|
 |
60cdbe |
From 61985f642b0b5cc75fc3f254ef6c99aeb56acbe2 Mon Sep 17 00:00:00 2001
|
|
|
60cdbe |
From: Alexander Scheel <ascheel@redhat.com>
|
|
|
60cdbe |
Date: Thu, 29 Aug 2019 16:14:08 -0400
|
|
|
60cdbe |
Subject: [PATCH 2/3] Add script to add common root CAs
|
|
|
60cdbe |
|
|
|
60cdbe |
When given an NSS DB, common_roots.sh uses the trust command to extract
|
|
|
60cdbe |
the root CAs trusted by the local system and add them to said NSS DB.
|
|
|
60cdbe |
|
|
|
60cdbe |
Signed-off-by: Alexander Scheel <ascheel@redhat.com>
|
|
|
60cdbe |
---
|
|
|
60cdbe |
tools/common_roots.sh | 36 ++++++++++++++++++++++++++++++++++++
|
|
|
60cdbe |
1 file changed, 36 insertions(+)
|
|
|
60cdbe |
create mode 100755 tools/common_roots.sh
|
|
|
60cdbe |
|
|
|
60cdbe |
diff --git a/tools/common_roots.sh b/tools/common_roots.sh
|
|
|
60cdbe |
new file mode 100755
|
|
|
60cdbe |
index 00000000..97341c4c
|
|
|
60cdbe |
--- /dev/null
|
|
|
60cdbe |
+++ b/tools/common_roots.sh
|
|
|
60cdbe |
@@ -0,0 +1,36 @@
|
|
|
60cdbe |
+#!/bin/bash
|
|
|
60cdbe |
+
|
|
|
60cdbe |
+# This script reads the contents of the OS CA bundle store,
|
|
|
60cdbe |
+# /usr/share/pki/ca-trust-source/ca-bundle.trust.p11-kit
|
|
|
60cdbe |
+# and places the contained CAs into the specified NSS DB.
|
|
|
60cdbe |
+#
|
|
|
60cdbe |
+# This NSS DB is used by various JSS tests that aren't enabled
|
|
|
60cdbe |
+# by default because they require an active internet connection.
|
|
|
60cdbe |
+
|
|
|
60cdbe |
+nssdb="$1"
|
|
|
60cdbe |
+
|
|
|
60cdbe |
+if [ -z "$nssdb" ] && [ -e "build" ]; then
|
|
|
60cdbe |
+ nssdb="build/results/cadb"
|
|
|
60cdbe |
+elif [ -z "$nssdb" ] && [ -e "../build" ]; then
|
|
|
60cdbe |
+ nssdb="../build/results/cadb"
|
|
|
60cdbe |
+else
|
|
|
60cdbe |
+ echo "Must provide path to NSS DB!" 1>&2
|
|
|
60cdbe |
+ exit 1
|
|
|
60cdbe |
+fi
|
|
|
60cdbe |
+
|
|
|
60cdbe |
+if [ -e "$nssdb" ]; then
|
|
|
60cdbe |
+ rm -rf "$nssdb"
|
|
|
60cdbe |
+fi
|
|
|
60cdbe |
+
|
|
|
60cdbe |
+mkdir -p "$nssdb"
|
|
|
60cdbe |
+echo "" > "$nssdb/password.txt"
|
|
|
60cdbe |
+certutil -N -d "$nssdb" -f "$nssdb/password.txt"
|
|
|
60cdbe |
+
|
|
|
60cdbe |
+trust extract --format=pem-bundle --filter=ca-anchors "$nssdb/complete.pem"
|
|
|
60cdbe |
+
|
|
|
60cdbe |
+# From: https://serverfault.com/questions/391396/how-to-split-a-pem-file
|
|
|
60cdbe |
+csplit -f "$nssdb/individual-" "$nssdb/complete.pem" '/-----BEGIN CERTIFICATE-----/' '{*}'
|
|
|
60cdbe |
+
|
|
|
60cdbe |
+for cert in "$nssdb"/individual*; do
|
|
|
60cdbe |
+ certutil -A -a -i "$cert" -n "$cert" -t CT,C,C -d "$nssdb" -f "$nssdb/password.txt"
|
|
|
60cdbe |
+done
|
|
|
60cdbe |
--
|
|
|
60cdbe |
2.21.0
|
|
|
60cdbe |
|