[FR] Add trust option to CA settings...

[fabianfrz]

... which put the CA certificate into the local trust store.

Useful for

• chaining TLS intercept proxies
• Trust internal CAs in cURL commands
• Use other CAs like CACert

etc.

Screenshot provided by @AndyX90 via opnsense/plugins#838:

[fichtner]

I like this, though were should trusted certificates land in the system to be automatically picked up?

[fabianfrz]

Looks like the mozilla bundle is installed here: /usr/local/share/certs/

I don't know if it needs symlinks somewhere.

[NOYB]

OpenSSL CAPATH hash directory is the way to go here. Makes managing the certs very easy and lookups very efficient. Already have code for managing the OpenSSL hash dir from the Web GUI to include CA's on a selected to be trusted basis. But OPNsense features need to utilize OpenSSL or it's pointless (dyndns, update url table aliases, etc.

[fabianfrz]

A single file is very easy too because everything needed is:

cat *.pem > /path/to/file.pem

And it works even if the previously used file was already a bundle.

[NOYB]

That is overly simplified.

c_rehash dir
is pretty easy too.

That method requires rewriting the entire bundle to remove a cert. Or a bunch of code to locate and snip it out of the bundle.

I've already done both methods and have code for managing both from the WebGUI. Much prefer the hash dir.

https://www.openssl.org/docs/manmaster/man1/c_rehash.html
https://www.openssl.org/docs/man1.1.0/ssl/SSL_CTX_load_verify_locations.html

[fichtner]

as per discussion with @fabianfrz

• ca_root_nss ETCSYMLINK option removal, roll our own /etc/ssl/certs.pem
• curl CA_BUNDLE option hardcodes /usr/local/share/certs/ca-root-nss.crt
• also check certifi, openssl, squid

[jpawlowski]

Please note that replacing the original /etc/ssl/certs.pem might have an impact on DNS-over-TLS validation where people might refer to that file to really secure DNS resolution in Unbound

[qinohe]

Hi fabian, I'm using a self-signed chain for this and did not see a change in 19.1 it still sends it's daily backup to the cloud, so I'm not seeing this behavior and your tool (TOTP) still seems to do the job...

edit: there was an update for ca-root-nss, btw. ;)
sorry for quoting the wrong message...

[fichtner]

Note to self: /usr/local/etc/ssl/cert.pem and /usr/local//openssl/cert.pem need to be rewritten for safety. UFS corruptions will block the sample files from fixing the file (size 0, but created). We should inject the local CA certificates as well. This only leaves /etc/ssl/cert.pem which is weirdly symlinked to the base ca-root-nss.crt file instead so it will miss our own certificates...