Hello, Thanks to this group's help, I'm learning my way through IPA's certificate system. I read Fraser's well written post on creating sub-CAs, and successfully got everything to work. I then ran into the same problem Kevin Vasko hit in this thread: https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho... It seems Debian-based Chrome and Firefox don't implicitly trust the OS root certificate store. For each Firefox profile (about:profiles), the NSS db is in ~/.mozilla/firefox/<profile>. The certs in this directory can be listed certutil -d sql:/home/nick/.mozilla/firefox/4sar5x5s.default-release/ -L On Ubuntu 18.04, after installing and configuring IPA client (# ipa-client-install --mkhomedir), the IPA certificate is listed in the store. Still, Firefox doesn't trust the IPA server or its trusted hosts. Why??? It's been established that Linux Firefox and Linux Chrome don't trust the OS trusted certificate stores. It seems, with all that comes with assumptions, that Firefox doesn't trust its own profile store, either. Nick

You can get browsers (and other programs that use libnss3) to use the system-wide trust store (i.e., /etc/ssl/certs/ca-certificates.crt) if you install p11-kit and run: # dpkg-divert --add --local --rename /usr/lib/x86_64-linux-gnu/nss/libnssckbi.so # ln -srf /usr/lib/x86_64-linux-gnu/pkcs11/p11-kit-trust.so /usr/lib/x86_64-linux-gnu/nss/libnssckbi.so You can undo it by removing the symlink and then running 'dpkg-divert --remove --rename /usr/lib/x86_64-linux-gnu/nss/libnssckbi.so'. There was a discussion on the Debian BTS about doing this by default at < https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=704180> but it never actually happened. I think this is already done by default in the Red Hat world. -- Sam Morris <sam(a)robots.org.uk&gt; https://robots.org.uk/ _______________________________________________ FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...