Re: Accessing Firefox keystore

2014-12-08 Thread Jean Bave
Thank you for your answer. We tried the SunPKCS11 class but the thing is we are trying to access Firefox's keystore to reach the certificates of a physical token stored in it. Apparently the Sun provider cannot deal with physical tokens through Firefox's keystore. Does that seem plausible to you?

Re: Accessing Firefox keystore

2014-12-08 Thread Julien Pierre
Jean, On 12/8/2014 02:38, Jean Bave wrote: Thank you for your answer. We tried the SunPKCS11 class but the thing is we are trying to access Firefox's keystore to reach the certificates of a physical token stored in it. Apparently the Sun provider cannot deal with physical tokens through

Re: libnsssysinit

2014-12-08 Thread David Woodhouse
On Mon, 2014-12-08 at 10:15 +, Martinsson Patrik wrote: So, to summarize, $ sudo update-alternatives --install /usr/lib64/libnssckbi.so libnssckbi.so.x86_64 /usr/lib64/p11-kit-proxy.so 1000 $ cat /etc/pki/nssdb/pkcs11.txt library=/usr/lib64/p11-kit-proxy.so name=p11-kit-proxy

Re: libnsssysinit

2014-12-08 Thread David Woodhouse
On Mon, 2014-12-08 at 13:05 +, David Woodhouse wrote: If you fix the unlock-at-login issue then you shouldn't have to disable this in any application for which there isn't already a Does not support Protected Authentication Path bug filed. I.e. evolution. I just fixed Evolution, FWIW:

Re: libnsssysinit

2014-12-08 Thread Martinsson Patrik
On Mon, 2014-12-08 at 13:05 +, David Woodhouse wrote: On Mon, 2014-12-08 at 10:15 +, Martinsson Patrik wrote: So, to summarize, $ sudo update-alternatives --install /usr/lib64/libnssckbi.so libnssckbi.so.x86_64 /usr/lib64/p11-kit-proxy.so 1000 $ cat /etc/pki/nssdb/pkcs11.txt

Re: libnsssysinit

2014-12-08 Thread Robert Relyea
On 12/08/2014 05:05 AM, David Woodhouse wrote: On Mon, 2014-12-08 at 10:15 +, Martinsson Patrik wrote: So, to summarize, $ sudo update-alternatives --install /usr/lib64/libnssckbi.so libnssckbi.so.x86_64 /usr/lib64/p11-kit-proxy.so 1000 $ cat /etc/pki/nssdb/pkcs11.txt

Re: libnsssysinit

2014-12-08 Thread Robert Relyea
On 12/08/2014 08:59 AM, David Woodhouse wrote: I still maintain that the path to sanity involves killing /etc/pki/nssdb entirely, and then you can look at applying *correct* fixes to whatever's still not behaving correctly. The whole point of /etc/pki/nssdb is so you have one place to install