Certificate problems on new Jolla

Question

6

Certificate problems on new Jolla

certificate

asked 2015-10-23 18:16:06 +0200

Yenya
922 ●20 ●28 ●33

updated 2018-12-03 19:42:37 +0200

Tanghus
10524 ●85 ●118 ●125

https://github.com/tanghu...

I have a new Jolla and have problems connecting to the Jolla store and to my mailserver. Both problems are probably somehow related to the installed certificates: I have installed a new certificate for my calendar server into /etc/pki/ca-trust/source/anchors and ran update-ca-trust, and probably at that time both Jolla store app and the mailserver stopped working.

The Jolla store says the following in journal:

Oct 23 16:59:23 Jolla [25847]: [D] onError:374 - Jolla account sign-in error: 7 
The account could not be set up due to an SSL authentication error. Make sure th
e system date and time are correct in Settings | System | Time and date.

Of course, the system date is OK.

The messageserver log set up as described here: https://together.jolla.com/question/46259/native-email-app-check-certificate-message/ contains the following:

[1094] Oct 23 16:51:47 [Debug] Messaging :  Opening connection -  "anxur.fi.muni.cz" : 993  SSL 
[1094] Oct 23 16:51:47 [Debug] Messaging :  IMAP : connection established 
[1094] Oct 23 16:51:47 [Warning] Encrypted connect warnings: "'The root certificate of the certificate chain is self-signed, and untrusted'"

(yes, this is the real FQDN).I have tried the following:

openssl s_client -connect store-api.jolla.com:443
openssl s_client -connect anxur.fi.muni.cz:993

and both commands ended with "Verify return code: 0 (ok)". So I suppose I have all the certificates installed correctly at least for openssl. Could it be that both the Jolla store and messageserver use another certificate store, which can be damaged by update-ca-trust?

I have verified that I have both root anchors (DigiCert Global Root CA for store-api.jolla.com, and DigiCert Assured ID Root CA for anxur.fi.muni.cz) are installed in /etc/pki/ca-trust/extracted/openssl/ca-bundle.trust.crt.

What can be wrong and how can I fix it? Thanks and sorry for the Jolla newbie question.

edit retag flag offensive close delete

Comments

Answer 1

2

answered 2016-03-01 15:20:17 +0200

fpe
651 ●9 ●15 ●19

I ran into the same problem after adding a self-signed certificate following this guide: https://together.jolla.com/question/2949/where-can-i-add-a-system-ca-certificate/

Any news on how you can fix that without a factory reset?

edit flag offensive delete publish link

Comments

I could add a self-signed certificate with the following solution: https://together.jolla.com/question/2949/where-can-i-add-a-system-ca-certificate/?answer=115214#post-id-115214

(on Intex Aqua Fish SFOS 2.0.4.14)

stateoftheart ( 2016-11-13 15:39:36 +0200 )edit

Answer 2

2

answered 2017-10-23 22:00:54 +0200

kro
143 ●2 ●6 ●5

Another less destructive way to restore store access:

devel-su
pkcon install --only-download ca-certificates # download ca-certificates RPM
mv /etc/pki /etc/pki.bak
mkdir -p /etc/pki/tls/certs # create empty directory tree without which gpg will complain
touch /etc/pki/tls/certs/ca-bundle.crt /etc/pki/tls/certs/ca-bundle.trust.crt # create empty files without which gpg will complain
rpm -U --replacepkgs --replacefiles -v /var/cache/zypp/packages/jolla/core/noarch/ca-certificates-2014.2.1-1.4.2.noarch.rpm # install the RPM that you downloaded beforehand
reboot, wait a bit - it didn't work right ahead for me, but eventuelly sorted itself out within the next 24h

This obviously reverts manual changes you made before in that directory structure (in my case, adding the letsencrypt root cert to /etc/pki/tls/certs/4f06f81d.0 as sailfishOS' XMPP client didn't want to connect without it)

edit flag offensive delete publish link

Comments

I works for me. SFOSX 2.1.3.7 I was unable to install new apps and update OS, also it was impossible to check new emails

White ( 2017-11-06 13:50:05 +0200 )edit

Accepted Answer

1

answered 2015-10-26 15:54:38 +0200

Yenya
922 ●20 ●28 ●33

OK, I have worked around the problem by a factory reset.

That said, I have rsync backups of the whole filesystem before and after the factory reset, so if somebody can tell me what files should i compare to at least have a clue where to look next time I run into a similar problem, it would be nice.