-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
El 2023-11-18 a las 21:48 -0700, Eduardo Chappa escribió:
On Sun, 19 Nov 2023, Carlos E. R. wrote:
-----------------------------
Manage your own certificates
-----------------------------
Manage Public Certificates
Manage Private Keys
Manage Certificate Authorities
I assume these three are for self signed certificates, so they don't apply
to me.
They apply to any certificates or keys that you wish to import, so they do
apply to you.
Oh! Ok. Guess I have a thick day. :-}
The three see the certificates, I don't see errors.
Manage Certificate Authorities:
+++——————————————————
Certificate Information
-
---------------------------------------------------------------------------------------------------------------------------
Certificate Owner Issuer
AC FNMT Usuarios AC RAIZ
FNMT-RCM
Ceres FNMT-RCM
FNMT-RCM ES
ES
Serial Number
45:5f:3a:e1:5c:21:cd:ba:54:4f:82:aa:47:51:eb:db
Validity
Not Before: Oct 28 11:48:58 2014 GMT
Not After: Oct 28 11:48:58 2029 GMT
SHA1 Fingerprint
80:8b:72:e4:3b:57:4c:f5:87:7c:b8:41:a8:df:88:39:6d:38:ab:94
MD5 Fingerprint
7a:92:88:1c:9a:ac:47:b4:3a:da:91:ff:da:ea:7e:8a
Certificate Chain Information
Issued to: AC FNMT Usuarios
\- Signed by: AC RAIZ FNMT-RCM
Certificate validated without errors
——————————————————++-
Manage Public Certificates (private data replaced with ellipsis)
+++——————————————————
Certificate Information
-
---------------------------------------------------------------------------------------------------------------------------
Certificate Owner Issuer
ROBIN...... AC FNMT Usuarios
ROBIN...... Ceres
CARLOS FNMT-RCM
IDCES-..... ES
ES
Serial Number
1b:fd:....
Validity
Not Before: Mar 7 08:37:59 2022 GMT
Not After: Mar 7 08:37:59 2026 GMT
SHA1 Fingerprint
bd:5e:43:...
MD5 Fingerprint
1b:9a:78:...
Certificate Chain Information
Issued to: ROBIN...
\- Signed by: AC FNMT Usuarios
\- Signed by: AC RAIZ FNMT-RCM
Certificate validated without errors
——————————————————++-
Manage Private Keys
(private data replaced with ellipsis)
+++——————————————————
Certificate Information
-
---------------------------------------------------------------------------------------------------------------------------
Certificate Owner Issuer
ROBIN... AC FNMT Usuarios
ROBIN... Ceres
CARLOS FNMT-RCM
IDCES-... ES
ES
Serial Number
1b:fd:a4:...
Validity
Not Before: Mar 7 08:37:59 2022 GMT
Not After: Mar 7 08:37:59 2026 GMT
SHA1 Fingerprint
bd:5e:43:...
MD5 Fingerprint
1b:9a:78:...
Certificate Chain Information
Issued to: ROBIN...
\- Signed by: AC FNMT Usuarios
\- Signed by: AC RAIZ FNMT-RCM
Certificate validated without errors
——————————————————++-
What I don't see is the mail address!
On Thunderbird, it says:
Purposes: E-mail Protection, Client Authentication
[email protected] -> ~/.alpine-smime/private/
[email protected] -> ~/.alpine-smime/public/
certificate-ca.crt -> ~/.alpine-smime/ca/ (is this name correc?)
copy [email protected] to ~/.alpine-smime/ca/ also.
Ah. Done. But doesn't help.
Have you run alpine with debug to see what more information you can get out
of the debug?
No, I'm unsure what debug options to use.
Do you mind sharing "ls -lR ~/.alpine-smime" with me if this does not
work?
Sure, will mail that in private after this mail.
Thank you. I got it. It all looks good.
Ok.
Thanks, but still not there...
For the record, it fails also in Thunderbird, but in Alpine I don't know
yet if I have it configured properly.
Yes, your Alpine is configured correctly. All your permissions are set
correctly. Although your certificates have information in them that is not
part of the key or certificate, that information does not matter because it
is ignored when the certificate is processed, so I am not sure what your
problem is.
Ok, that's what I needed to know :-)
same error code as this bug:
<https://bugzilla.mozilla.org/show_bug.cgi?id=1756413>
It seems RSA-PSS certificates are not supported.
There's also this:
<https://bugzilla.mozilla.org/show_bug.cgi?id=1364339>
Not my expertise here, but reading man pages, it looks like RSA-PSS uses
pkcs#8, while s/mime uses pkcs#7.
https://www.openssl.org/docs/man1.1.1/man7/RSA-PSS.html
https://en.wikipedia.org/wiki/PKCS
I can't imagine these are good news for you. Let me interpret this in a
different way. It looks like the purpose of your certificate is not for
s/mime, hence it is not surprising it fails. Since I am not the expert here,
I'd love to be corrected.
I have no idea.
I don't use this even every year. I used a certificate from this entity
maybe a decade ago with Thunderbird and it worked. It has to be renewed
periodically, so the current incantation is different, and Thunderbird is
different. So I wanted to try Alpine being different software- Knowing
that it is properly configured, if it gives an apparently similar error
indicates that the certificate doesn't work.
And today I have noticed that my email is not listed in the certificate,
despite me asking for it. That could be the reason.
I guess that the error messages from these libraries are not very
informative for the layman.
I can try to get another certificate from another entity for email. I'm
open to suggestions, but the reason I wanted to use this official
certificate is that it includes our National Identification Number, which
is used in many procedures, and identity is verified by an official in an
interview. It is used on the web for tax purposes, so it has to be
verifiable.
But for some reason, my email is not listed in it.
- --
Cheers
Carlos E. R.
(from openSUSE 15.5 (Laicolasse))
-----BEGIN PGP SIGNATURE-----
iHoEARECADoWIQQZEb51mJKK1KpcU/W1MxgcbY1H1QUCZVn5lRwccm9iaW4ubGlz
dGFzQHRlbGVmb25pY2EubmV0AAoJELUzGBxtjUfVSLMAn17b1g8qqFCcxrAbrxPg
DqDvI84rAKCCzVKZy7jWPx9ABFosjP8MFugTWg==
=4xe9
-----END PGP SIGNATURE-----_______________________________________________
Alpine-info mailing list
[email protected]
http://mailman12.u.washington.edu/mailman/listinfo/alpine-info
