Hi.

Apparrently, when certs are removed from the package upon Mozillas command
the following errors happen each time during upgrade:
Setting up ca-certificates (20140927) ...
Processing triggers for ca-certificates (20140927) ...
Updating certificates in /etc/ssl/certs... W: /usr/share/ca-certificates/mozilla/Entrust.net_Secure_Server_CA.crt not found, but listed in /etc/ca-certificates.conf.
W: /usr/share/ca-certificates/mozilla/RSA_Root_Certificate_1.crt not found, but listed in /etc/ca-certificates.conf.
W: /usr/share/ca-certificates/mozilla/TDC_Internet_Root_CA.crt not found, but listed in /etc/ca-certificates.conf.
W: /usr/share/ca-certificates/mozilla/ValiCert_Class_1_VA.crt not found, but listed in /etc/ca-certificates.conf.
W: /usr/share/ca-certificates/mozilla/ValiCert_Class_2_VA.crt not found, but listed in /etc/ca-certificates.conf.
Error opening Certificate RSA_Root_Certificate_1.pem
140074132829840:error:02001002:system library:fopen:No such file or directory:bss_file.c:398:fopen('RSA_Root_Certificate_1.pem','r')
140074132829840:error:20074002:BIO routines:FILE_CTRL:system lib:bss_file.c:400:
unable to load certificate
WARNING: RSA_Root_Certificate_1.pem does not contain a certificate or CRL: skipping
Error opening Certificate ValiCert_Class_1_VA.pem
140153506678416:error:02001002:system library:fopen:No such file or directory:bss_file.c:398:fopen('ValiCert_Class_1_VA.pem','r')
140153506678416:error:20074002:BIO routines:FILE_CTRL:system lib:bss_file.c:400:
unable to load certificate
WARNING: ValiCert_Class_1_VA.pem does not contain a certificate or CRL: skipping
Error opening Certificate TDC_Internet_Root_CA.pem
139641791534736:error:02001002:system library:fopen:No such file or directory:bss_file.c:398:fopen('TDC_Internet_Root_CA.pem','r')
139641791534736:error:20074002:BIO routines:FILE_CTRL:system lib:bss_file.c:400:
unable to load certificate
WARNING: TDC_Internet_Root_CA.pem does not contain a certificate or CRL: skipping
Error opening Certificate Entrust.net_Secure_Server_CA.pem
140510059488912:error:02001002:system library:fopen:No such file or directory:bss_file.c:398:fopen('Entrust.net_Secure_Server_CA.pem','r')
140510059488912:error:20074002:BIO routines:FILE_CTRL:system lib:bss_file.c:400:
unable to load certificate
WARNING: Entrust.net_Secure_Server_CA.pem does not contain a certificate or CRL: skipping
Error opening Certificate ValiCert_Class_2_VA.pem
140492449592976:error:02001002:system library:fopen:No such file or directory:bss_file.c:398:fopen('ValiCert_Class_2_VA.pem','r')
140492449592976:error:20074002:BIO routines:FILE_CTRL:system lib:bss_file.c:400:
unable to load certificate
WARNING: ValiCert_Class_2_VA.pem does not contain a certificate or CRL: skipping
8 added, 0 removed; done.
Running hooks in /etc/ca-certificates/update.d....
Adding debian:DigiCert_Assured_ID_Root_G2.pem
Adding debian:DigiCert_Assured_ID_Root_G3.pem
Adding debian:DigiCert_Global_Root_G2.pem
Adding debian:DigiCert_Global_Root_G3.pem
Adding debian:DigiCert_Trusted_Root_G4.pem
Adding debian:QuoVadis_Root_CA_1_G3.pem
Adding debian:QuoVadis_Root_CA_2_G3.pem
Adding debian:QuoVadis_Root_CA_3_G3.pem
done.
done.


And "0 [are] removed".


It seems, though, that this is only a configuration file/cosmetic issue,
than the certs are in fact gone and /etc/ssl/certs only contains
dangling symlinks.
Also, /etc/ssl/certs/ca-certificates.crt should be save, as the following
call should demonstrate (in the most recent upgrade the ValiCert certs
were removed):
$ cat /etc/ssl/certs/ca-certificates.crt | while openssl x509 -noout -issuer ; do true; done | grep ValiCert
which gives no results in my case.


Another run of
# update-ca-certificates
Updating certificates in /etc/ssl/certs... W: /usr/share/ca-certificates/mozilla/Entrust.net_Secure_Server_CA.crt not found, but listed in /etc/ca-certificates.conf.
W: /usr/share/ca-certificates/mozilla/RSA_Root_Certificate_1.crt not found, but listed in /etc/ca-certificates.conf.
W: /usr/share/ca-certificates/mozilla/TDC_Internet_Root_CA.crt not found, but listed in /etc/ca-certificates.conf.
W: /usr/share/ca-certificates/mozilla/ValiCert_Class_1_VA.crt not found, but listed in /etc/ca-certificates.conf.
W: /usr/share/ca-certificates/mozilla/ValiCert_Class_2_VA.crt not found, but listed in /etc/ca-certificates.conf.
0 added, 0 removed; done.
Running hooks in /etc/ca-certificates/update.d....
done.
done.

won't cure the problem, though.
Only when I do:
# dpkg-reconfigure ca-certificates
Processing triggers for ca-certificates (20140927) ...
Updating certificates in /etc/ssl/certs... 0 added, 5 removed; done.
Running hooks in /etc/ca-certificates/update.d....
Removing debian:Entrust.net_Secure_Server_CA.pem
Removing debian:RSA_Root_Certificate_1.pem
Removing debian:TDC_Internet_Root_CA.pem
Removing debian:ValiCert_Class_1_VA.pem
Removing debian:ValiCert_Class_2_VA.pem
done.
done.

without any changes in the selections (I just click ok), the certificates
(rather said: there symlinks and config file entries) are removed.


Cheers,
Chris.

Hello,

I tested upgrades on about 8 boxes with no issues, before requesting an
upload. Here's a test I just ran on a box that I had not upgraded, yet:

(master)mshuler@hana:~$ dpkg -l ca-certificates
Desired=Unknown/Install/Remove/Purge/Hold
|
Status=Not/Inst/Conf-files/Unpacked/halF-conf/Half-inst/trig-aWait/Trig-pend
|/ Err?=(none)/Reinst-required (Status,Err: uppercase=bad)
||/ Name                                  Version
Architecture            Description
+++-=====================================-=======================-=======================-================================================================================
ii  ca-certificates                       20140325                all
                   Common CA certificates
(master)mshuler@hana:~$ grep '^!' /etc/ca-certificates.conf
(master)mshuler@hana:~$ sudo apt-get install ca-certificates -t unstable -V
Reading package lists... Done
Building dependency tree
Reading state information... Done
The following packages will be upgraded:
    ca-certificates (20140325 => 20140927)
1 upgraded, 0 newly installed, 0 to remove and 281 not upgraded.
Need to get 199 kB of archives.
After this operation, 99.3 kB of additional disk space will be used.
Get:1 http://http.debian.net/debian/ unstable/main ca-certificates all
20140927 [199 kB]
Fetched 199 kB in 1s (186 kB/s)
Reading changelogs... Done
apt-listchanges: Mailing root: apt-listchanges: news for hana
Preconfiguring packages ...
(Reading database ... 162156 files and directories currently installed.)
Preparing to unpack .../ca-certificates_20140927_all.deb ...
Unpacking ca-certificates (20140927) over (20140325) ...
Processing triggers for man-db (2.7.0.2-1) ...
Setting up ca-certificates (20140927) ...
Processing triggers for ca-certificates (20140927) ...
Updating certificates in /etc/ssl/certs... 10 added, 5 removed; done.
Running hooks in /etc/ca-certificates/update.d....
Adding debian:DigiCert_Assured_ID_Root_G2.pem
Adding debian:DigiCert_Assured_ID_Root_G3.pem
Adding debian:DigiCert_Global_Root_G2.pem
Adding debian:DigiCert_Global_Root_G3.pem
Adding debian:DigiCert_Trusted_Root_G4.pem
Adding debian:QuoVadis_Root_CA_1_G3.pem
Adding debian:QuoVadis_Root_CA_2_G3.pem
Adding debian:QuoVadis_Root_CA_3_G3.pem
Adding debian:WoSign_China.pem
Adding debian:WoSign.pem
Removing debian:Entrust.net_Secure_Server_CA.pem
Removing debian:RSA_Root_Certificate_1.pem
Removing debian:TDC_Internet_Root_CA.pem
Removing debian:ValiCert_Class_1_VA.pem
Removing debian:ValiCert_Class_2_VA.pem
done.
done.

   ¯\_(ツ)_/¯

If you have some additional info to go on, it might help in finding the
problem.

Hmm interesting... for me that problem exists actually since much
longer... at least since the last 3-4 versions.
Well I have many disabled certs... could that be a difference?

And what's your default debconf mode for ca-certificates? ask/yes/no?
Mine is ask.

Have you had ca-certificates-java installed in your test?
Well not much more then the questions I've asked you just now.

I also have some of the igtf-* certificate bundle packages installed,
which seem to interfere somehow with ca-certificates, but IIRC, the
problem appeared already before igtf-* became available in Debian.


Cheers,
Chris.

Thanks for the extra info!

I use the package defaults, for the most part, and try different
configurations from time to time, but this gives me an idea to perhaps
script through a few config change tests.

Yes, that's the "Running hooks in /etc/ca-certificates/update.d,
Adding/Removing ..." section.

Perhaps. I'll take a look at those.

Thanks for your time!

Default was "yes", wasn't it? So perhaps you can try it again with
"ask".
Okay,.. wasn't sure if that's generally printed, even if the dir is
empty.
Sure :)