Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account


tiran opened this issue Jan 20, 2020 · 2 comments


tiran opened this issue Jan 20, 2020 · 2 comments


Copy link

@tiran tiran commented Jan 20, 2020

The script generates a CA bundle from Mozilla NSS's certdata.txt. Recently Mozilla has introduced two new fields. The new fields CKA_NSS_SERVER_DISTRUST_AFTER and CKA_NSS_EMAIL_DISTRUST_AFTER encode a date after which the certificates are considered distrusted. should not add certs that have CKA_NSS_SERVER_DISTRUST_AFTER after the current date. The field is either a CK_BBOOL with value CK_FALSE or a MULTILINE_OCTAL that encodes the date as octal string "YYMMDDHHMMSSZ", e.g. \062\060\060\066\061\067\060\060\060\060\060\060\132 == 200617000000Z == 2020-06-17 00:00:00Z.

Copy link

@bagder bagder commented Jan 20, 2020

My gosh that file format is obscure! =) I also note that no certificate so far has CKA_NSS_SERVER_DISTRUST_AFTER set. I have a patch coming that I think is okay.

Copy link
Contributor Author

@tiran tiran commented Jan 20, 2020

Yeah, certdata.txt wasn't designed with 3rd party parsers in mind. You could use a complete different approach and interface the PKCS#11 interface of the nssckbi token. You can do this either directly or with p11-kit.


  • You would use the designated API to get a list of trust anchors for a specific purpose.


  • It's PKCS#11 :(
bagder added a commit that referenced this issue Jan 20, 2020
For now, no cert in the bundle actually sets a date there...

Reported-by: Christian Heimes
Fixes #4834
@bagder bagder closed this in 1ebc53d Jan 22, 2020
@lock lock bot locked as resolved and limited conversation to collaborators Apr 25, 2020
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
None yet
2 participants
You can’t perform that action at this time.