Ubuntu
ca-certificates package

Missing: /usr/share/ca-certificates/mozilla/SwissSign_Platinum_CA_-_G2.crt

Bug #1721712 reported by mrw on 2017-10-06

This bug affects 1 person

Affects		Status	Importance	Assigned to	Milestone
	ca-certificates (Ubuntu)	New	Undecided	Unassigned

Bug Description

Version: ca-certificates 20170717~16.04.1

Please add /usr/share/ca-certificates/mozilla/SwissSign_Platinum_CA_-_G2.crt back again as soon as possible.

File /usr/share/ca-certificates/mozilla/SwissSign_Platinum_CA_-_G2.crt is missing in ca-certificates, even though after everything I found it should be there. AFAIK there is no reason for removing it (and I work for SwissSign, so I should know if it were so).

apt-file search reports that it should be there

$ apt-file search SwissSign
ca-certificates: /usr/share/ca-certificates/mozilla/SwissSign_Gold_CA_-_G2.crt
ca-certificates: /usr/share/ca-certificates/mozilla/SwissSign_Platinum_CA_-_G2.crt
ca-certificates: /usr/share/ca-certificates/mozilla/SwissSign_Silver_CA_-_G2.crt

but in fact it is not:

marc@dev0001:~/svn/websites/plugins$ lsb_release -d
Description: Ubuntu 16.04.3 LTS
marc@dev0001:~/svn/websites/plugins$ dpkg -L ca-certificates | grep SwissSign
/usr/share/ca-certificates/mozilla/SwissSign_Gold_CA_-_G2.crt
/usr/share/ca-certificates/mozilla/SwissSign_Silver_CA_-_G2.crt
marc@dev0001:~/svn/websites/plugins$

in both, Ubuntu 14.04 und 16.04:

$ dpkg -S *SwissSign*
ca-certificates: /usr/share/ca-certificates/mozilla/SwissSign_Gold_CA_-_G2.crt
ca-certificates: /usr/share/ca-certificates/mozilla/SwissSign_Silver_CA_-_G2.crt

→ Platinum is missing!

Install old version:

sudo apt-get install --reinstall ca-certificates=20130906ubuntu2

$ dpkg -S SwissSign
ca-certificates: /usr/share/ca-certificates/mozilla/SwissSign_Platinum_CA_-
_G2.crt
ca-certificates: /usr/share/ca-certificates/mozilla/SwissSign_Silver_CA_-_G2.crt
ca-certificates: /usr/share/ca-certificates/mozilla/SwissSign_Gold_CA_-_G2.crt

→ Platinum is back again!

Tags:

Revision history for this message

mrw (marc-waeckerlin) wrote on 2017-10-06:

Download full text (5.5 KiB)

According to https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=858064 it has been removed when all 1024-bit root certificates have been removed, but this certificate is 4096bit, so it is obviously a mistake:

$ openssl x509 -in /usr/share/ca-certificates/mozilla/SwissSign_Platinum_CA_-_G2.crt -text -noout
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            4e:b2:00:67:0c:03:5d:4f
    Signature Algorithm: sha1WithRSAEncryption| grep "RSA Public Key"
        Issuer: C=CH, O=SwissSign AG, CN=SwissSign Platinum CA - G2
        Validity
            Not Before: Oct 25 08:36:00 2006 GMT
            Not After : Oct 25 08:36:00 2036 GMT
        Subject: C=CH, O=SwissSign AG, CN=SwissSign Platinum CA - G2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Modulus:
                    00:ca:df:a2:02:e2:da:f8:fc:07:16:b1:de:60:aa:
                    de:96:5c:64:1f:c7:2f:7e:cf:67:fa:44:42:d6:76:
                    63:95:ae:eb:af:72:20:8a:45:47:86:62:78:86:d6:
                    20:39:26:f4:ae:a3:fd:23:e7:a5:9c:b5:22:21:19:
                    b7:37:93:22:c0:50:9c:82:7b:d4:d5:04:44:5c:cb:
                    b4:c2:9f:92:be:24:d8:7b:67:22:e2:69:5f:e5:05:
                    78:d4:87:d9:71:70:33:25:53:b4:87:3b:29:90:28:
                    36:9a:55:44:30:68:a4:83:97:7f:0d:1e:9c:76:ff:
                    15:9d:60:97:00:8d:8a:85:03:ec:80:be:ea:2c:6e:
                    10:51:92:cc:7e:d5:a3:33:d8:d6:49:de:58:2a:af:
                    f6:16:eb:4b:7b:90:32:97:b9:ba:9d:58:f1:f8:57:
                    49:04:1e:a2:5d:06:70:dd:71:db:f9:dd:8b:9a:1b:
                    8c:cf:3d:a3:4d:ce:cb:7c:f6:bb:9c:a0:fa:09:ce:
                    23:62:b2:e9:0d:1f:e2:72:28:8f:9f:ac:68:20:7d:
                    6f:3b:a8:85:31:09:7f:0b:c7:e8:65:e9:e3:78:0e:
                    09:67:30:8b:34:82:fb:5d:e0:cc:9d:81:6d:62:ee:
                    08:1e:04:2c:4e:9b:ec:fe:a9:4f:5f:fd:69:78:ef:
                    09:1f:a1:b4:bf:fa:f3:ef:90:1e:4c:05:8b:1e:ea:
                    7a:91:7a:c3:d7:e5:fb:30:bc:6c:1b:10:58:98:f7:
                    1a:5f:d0:29:32:03:13:46:4d:61:6a:85:4c:52:74:
                    2f:06:1f:7b:11:e2:84:97:c6:99:f3:6d:7f:d7:67:
                    83:7e:13:68:d8:71:28:5a:d8:ce:dd:e8:10:14:9a:
                    fe:6d:23:87:6e:8e:5a:70:3c:d5:8d:09:00:a7:aa:
                    bc:b0:31:37:6d:c8:84:14:1e:5b:bd:45:63:20:6b:
                    4b:74:8c:bd:db:3a:0e:c1:cf:5a:16:8f:a5:98:f2:
                    76:89:b2:13:12:3b:0b:77:77:ac:bb:e5:3c:29:4a:
                    92:72:ca:61:1a:2b:5e:4c:e2:83:74:77:fa:35:48:
                    7a:85:4d:8d:9a:53:c4:df:78:ca:97:91:48:2b:45:
                    2b:01:f7:1c:1a:a2:ed:18:ba:0a:bd:83:fa:6f:bc:
                    8d:57:93:3b:d4:d4:a6:ce:1e:f1:a0:b1:ce:ab:fd:
                    2b:28:9a:4f:1b:d7:c3:72:db:a4:c4:bf:5d:4c:f5:
                    dd:7b:96:69:ee:68:80:e6:e7:98:ba:36:b7:fe:6e:
                    ed:2b:bd:20:f8:65:19:da:55:09:7e:25:dc:fe:61:
                    62:72:f9:7e:18:02:ef:63:b4:d0:fb:af:e5:3b:63:
                    8c:67:8f
                Exponent: 65537 (0x10001)
   ...

$ openssl x509 -in /usr/share/ca-certificates/mozilla/SwissSign_Platinum_CA_-_G2.crt -text -noout 
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            4e:b2:00:67:0c:03:5d:4f
    Signature Algorithm: sha1WithRSAEncryption| grep "RSA Public Key"
        Issuer: C=CH, O=SwissSign AG, CN=SwissSign Platinum CA - G2
        Validity
            Not Before: Oct 25 08:36:00 2006 GMT
            Not After : Oct 25 08:36:00 2036 GMT
        Subject: C=CH, O=SwissSign AG, CN=SwissSign Platinum CA - G2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Modulus:
                    00:ca:df:a2:02:e2:da:f8:fc:07:16:b1:de:60:aa:
                    de:96:5c:64:1f:c7:2f:7e:cf:67:fa:44:42:d6:76:
                    63:95:ae:eb:af:72:20:8a:45:47:86:62:78:86:d6:
                    20:39:26:f4:ae:a3:fd:23:e7:a5:9c:b5:22:21:19:
                    b7:37:93:22:c0:50:9c:82:7b:d4:d5:04:44:5c:cb:
                    b4:c2:9f:92:be:24:d8:7b:67:22:e2:69:5f:e5:05:
                    78:d4:87:d9:71:70:33:25:53:b4:87:3b:29:90:28:
                    36:9a:55:44:30:68:a4:83:97:7f:0d:1e:9c:76:ff:
                    15:9d:60:97:00:8d:8a:85:03:ec:80:be:ea:2c:6e:
                    10:51:92:cc:7e:d5:a3:33:d8:d6:49:de:58:2a:af:
                    f6:16:eb:4b:7b:90:32:97:b9:ba:9d:58:f1:f8:57:
                    49:04:1e:a2:5d:06:70:dd:71:db:f9:dd:8b:9a:1b:
                    8c:cf:3d:a3:4d:ce:cb:7c:f6:bb:9c:a0:fa:09:ce:
                    23:62:b2:e9:0d:1f:e2:72:28:8f:9f:ac:68:20:7d:
                    6f:3b:a8:85:31:09:7f:0b:c7:e8:65:e9:e3:78:0e:
                    09:67:30:8b:34:82:fb:5d:e0:cc:9d:81:6d:62:ee:
                    08:1e:04:2c:4e:9b:ec:fe:a9:4f:5f:fd:69:78:ef:
                    09:1f:a1:b4:bf:fa:f3:ef:90:1e:4c:05:8b:1e:ea:
                    7a:91:7a:c3:d7:e5:fb:30:bc:6c:1b:10:58:98:f7:
                    1a:5f:d0:29:32:03:13:46:4d:61:6a:85:4c:52:74:
                    2f:06:1f:7b:11:e2:84:97:c6:99:f3:6d:7f:d7:67:
                    83:7e:13:68:d8:71:28:5a:d8:ce:dd:e8:10:14:9a:
                    fe:6d:23:87:6e:8e:5a:70:3c:d5:8d:09:00:a7:aa:
                    bc:b0:31:37:6d:c8:84:14:1e:5b:bd:45:63:20:6b:
                    4b:74:8c:bd:db:3a:0e:c1:cf:5a:16:8f:a5:98:f2:
                    76:89:b2:13:12:3b:0b:77:77:ac:bb:e5:3c:29:4a:
                    92:72:ca:61:1a:2b:5e:4c:e2:83:74:77:fa:35:48:
                    7a:85:4d:8d:9a:53:c4:df:78:ca:97:91:48:2b:45:
                    2b:01:f7:1c:1a:a2:ed:18:ba:0a:bd:83:fa:6f:bc:
                    8d:57:93:3b:d4:d4:a6:ce:1e:f1:a0:b1:ce:ab:fd:
                    2b:28:9a:4f:1b:d7:c3:72:db:a4:c4:bf:5d:4c:f5:
                    dd:7b:96:69:ee:68:80:e6:e7:98:ba:36:b7:fe:6e:
                    ed:2b:bd:20:f8:65:19:da:55:09:7e:25:dc:fe:61:
                    62:72:f9:7e:18:02:ef:63:b4:d0:fb:af:e5:3b:63:
                    8c:67:8f
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier: 
                50:AF:CC:07:87:15:47:6F:38:C5:B4:65:D1:DE:95:AA:E9:DF:9C:CC
            X509v3 Authority Key Identifier: 
                keyid:50:AF:CC:07:87:15:47:6F:38:C5:B4:65:D1:DE:95:AA:E9:DF:9C:CC

X509v3 Certificate Policies: 
                Policy: 2.16.756.1.89.1.1.1.1
                  CPS: http://repository.swisssign.com/

Signature Algorithm: sha1WithRSAEncryption
         08:85:a6:f5:16:0c:fc:44:1a:c1:63:e0:f9:55:46:08:fc:70:
         1c:42:28:96:8e:b7:c5:c1:41:75:4e:09:71:79:e5:6d:96:ca:
         4b:a5:88:60:d0:30:74:b8:ca:08:dc:b4:30:9e:40:07:16:6b:
         65:95:77:01:ae:a4:b7:35:0b:81:da:71:15:a9:74:17:38:7b:
         58:ca:f9:2f:fb:c0:65:76:8d:5b:01:b9:7d:de:82:3d:64:b8:
         be:14:74:a3:0a:54:d3:2c:95:18:17:35:f5:51:6b:3f:8f:a2:
         96:61:39:78:6b:4b:e5:a6:a0:f8:53:df:51:10:93:62:e7:80:
         2f:e2:d1:e0:bc:8e:36:46:77:33:ec:b8:fb:8e:9a:2c:89:4d:
         31:11:0f:26:9e:04:bb:b7:04:8d:0b:f2:b9:fc:5a:9d:3b:16:
         b7:2f:c8:98:ab:fe:8a:50:59:2e:a3:3b:fc:29:5d:8b:c1:4b:
         c9:e2:8a:13:1d:b1:bf:bb:42:1d:52:dd:4e:d8:14:5e:10:c6:
         31:07:ef:71:27:f7:1b:39:09:dc:82:ea:8b:b3:95:86:5e:fd:
         f5:da:5d:31:a6:e0:31:b6:94:e6:44:49:74:c5:16:e5:f7:1f:
         03:61:28:c5:c8:cb:12:a0:42:4b:f9:6b:88:08:8d:b4:32:18:
         f3:75:9f:c4:7f:00:4f:05:95:9c:a3:17:02:c3:b3:53:9b:aa:
         20:39:29:2b:66:fa:9d:af:5e:b3:92:d2:b5:a6:e1:1a:f9:2d:
         41:69:81:14:b4:b4:b5:ed:89:3d:ce:fb:a9:9d:35:42:44:b1:
         1c:14:73:81:cf:2a:01:35:9a:31:d5:2d:8f:6d:84:df:80:4d:
         57:e3:3f:c5:84:75:da:89:c6:30:bb:eb:8f:cb:22:08:a0:ae:
         aa:f1:03:6c:3a:4b:4d:09:a5:0e:72:c6:56:6b:21:42:4e:23:
         25:14:68:ae:76:0a:7c:0c:07:70:64:f9:9a:2f:f6:05:39:26:
         c6:0c:8f:19:7f:43:5e:6e:f4:5b:15:2f:db:61:5d:e6:67:2f:
         3f:08:94:f9:60:b4:98:31:da:74:f1:84:93:71:4d:5f:fb:60:
         58:d1:fb:c4:c1:6d:89:a2:bb:20:1f:9d:71:91:cb:32:9b:13:
         3d:3e:7d:92:52:35:ac:92:94:a2:d3:18:c2:7c:c7:ea:af:76:
         05:16:dd:67:27:c2:7e:1c:07:22:21:f3:40:0a:1b:34:07:44:
         13:c2:84:6a:8e:df:19:5a:bf:7f:eb:1d:e2:1a:38:d1:5c:af:
         47:92:6b:80:b5:30:a5:c9:8d:d8:ab:31:81:1f:df:c2:66:37:
         d3:93:a9:85:86:79:65:d2

Revision history for this message

Marc Deslauriers (mdeslaur) wrote on 2017-10-06:

Hi,

In the 20170717 package, we no longer ship email signing certificates.

Per Mozilla, "SwissSign Platinum CA - G2" is marked as an email signing certificate only:

CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_MUST_VERIFY_TRUST
CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE

This is the Debian bug where email signing certificates were removed:

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=721976