Ubuntu
ca-certificates-java package

Keystore is not generated during package installation

Bug #244410 reported by Anders Kaseorg
8
This bug affects 1 person
Affects Status Importance Assigned to Milestone
ca-certificates-java (Debian)
Fix Released
Unknown
ca-certificates-java (Ubuntu)
Fix Released
Undecided
Unassigned
Intrepid
Fix Released
Undecided
Unassigned

Bug Description

Binary package hint: ca-certificates-java

Currently, the postinst script removes the CAs in the pregenerated keystore that are not marked as trusted by the user. However, it does not add any CAs not yet in the keystore that are marked as trusted. So a user of a local CA that subsequently installs openjdk and ca-certificates-java still won’t be able to use the CA with Java.

Bug Watch Updater (bug-watch-updater)
Changed in ca-certificates-java:
status: Unknown → New
Revision history for this message
Matthias Klose (doko) wrote :

> However, it does not add any CAs not yet in the keystore that are marked as trusted.

How are these recognized? Shouldn't these be mentioned in /etc/ca-certificates.conf as well?

Revision history for this message
Anders Kaseorg (andersk) wrote :

Yes, they are. For example, when I copied my local CA into /usr/share/ca-certificates/mit.edu/mitCA.crt and ran `dpkg-reconfigure ca-certificates`, it prompted me to activate them by checking a box. This caused the line ‘mit.edu/mitCA.crt’ to be added to ca-certificates.conf, and so update-ca-certificates symlinked mitCA.pem into /etc/ssl/certs, etc.

The problem is that, if all of this happens _before_ ca-certificates-java is installed, then the ca-certificates-java postinst script never takes any action on the added lines. All the postinst does is remove the CA that are marked with ‘!’ in ca-certificates.conf; it never adds anything. Therefore, the keystore stays out of sync (until I do something like remove and re-add the certificate).

Matthias Klose (doko)
Changed in ca-certificates-java:
status: New → In Progress
Revision history for this message
Matthias Klose (doko) wrote :

fixed in ca-certificates-java_20080712ubuntu3

Changed in ca-certificates-java:
status: In Progress → Fix Released
Bug Watch Updater (bug-watch-updater)
Changed in ca-certificates-java:
status: New → Fix Released
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.
Subscribing...

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.