Hi, On Wednesday, 24 April 2019 at 08:05, Danishka Navin wrote: > Sri Lanka Cert is gonna implement local Root CA. > How we can submit this Root CA with Fedora? > > I could not find enough information on this. The best path would be to get it included in Mozilla's root CA trust store, which Fedora consumes.

https://wiki.mozilla.org/CA/Application_Process https://blog.mozilla.org/security/2019/02/14/why-does-mozilla-maintain-ou... https://apps.fedoraproject.org/packages/ca-certificates/ https://fedoraproject.org/wiki/CA-Certificates Regards, Dominik -- Fedora https://getfedora.org | RPM Fusion http://rpmfusion.org There should be a science of discontent. People need hard times and oppression to develop psychic muscles. -- from "Collected Sayings of Muad'Dib" by the Princess Irulan _______________________________________________ devel mailing list -- devel(a)lists.fedoraproject.org To unsubscribe send an email to devel-leave(a)lists.fedoraproject.org Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org

Hi, On Wednesday, 24 April 2019 at 08:05, Danishka Navin wrote: > Sri Lanka Cert is gonna implement local Root CA. > How we can submit this Root CA with Fedora? > > I could not find enough information on this. The best path would be to get it included in Mozilla's root CA trust store, which Fedora consumes.

On Wed, 2019-04-24 at 11:35 +0530, Danishka Navin wrote: Hi, Sri Lanka Cert is gonna implement local Root CA. How we can submit this Root CA with Fedora? I could not find enough information on this. you can do one custom ca-certificates-2018.2.26-2.fc29.noarch package and add your certificate to ca-truted in you system

or you just need copy you ca to /etc/pki/ca-trust/source/anchors and run update-ca-trust I used or as reference [1] [1] https://ask.fedoraproject.org/en/question/37820/confusion-with-rpm-fusion... Best regards, -- Sérgio M. B. _______________________________________________ devel mailing list -- devel(a)lists.fedoraproject.org To unsubscribe send an email to devel-leave(a)lists.fedoraproject.org Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org

On Thu, Apr 25, 2019 at 1:42 PM Danishka Navin <danishka(a)gmail.com&gt; wrote: > > > > On Wed, Apr 24, 2019 at 6:02 PM Sérgio Basto <sergio(a)serjux.com&gt; wrote: >> >> On Wed, 2019-04-24 at 11:35 +0530, Danishka Navin wrote: >> >> Hi, >> >> Sri Lanka Cert is gonna implement local Root CA. >> How we can submit this Root CA with Fedora? >> >> I could not find enough information on this. >> >> >> you can do one custom ca-certificates-2018.2.26-2.fc29.noarch package and add your certificate to ca-truted in you system > > > Its about officially distributed using formal channels, i.e: Operating Systems and Browsers. > This is not about testing locally. > I mean it required to be in ca-certificates-2018.2.26-2.fc29.noarch package by default. > That package comes from Mozilla's collection. If Mozilla approves it, Fedora will pick it up as soon as an updated ca-certificates package is released. That said, it sounds like the intent of that CA is for a government-mandated man-in-the-middle attack to monitor secure traffic. It is highly unlikely that will be accepted by Mozilla.

On Mon, May 20, 2019 at 8:53 AM Danishka Navin <danishka(a)gmail.com&gt; wrote: > Seems government is working with Chinese tech people to run mass online surveillance system. > http://www.themorning.lk/china-styled-mass-online-surveillance/ > > > But I am not clear how Root CA can use to SSL MITM attack instead of user cert. > If you trust a root CA for signing websites, then they can sign a new certificate for google.com, then modify DNS to send you to a non-Google server presenting their certificate, signed by the corrupt CA. They'd decrypt all of your traffic, read it, re-encrypt it with the real google.com cert and pass it along. You would still see the website you expect to, but in the middle all of your traffic is exposed to the man-in-the-middle server.