NetBSD Problem Report #60916

From www@netbsd.org  Thu Oct 22 16:34:16 2026
Return-Path: <www@netbsd.org>
Received: from mail.netbsd.org (mail.netbsd.org [199.233.217.200])
	(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
	 key-exchange X25519 server-signature RSA-PSS (2048 bits)
	 client-signature RSA-PSS (2048 bits))
	(Client CN "mail.netbsd.org", Issuer "YR1" (not verified))
	by mollari.NetBSD.org (Postfix) with ESMTPS id B0A521A923B
	for <gnats-bugs@gnats.NetBSD.org>; Thu, 22 Oct 2026 16:34:16 +0000 (UTC)
Message-Id: <20261022163415.7619F1A923C@mollari.NetBSD.org>
Date: Thu, 22 Oct 2026 16:34:15 +0000 (UTC)
From: campbell+netbsd@mumble.net
Reply-To: campbell+netbsd@mumble.net
To: gnats-bugs@NetBSD.org
Subject: certctl(8) doesn't gracefully handle deleting untrusted certs
X-Send-Pr-Version: www-1.0
X-From4GNATS: "campbell+netbsd@mumble.net via gnats" <gnats-admin@NetBSD.org>

>Number:         60916
>Category:       bin
>Synopsis:       certctl(8) doesn't gracefully handle deleting untrusted certs
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    bin-bug-people
>State:          pending-pullups
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Thu Oct 22 16:35:00 +0000 2026
>Closed-Date:    
>Last-Modified:  Thu Oct 22 17:40:00 +0000 2026
>Originator:     Taylor R Campbell
>Release:        current, 11, 10
>Organization:
Acme Certification Authority Kits LLC
>Environment:
>Description:

	Suppose the operator distrusts a CA certificate and codifies
	this by running

# certctl untrust /usr/share/certs/mozilla/all/emSign_ECC_Root_CA_-_G3.pem

	and then updates the system so that the certificate is deleted
	altogether.

	After this, certctl(8) will complain because there is an
	inconsistent configuration that _could_ mean something went
	wrong, e.g. a typo somewhere led to distrusting a nonexistent
	certificate when the operator meant to distrust an existing
	one:

# rm /usr/share/certs/mozilla/all/emSign_ECC_Root_CA_-_G3.pem
# certctl rehash
certctl: distrusted certificate not found: emSign_ECC_Root_CA_-_G3.pem

	Fortunately, it will fail safe in this scenario and leave the
	system with _everything_ distrusted:

# ls /etc/openssl/certs/ca-certificates.crt
ls: /etc/openssl/certs/ca-certificates.crt: No such file or directory

	However, that's not great either, because you get stuck without
	some kind of manual intervention!  There has to be some way for
	this transition path to work gracefully.

>How-To-Repeat:

	global fire drill of CA certificate removal, brought to you by
	the number 4

>Fix:

	Since `certctl untrust X' already verifies whether X exists,
	perhaps that's good enough:

# certctl untrust /usr/share/certs/mozilla/all/emSign_Root_CA_-_G1x.pem
certctl: no such certificate: /usr/share/certs/mozilla/all/emSign_Root_CA_-_G1x.pem

	So maybe we can just remove the `distrusted certificate not
	found' failure mode -- eliminate the warning (warning fatigue
	is bad and there's no documented user interface for updating
	the state to avoid the warning) and make certctl(8) succeed.

	That does leave dangling symlinks in /etc/openssl/untrusted
	indefinitely with no way to clean them up, but does it matter?

>Release-Note:

>Audit-Trail:
From: "Taylor R Campbell" <riastradh@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc: 
Subject: PR/60916 CVS commit: src
Date: Thu, 22 Oct 2026 17:20:22 +0000

 Module Name:	src
 Committed By:	riastradh
 Date:		Thu Oct 22 17:20:22 UTC 2026

 Modified Files:
 	src/tests/usr.sbin/certctl: t_certctl.sh
 	src/usr.sbin/certctl: certctl.sh

 Log Message:
 certctl(8): Gracefully handle deletion of untrusted certs.

 PR bin/60916: certctl(8) doesn't gracefully handle deleting untrusted
 certs


 To generate a diff of this commit:
 cvs rdiff -u -r1.11 -r1.12 src/tests/usr.sbin/certctl/t_certctl.sh
 cvs rdiff -u -r1.7 -r1.8 src/usr.sbin/certctl/certctl.sh

 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.

From: "Taylor R Campbell" <riastradh@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc: 
Subject: PR/60916 CVS commit: src
Date: Thu, 22 Oct 2026 17:20:00 +0000

 Module Name:	src
 Committed By:	riastradh
 Date:		Thu Oct 22 17:20:00 UTC 2026

 Modified Files:
 	src/distrib/sets/lists/tests: mi
 	src/etc/mtree: NetBSD.dist.tests
 	src/tests/usr.sbin/certctl: Makefile t_certctl.sh
 Added Files:
 	src/tests/usr.sbin/certctl/certs5: Comodo_AAA_Services_root.pem
 	    DigiCert_Global_Root_CA.pem Makefile emSign_ECC_Root_CA_-_G3.pem

 Log Message:
 certctl(8): Test response to updates that delete untrusted certs.

 PR bin/60916: certctl(8) doesn't gracefully handle deleting untrusted
 certs


 To generate a diff of this commit:
 cvs rdiff -u -r1.1432 -r1.1433 src/distrib/sets/lists/tests/mi
 cvs rdiff -u -r1.216 -r1.217 src/etc/mtree/NetBSD.dist.tests
 cvs rdiff -u -r1.1 -r1.2 src/tests/usr.sbin/certctl/Makefile
 cvs rdiff -u -r1.10 -r1.11 src/tests/usr.sbin/certctl/t_certctl.sh
 cvs rdiff -u -r0 -r1.1 \
     src/tests/usr.sbin/certctl/certs5/Comodo_AAA_Services_root.pem \
     src/tests/usr.sbin/certctl/certs5/DigiCert_Global_Root_CA.pem \
     src/tests/usr.sbin/certctl/certs5/Makefile \
     src/tests/usr.sbin/certctl/certs5/emSign_ECC_Root_CA_-_G3.pem

 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.

State-Changed-From-To: open->needs-pullups
State-Changed-By: riastradh@NetBSD.org
State-Changed-When: Thu, 22 Oct 2026 17:32:55 +0000
State-Changed-Why:
fixed in HEAD (mostly), needs pullup-11 and pullup-10


State-Changed-From-To: needs-pullups->pending-pullups
State-Changed-By: riastradh@NetBSD.org
State-Changed-When: Thu, 22 Oct 2026 17:40:00 +0000
State-Changed-Why:
pullup-11 #558
pullup-10 #1403


>Unformatted:

Home	PR Database Search