Dear Maintainer,

update-ca-certificates -f does not pass removed certificates
to the update hooks. See the "remove" function in
/usr/sbin/update-ca-certificates - the test always fails if -f was
passed because the symlinks were deleted earlier in the script.

This happens when a certificate is removed from /usr/share/ca-certificates,
e.g.: for the update due to
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=858539, which removed
untrusted startcom and wosign certificates.

If ca-certificates-java is installed, the jks-keystore hook is not told
about the removed certificates, and they are still in
/etc/ssl/certs/java/keystore.

I beleive this is a critical security issue as any Java application will
accept certificates that Debian has removed.

There is a bug (reported by me a few years ago) against
ca-certificates-java
(https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=767272)
that is not a bug in that package, but a result of this bug.

Testing against a new build for jessie, it looks as if the
ca-certificates-java hook does nothing with new CA certificate
additions, either? None of the newly added CAs appear to have made it to
the keystore upon package upgrade, but were added in --fresh. It appears
the hook is not doing the right thing in either add/remove case.

Just wanted to let you know I've taken a quick look, but I'm not sure
what the real issue is, at this moment.

(test stdout attached)

Dear Maintainer,

I still run into this problem using debian stretch packages.

ca-certificates 20161130+nmu1
ca-certificates-java 20170531+nmu1

For testing I put/removed my own certificates to/from
"/usr/local/share/ca-certificates" and run "update-ca-certificates -f".

New certificates are correctly added to cacerts, but removed
certificates stay present in the cacerts.

I did a very nasty workaround by adding a

rm -f /etc/ssl/certs/java/cacerts

into the ca-certificates-java hook. That way the cacerts is build from
scratch every time, that way only existing certificates are used. But
IMHO this can't be the solution.

Best regards
Daniel

Hello,

Is there any progress on these two bugs?

This looks like a potential security issue as the certificates that are
not trusted anymore are still trusted by java programs as they are not
removed from the java trust store.

Could someone have a look at this?

Kind regards,

Laurent Bigonville