launch the Web browser
  6. Type in "chrome://pippki/content/certManager.xul" as the URL
  7. Tap on "Authorities" to view the CA tab
  8. Scroll down to DigiNotar (they're in alphabetical order)
  9. Select the DigiNotar certificate (if there's more than one, repeat this and the next two steps for each)
  10. Click on the "Delete..." button
  11. Confirm to delete the certificate
  12. Once you're finished deleting all DigiNotar certificates, click on the "OK" button
  13. Browse to "https://www.diginotar.com" and check that you get a security error
Last edited by Rob1n; 2011-09-05 at 08:15. Reason: Removed erroneous http:// prefix from URL
 

The Following 2 Users Say Thank You to Rob1n For This Useful Post:
Pigro is offline Pigro
2011-09-02 , 15:45
Posts: 433 | Thanked: 274 times | Joined on Jan 2010
#28
Originally Posted by Rob1n View Post
You're not screwed, no - you're pretty unlikely (outside Iran) to run into one of these fraudulent certificates. It's probably worth making the effort to follow the instructions though - they're not overly complex, even for casual users.
  1. Install rootsh from App Manager (if not installed)
  2. Launch X Terminal
  3. Type "root" and press Enter
  4. Type "cmcli -c common-ca -r 8868bfe08e35c43b386b62f7283b8481c80cd74d" and press Enter
  5. Close X Terminal and launch the Web browser
  6. Type in "http://chrome://pippki/content/certManager.xul" as the URL
  7. Tap on "Authorities" to view the CA tab
  8. Scroll down to DigiNotar (they're in alphabetical order)
  9. Select the DigiNotar certificate (if there's more than one, repeat this and the next two steps for each)
  10. Click on the "Delete..." button
  11. Confirm to delete the certificate
  12. Once you're finished deleting all DigiNotar certificates, click on the "OK" button
  13. Browse to "https://www.diginotar.com" and check that you get a security error
the URL in bold above shouldn't have the "http://" prefix, I think?
__________________
n900: "with power comes responsibility".

If you buy a niche, highly modifiable smartphone and proceed to mess it up by blindly screwing around, don't just blame the phone, also blame yourelf.
 

The Following 3 Users Say Thank You to Pigro For This Useful Post:
peterleinchen's Avatar
peterleinchen is offline peterleinchen
2011-09-02 , 22:07
Posts: 4,118 | Thanked: 8,901 times | Joined on Aug 2010 @ Ruhrgebiet, Germany
#29
Originally Posted by Pigro View Post
the URL in bold above shouldn't have the "http://" prefix, I think?
Yes, just chrome:// without http://

Originally Posted by Rob1n View Post
A CA can later decide to revoke a site's certificate, in which case it gets added to a list of revoked certificates. The browser is supposed to then verify that any certificates it receives don't appear on this list, but this behaviour is sadly not very robust (some just don't check and many will, if they fail to get a response, just assume it's okay).

So previously hacked CAs have just revoked all the certificates. Removal of the CA from the trusted list is a major step, and means that no sites using their certificates will show as trusted any more. For the really major CAs (Comodo, Verisign, Thawte, etc), this is just not a reasonable option. Fortunately DigiNotar is a very small scale outfit, and blocking them will affect very few sites.
Thanks for detailing. This is as I understood certs.
But, that also means, we should find out those CAs -hacked a few months ago- and remove them from our cert management on N900 to be (fully) on the safe side, right?
 

The Following User Says Thank You to peterleinchen For This Useful Post:
Rob1n is offline Rob1n
2011-09-05 , 08:20
Posts: 3,617 | Thanked: 2,412 times | Joined on Nov 2009 @ Cambridge, UK
#30
Originally Posted by peterleinchen View Post
TBut, that also means, we should find out those CAs -hacked a few months ago- and remove them from our cert management on N900 to be (fully) on the safe side, right?
The previous one was Comodo (via an affiliate site - see http://www.f-secure.com/weblog/archives/00002128.html)- removing that will block access to a significant proportion of secure sites though.
 

The Following User Says Thank You to Rob1n For This Useful Post:
Reply
Page 3 of 5 12 3 45

« Previous Thread | Next Thread »

 
Forum Jump


All times are GMT. The time now is 08:45.

Contact Us - Home - Archive - Top