@ckujau, if you are in doubt, try (temporarily) blacklisting the cross-signed "COMODO RSA Certification Authority" on the system and see if the connection fails as expected:

$ trust list # check the URL of the cross-signed certificate
$ trust dump --filter 'pkcs11:id=%BB%AF%7E%02%3D%FA%A6%F1%3C%84%8E%AD%EE%38%98%EC%D9%32%32%D4;type=cert' > comodo-rsa.p11-kit
$ sudo cp comodo-rsa.p11-kit /etc/pki/ca-trust/source/blacklist/
$ gnutls-cli host:443
*** PKI verification of server certificate failed...
*** Fatal error: Error in the certificate.

@ckujau, no, the message is just misleading. The certificate is internally dropped from the input chain, and the cross signed (non-expired) certificate is used from the system trust store. See the background of the fix:

I'll try to update the command output later.

Re-added ca-certificates with a versioned dependency on p11-kit.

@cmadams right, re-added ca-certificates with a versioned dependency on p11-kit. thanks!

@cmadams, yes, that's why this update contains both ca-certificates and p11-kit. @pizzadude, that's interesting; maybe the flatpak runtime needs an updated p11-kit.

Anyway I will drop ca-cerfificate from this update for now.


This seems to fix the false-positives we hit on the p11-kit CI:

This update has been unpushed.

Given that the AVC denials are through rtkit, updating only nspr/nss packages shouldn't cause any new denials. So I am dropping firefox for now.

BZ#1713777 Visiting results in SSL_ERROR_DECODE_ERROR_ALERT

Thank you Nils for the update (sorry for my laziness)!

User Icon ueno commented & provided feedback on nss-3.41.0-3.fc28 3 years ago

@cheimes, nss-3.41.0-3.fc28 has been ready for some time but I can't edit this update as it's locked, perhaps adding karma in the pending state confused the system...

@remi, possibly a repo problem on your side? I don't see anything wrong here:

$ rpm -qP nspr-4.20.0-1.fc27.x86_64.rpm | grep '^nspr'
nspr = 4.20.0-1.fc27
nspr(x86-64) = 4.20.0-1.fc27

$ rpm -qR thunderbird-60.0-1.fc27.x86_64.rpm | grep '^nspr'
nspr >= 4.20.0

@jerboaa, there's no policy actually other than that we usually keep the update for a week and make sure there is no serious regression. as it's been in testing for 5 days and have enough karmas, I am going to push this to stable now.

@jchaloup, well nss is NOT pushed into the stable yet. I suspect it's a transitional issue: 20 minutes ago I created override for nss-util, nss-softokn, and nss (all 3.37.3) for building firefox. I can see all those packages are now in the buildroot:

$ koji wait-repo f28-build --build=nss-util-3.37.3-1.0.fc28
Successfully waited 0:01 for nss-util-3.37.3-1.0.fc28 to appear in the f28-build repo
koji wait-repo f28-build --build=nss-softokn-3.37.3-1.0.fc28
Successfully waited 0:01 for nss-softokn-3.37.3-1.0.fc28 to appear in the f28-build repo
koji wait-repo f28-build --build=nss-3.37.3-1.1.fc28
Successfully waited 0:02 for nss-3.37.3-1.1.fc28 to appear in the f28-build repo

Added nss-pem build to this update to resolve the issue, per Kamil's suggestion on bug 1500655

@corsepiu, as I said in the bug, it will be fixed as part of NSS 3.34 release planned for 2017-11-08

@corsepiu It's not a new problem, it has been there since 3.32. That means F25 already has the problem even without this update.

@alexpl, don't expect the SSE2 issue to be fixed with this update; it has been postponed to the next (3.34) rebase. I can create a copr if anyone needs the fix earlier.

This update has been unpushed.