Re: libnsssysinit

2014-12-02 Thread David Woodhouse
On Tue, 2014-12-02 at 19:59 +, David Woodhouse wrote: > > That doesn't happen here on F21, FWIW. > > Firefox only asks me to log into my p11-kit-provided hardware tokens > when I go to a web site which wants a certificate, which is fair > enough. > > And I haven't actually got Evolution to s

Re: libnsssysinit

2014-12-02 Thread David Woodhouse
On Tue, 2014-12-02 at 18:24 +, Martinsson Patrik wrote: > > I quickly tried to import libp11-proxy.so in the users nssdb (and > in .mozillas) and it worked as expected. However, since all my > "keyrings" (?) now are in the slots, evolution (and chrome/ff etc) now > asks me for passwords to

Re: libnsssysinit

2014-12-02 Thread David Woodhouse
On Tue, 2014-12-02 at 18:24 +, Martinsson Patrik wrote: > So here's a round of new questions, > > - There are different ways of loading pkcs11-modules into an application > where nss is one and p11-kit is another. And where p11-kit is a library > that an application can link to, and where ns

Re: libnsssysinit

2014-12-02 Thread Martinsson Patrik
Hi again, Thanks for all the info guys, it certainly answered some of my questions (and I've also figured out some stuff while digging on my own). With that being said, this still seems like a *huge* jungle for a sysadmin, and while the introduction of p11-kit seems promising I'm still somewhat

Re: libnsssysinit

2014-12-02 Thread David Woodhouse
On Tue, 2014-12-02 at 12:00 -0500, Miloslav Trmač wrote: > > Great. So that should solve Patrik's CA issues without needing to do > > anything special. All that remains is to get the smartcards working by > > loading p11-kit-proxy.so (or preferably the individual modules) too. > > > > Is that some

Re: libnsssysinit

2014-12-02 Thread Miloslav Trmač
Hello, - Original Message - > On Tue, 2014-12-02 at 11:16 -0500, Miloslav Trmač wrote: > > Hello, > > > It has largely been superseded by p11-kit-trust, which in the NSS case > > > provides a replacement for libnssckbi.so and gives us consistency across > > > the entire system regardless of

Re: libnsssysinit

2014-12-02 Thread David Woodhouse
On Tue, 2014-12-02 at 11:16 -0500, Miloslav Trmač wrote: > Hello, > > It has largely been superseded by p11-kit-trust, which in the NSS case > > provides a replacement for libnssckbi.so and gives us consistency across > > the entire system regardless of the crypto libraries in use. (This > > wasn't

Re: libnsssysinit

2014-12-02 Thread Miloslav Trmač
Hello, > It has largely been superseded by p11-kit-trust, which in the NSS case > provides a replacement for libnssckbi.so and gives us consistency across > the entire system regardless of the crypto libraries in use. (This > wasn't in RHEL6; it came in with Fedora 19 so hopefully it's in RHEL7).

Re: libnsssysinit

2014-12-02 Thread David Woodhouse
On Mon, 2014-12-01 at 17:22 -0800, Robert Relyea wrote: > > This is still the issue with nsssysinit. It currently only works if the > the application open sql:/etc/pki/nssdb. Currently firefox doesn't even > use the sql database. Which has always been a bit of a facepalm realisation: "Hey... we

Accessing Firefox keystore

2014-12-02 Thread Jean Bave
Hello everyone, I am currently trying to access the certificates stored in Firefox's keystore to sign an object. I tried with a Java applet using NSS then JSS but none of them worked. I was wondering if it was possible to access this by developing an add-on or plugin for Firefox? Regards, Shelbuk