Page 1 of 5 1 23 Last »
Reply
Thread Tools Search this Thread
PMaff's Avatar
PMaff is offline PMaff
08-30-2011 , 10:14 AM
Posts: 339 | Thanked: 177 times | Joined on Sep 2010
#1
"Issue

Mozilla was informed today about the issuance of at least one fraudulent SSL certificate for public websites belonging to Google, Inc. This is not a Firefox-specific issue, and the certificate has now been revoked by its issuer, DigiNotar. This should protect most users.
..."
http://blog.mozilla.com/security/201...m-certificate/

and
http://www.h-online.com/open/news/it...s-1333088.html

Can we switch that off for our browsers (MicroB,Fennec, Opera)?
See also
http://support.mozilla.com/en-US/kb/...inotar-ca-cert
Certificate Manager (in Settings) only allows to import a certificate.
How do I delete one?
Last edited by PMaff; 11-01-2011 at 01:27 PM.
 
freemangordon is online now freemangordon
08-30-2011 , 10:26 AM
Posts: 2,177 | Thanked: 8,274 times | Joined on Mar 2010 @ Sofia,Bulgaria
#2
Open a bug, seriously, there is a chance Nokia to react
 

The Following 3 Users Say Thank You to freemangordon For This Useful Post:
jd4200's Avatar
jd4200 is offline jd4200
08-30-2011 , 10:56 AM
Posts: 450 | Thanked: 415 times | Joined on Apr 2010 @ England
#3
I manually deleted diginotars certificate on my laptop (as per mozilla's instructions), and then copied the cert8.db file from within the firefox directory to the phone.

Going to https://www.diginotar.com/ presented me with an invalid certificate, so it's working.

Edit: You could also use certutil to remove just the one certificate, you'll have to copy your cert8.db over to a computer that can run the certutil program, and the copy the database back over.
Last edited by jd4200; 08-30-2011 at 11:03 AM.
 
NIN101 is offline NIN101
08-30-2011 , 11:07 AM
Posts: 103 | Thanked: 266 times | Joined on Dec 2010
#4
This is very important. And it seems there is no way to manage certificates on maemo, which is a shame. So yeah, as jd4200 said, simply delete the certificate on your computer, then copy the cert8.db to /home/user/.mozilla/microb/. Not sure how microb makes usage of OCSP.
Edit: better this http://talk.maemo.org/showpost.php?p...7&postcount=12 and http://talk.maemo.org/showpost.php?p...86&postcount=7

Anyway, it's an OS from October 2010. I bet there much much more security issues, probably even remote :-).
Last edited by NIN101; 08-31-2011 at 10:42 AM.
 
PMaff's Avatar
PMaff is offline PMaff
08-30-2011 , 11:12 AM
Posts: 339 | Thanked: 177 times | Joined on Sep 2010
#5
Originally Posted by jd4200 View Post
I manually deleted diginotars certificate on my laptop (as per mozilla's instructions), and then copied the cert8.db file from within the firefox directory to the phone.

Going to https://www.diginotar.com/ presented me with an invalid certificate, so it's working.

Edit: You could also use certutil to remove just the one certificate, you'll have to copy your cert8.db over to a computer that can run the certutil program, and the copy the database back over.
I am not sure if cert8.db from another machine contains all the necessary certificates for N900.
It think this only helps for Fennec.

Anyway: I contacted a security email address at Nokia, let's see, if they answer.
 

The Following 3 Users Say Thank You to PMaff For This Useful Post:
NIN101 is offline NIN101
08-30-2011 , 11:18 AM
Posts: 103 | Thanked: 266 times | Joined on Dec 2010
#6
I am not sure if cert8.db from another machine contains all the necessary certificates for N900.
These are just certs for microb. I don't see any problem here.

Anyway, OCSP in microb:
security.OCSP.enabled=1
security.OCSP.require=false

Which means AFAIK: "Contact an OCSP server if the certificate has one listed. If not, then do not. " "Also, if the connection to the OCSP server fails, do not think it is invalid/revoked."

But I would not rely on OCSP anyway. However, some people might want to change this.
Last edited by NIN101; 08-30-2011 at 11:25 AM.
 

The Following 3 Users Say Thank You to NIN101 For This Useful Post:
Rob1n is offline Rob1n
08-31-2011 , 04:01 AM
Posts: 3,617 | Thanked: 2,392 times | Joined on Nov 2009 @ Cambridge, UK
#7
Originally Posted by NIN101 View Post
This is very important. And it seems there is no way to manage certificates on maemo, which is a shame.
For microb, just point your browser to chrome://pippki/content/certManager.xul (I've set up a bookmark for this) to get access to the certificate management interface.
 

The Following 11 Users Say Thank You to Rob1n For This Useful Post:
vinc17 is offline vinc17
08-31-2011 , 07:50 AM
Posts: 227 | Thanked: 52 times | Joined on Feb 2008 @ Lyon, France
#8
Originally Posted by Rob1n View Post
For microb, just point your browser to chrome://pippki/content/certManager.xul (I've set up a bookmark for this) to get access to the certificate management interface.
After trying to remove the DigiNotar root CA certificate with this, https no longer works at all! I just get a blank window for any https URL I try. It seems that the browser still tries to connect...
 
Rob1n is offline Rob1n
08-31-2011 , 08:20 AM
Posts: 3,617 | Thanked: 2,392 times | Joined on Nov 2009 @ Cambridge, UK
#9
Originally Posted by vinc17 View Post
After trying to remove the DigiNotar root CA certificate with this, https no longer works at all! I just get a blank window for any https URL I try. It seems that the browser still tries to connect...
No idea how that's happened - it won't actually let you remove the certificate anyway (it appears to work, but re-opening the certificate manager shows it back again).
 
vinc17 is offline vinc17
08-31-2011 , 08:42 AM
Posts: 227 | Thanked: 52 times | Joined on Feb 2008 @ Lyon, France
#10
Originally Posted by Rob1n View Post
No idea how that's happened - it won't actually let you remove the certificate anyway (it appears to work, but re-opening the certificate manager shows it back again).
Yes, I noticed that. That's why I removed the certificate 8868bfe08e35c43b386b62f7283b8481c80cd74d.pem manually from /etc/certs/common-ca and the corresponding symlink (c0cafbd2.0).

Actually the browser (the backend) crashes (the coredump has been uploaded by the crash reporter). This explains why the UI remains in the same state.
 
Reply
Page 1 of 5 1 23 Last »

« Previous Thread | Next Thread »
Thread Tools Search this Thread
Search this Thread:

Advanced Search

 
Forum Jump


All times are GMT -4. The time now is 03:17 PM.

Contact Us - Home - Archive - Top