This page is related to the Shared System Certificates (SSC) feature.
Known issues and workarounds are posted here.
32-bit systems: Firefox prints warnings
On a 32 bit / i686 system, Firefox might print the following messages on the console:
p11-kit: 'timet >= 0' not true at when_and_offset_to_time_t p11-kit: 'timet >= 0' not true at calc_date
These messages are safe to ignore. The issues is tracked in https://bugs.freedesktop.org/show_bug.cgi?id=62825 and will be fixed.
32-bit systems: Firefox crashes
Firefox 32bit on Fedora seems unstable, and crashes frequently when visiting web pages that make use of JavaScript. The crashes are believed to be unrelated to the SSC feature.
HOWTO: Confirm that SSC is being used
This command tells you which module is in use:
ls -l /etc/alternatives/libnssckbi.so
It will either report /usr/lib/nss/libnssckbi.so (NSS), or it will report /usr/lib/pkcs11/p11-kit-trust.so (p11-kit).
On a standard F19 system, it should report: p11-kit
HOWO: Test Firefox _without_ the new SSC feature
If you are triaging an issue, and you would like to test the behaviour of an NSS application (e.g. Firefox) using the classic module provided by NSS, use the following command to switch to the NSS module:
/usr/sbin/update-alternatives --remove libnssckbi.so /usr/lib/pkcs11/p11-kit-trust.so
After above command, use
ls -l /etc/alternatives/libnssckbi.so
and the link should point to the NSS module.
Once you're ready to again activate the new p11-kit module, use:
/usr/sbin/update-alternatives --install /usr/lib/libnssckbi.so libnssckbi.so /usr/lib/pkcs11/p11-kit-trust.so 30
then use
ls -l /etc/alternatives/libnssckbi.so
and the link should point to the p11-kit module.
HOWTO: Reset the standard F19 SSC setup
If for some reason, you want to completely reset the alternative modules to the original state, use the following series of commands:
/usr/sbin/update-alternatives --remove libnssckbi.so /usr/lib/pkcs11/p11-kit-trust.so /usr/sbin/update-alternatives --remove libnssckbi.so /usr/lib/nss/libnssckbi.so /usr/sbin/update-alternatives --install /usr/lib/libnssckbi.so libnssckbi.so /usr/lib/nss/libnssckbi.so 10 /usr/sbin/update-alternatives --install /usr/lib/libnssckbi.so libnssckbi.so /usr/lib/pkcs11/p11-kit-trust.so 30 ls -l /etc/alternatives/libnssckbi.so
and the link should point to the p11-kit module.