We have moved to a new Sailfish OS Forum. Please start new discussions there.
6

Certificate problems on new Jolla

asked 2015-10-23 18:16:06 +0300

Yenya gravatar image

updated 2018-12-03 19:42:37 +0300

Tanghus gravatar image

I have a new Jolla and have problems connecting to the Jolla store and to my mailserver. Both problems are probably somehow related to the installed certificates: I have installed a new certificate for my calendar server into /etc/pki/ca-trust/source/anchors and ran update-ca-trust, and probably at that time both Jolla store app and the mailserver stopped working.

The Jolla store says the following in journal:

Oct 23 16:59:23 Jolla [25847]: [D] onError:374 - Jolla account sign-in error: 7 
The account could not be set up due to an SSL authentication error. Make sure th
e system date and time are correct in Settings | System | Time and date.

Of course, the system date is OK.

The messageserver log set up as described here: https://together.jolla.com/question/46259/native-email-app-check-certificate-message/ contains the following:

[1094] Oct 23 16:51:47 [Debug] Messaging :  Opening connection -  "anxur.fi.muni.cz" : 993  SSL 
[1094] Oct 23 16:51:47 [Debug] Messaging :  IMAP : connection established 
[1094] Oct 23 16:51:47 [Warning] Encrypted connect warnings: "'The root certificate of the certificate chain is self-signed, and untrusted'"

(yes, this is the real FQDN).I have tried the following:

openssl s_client -connect store-api.jolla.com:443
openssl s_client -connect anxur.fi.muni.cz:993

and both commands ended with "Verify return code: 0 (ok)". So I suppose I have all the certificates installed correctly at least for openssl. Could it be that both the Jolla store and messageserver use another certificate store, which can be damaged by update-ca-trust?

I have verified that I have both root anchors (DigiCert Global Root CA for store-api.jolla.com, and DigiCert Assured ID Root CA for anxur.fi.muni.cz) are installed in /etc/pki/ca-trust/extracted/openssl/ca-bundle.trust.crt.

What can be wrong and how can I fix it? Thanks and sorry for the Jolla newbie question.

edit retag flag offensive close delete

Comments

4 Answers

Sort by » oldest newest most voted
2

answered 2016-03-01 15:20:17 +0300

fpe gravatar image

I ran into the same problem after adding a self-signed certificate following this guide: https://together.jolla.com/question/2949/where-can-i-add-a-system-ca-certificate/

Any news on how you can fix that without a factory reset?

edit flag offensive delete publish link more

Comments

I could add a self-signed certificate with the following solution: https://together.jolla.com/question/2949/where-can-i-add-a-system-ca-certificate/?answer=115214#post-id-115214

(on Intex Aqua Fish SFOS 2.0.4.14)

stateoftheart ( 2016-11-13 15:39:36 +0300 )edit
2

answered 2017-10-23 22:00:54 +0300

kro gravatar image

Another less destructive way to restore store access:

  • devel-su
  • pkcon install --only-download ca-certificates # download ca-certificates RPM
  • mv /etc/pki /etc/pki.bak
  • mkdir -p /etc/pki/tls/certs # create empty directory tree without which gpg will complain
  • touch /etc/pki/tls/certs/ca-bundle.crt /etc/pki/tls/certs/ca-bundle.trust.crt # create empty files without which gpg will complain
  • rpm -U --replacepkgs --replacefiles -v /var/cache/zypp/packages/jolla/core/noarch/ca-certificates-2014.2.1-1.4.2.noarch.rpm # install the RPM that you downloaded beforehand
  • reboot, wait a bit - it didn't work right ahead for me, but eventuelly sorted itself out within the next 24h

This obviously reverts manual changes you made before in that directory structure (in my case, adding the letsencrypt root cert to /etc/pki/tls/certs/4f06f81d.0 as sailfishOS' XMPP client didn't want to connect without it)

edit flag offensive delete publish link more

Comments

I works for me. SFOSX 2.1.3.7 I was unable to install new apps and update OS, also it was impossible to check new emails

White ( 2017-11-06 13:50:05 +0300 )edit
1

answered 2015-10-26 15:54:38 +0300

Yenya gravatar image

OK, I have worked around the problem by a factory reset.

That said, I have rsync backups of the whole filesystem before and after the factory reset, so if somebody can tell me what files should i compare to at least have a clue where to look next time I run into a similar problem, it would be nice.

edit flag offensive delete publish link more
0

answered 2016-04-04 16:17:01 +0300

updated 2016-04-04 18:09:40 +0300

I solved the issue by erasing the entire /etc/pki folder (with all its contents) and restoring it from the SailfishOS image.

edit flag offensive delete publish link more
Login/Signup to Answer

Question tools

Follow
4 followers

Stats

Asked: 2015-10-23 18:16:06 +0300

Seen: 1,219 times

Last updated: Oct 23 '17