Hello, alctra <[email protected]> writes:
> Hello, > > I'm trying to verify the nss-mozilla-ca-policy certificate attribute for > the system certificates, but I can't seem to find the p11-kit trust > store. For instance, ArchLinux keeps the store at: > > /usr/share/ca-certificates/trust-source/mozilla.trust.p11-kit > > while NixOS at: > > /etc/ssl/trust-source/ca-bundle.trust.p11-kit > > Running `p11-kit list-modules' shows `ca-certificates.crt', > `ca-bundle.crt' and `ca-bundle.pem' as the names of the tokens of the > default `p11-kit-trust.so' module. I assume (and from strace) that > `ca-certificates.crt' corresponds to: > > /etc/ssl/certs/ca-certificates.crt This is probably clearer than words to explain how our p11-kit package is configured: https://codeberg.org/guix/guix/src/branch/master/gnu/packages/tls.scm#L175 It trusts a few /etc/ subdirectories, and also adds the nss-certs certificates directly to its trust paths. This is so that TLS can work out-of-the-box with e.g. gnutls, which uses p11-kit as for its trust store. There is a PR to make user-configuration of p11-kit in Guix easier, see <https://codeberg.org/guix/guix/pulls/10199>. -- Thanks, Maxim
