User:Parasense/releng

Fedora Certificate

$ fedora-cert --new-cert --username=parasensse

$ fedora-cert --verify
Verifying Certificate
cert expires: 2014-11-10
CRL Checking not implemented yet

NOTE: CRL means "Certificate Revocation List", and involves verifying not just the certificate, but the chain of trust. Basically to check if any certificate in the chain of trust has been marked invalid via a CRL data.

Another way to check the Fedora certificate is directly with OpenSSL

$ openssl verify -verbose -CAfile ~/.fedora-server-ca.cert ~/.fedora.cert 
/home/jdisnard/.fedora.cert: OK

Fedora certificates exist in the home directory:

signing notes

$ sigul --help-commands
delete-key          Delete a key
modify-key-user     Modify user's key access
list-users          List users
grant-key-access    Grant key access to a user
sign-text           Output a cleartext signature of a text
import-key          Import a key
new-user            Add a user
sign-rpm            Sign a RPM
list-keys           List keys
sign-data           Create a detached signature
revoke-key-access   Revoke key acess from a user
user-info           Show information about a user
change-passphrase   Change key passphrase
list-key-users      List users that can access a key
new-key             Add a key
modify-user         Modify a user
sign-rpms           Sign one or more RPMs
modify-key          Modify a key
delete-user         Delete a user
key-user-info       Show information about user's key access
get-public-key      Output public part of the key

• Adding passphrase to signing key.

NSS_HASH_ALG_SUPPORT=+MD5 sigul --verbose --user-name=parasense change-passphrase epel-7

• Inspecting the NSS database with certutil

More info about certutil can be found here: https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/Tools/certutil

• start by displaying the certificate nicknames, which comes in handy later:

$ certutil -L  -d ~/.sigul

Certificate Nickname                                         Trust Attributes
                                                             SSL,S/MIME,JAR/XPI

fedora-ca                                                    CT,, 
sigul-client-cert                                            u,u,u

The "fedora-ca" is fedora packager cert. The "sigul-client-cert" is the relevant signing certificate. These two certificates combined allow for the delegation of package signing tasks to trusted persons.

NOTE: the fedora-ca is based on your packager cert, which is itself stored in the home directory:

$ fedora-cert --verify
Verifying Certificate
cert expires: 2014-11-10
CRL Checking not implemented yet

NOTE: If you are curious, you could do the above directly

$ grep "Not After" ~/.fedora.cert
            Not After : Nov 10 15:31:45 2014 GMT

$ certutil -K -d ~/.sigul
certutil: Checking token "NSS Certificate DB" in slot "NSS User Private Key and Certificate Services"
Enter Password or Pin for "NSS Certificate DB":
< 0> rsa     ... <REDACTED> ...  sigul-client-cert
< 1> rsa     ... <REDACTED> ...  sigul-client-cert

certutil -O -n sigul-client-cert -d ~/.sigul
"fedora-ca" [E=admin@fedoraproject.org,CN=Fedora Project CA,OU=Fedora Project CA,O=Fedora Project,L=Raleigh,ST=North Carolina,C=US]

  "sigul-client-cert" [E=jdisnard@gmail.com,CN=parasense,OU=Fedora User Cert,O=Fedora Project,ST=North Carolina,C=US]