Hey guys. Mike from Start9 here. We have a lot of Zorin users that are also StartOS personal server users. Something I'm running into is, some of them are still on Zorin 17.3. I know that 17.3 is sun-setting soon, and they really need to move to 18. But some aren't quite ready to do that yet. We have documentation for setting up their root CA on Ubuntu based operating systems.
This seems to be ignored however, on 17.3. I'm guessing it's because it's relevant for newer Ubuntu based distros, but 17.3 is based on 22.04. If someone could be so kind as to let me know how these instructions can be modified to apply to 17.3, I'd greatly appreciate the assistance.
Thanks in advance.
1 Like
Welcome to the Forum!
Could You explain in more Detail what doesn't work? You offer Instructions on Your Site but where are there the Issues with these? Isn't it possible to follow them because of Errors?
2 Likes
zorin 17.3 is ubuntu 22.04 under the hood so the debian/ubuntu block on the start9 CA page is the right one. it isnt ignored, something in the install usually just misses.
try doin this from the folder where the .crt landed (usually ~/Downloads):
sudo apt update
sudo apt install -y ca-certificates p11-kit
sudo mkdir -p /usr/share/ca-certificates/start9
sudo cp "YOUR-SERVER-NAME.crt" /usr/share/ca-certificates/start9/
sudo bash -c "echo 'start9/YOUR-SERVER-NAME.crt' >> /etc/ca-certificates.conf"
sudo update-ca-certificates
you want 1 added in that output. if it says 0, the cert is already registered or the filename didnt match.
gotchas that trip people on 17.3:
- use the exact downloaded filename. dont add
.local to it
- firefox/librewolf on zorin is often a snap and ignores the system store. Settings → Privacy & Security → Certificates → View Certificates → Authorities → Import the same .crt (trust for websites)
- chrome/chromium usually picks up the system store after update-ca-certificates + a full browser restart
- test with
curl -vI https://YOUR-SERVER-NAME.local after. if curl is happy but the browser isnt, its the browser store
paste the update-ca-certificates line + whether theyre on firefox snap or deb if it still ignores https.
2 Likes
Thank you. The testing with curl was very helpful. In my particular test with 17.3. I thought it was being ignored because no errors occurred, but neither the built in Brave browser, or Firefox which I installed, trust the server's certificate after installing the root CA. Curl does connect, and is happy. So you were right. It's not that the system was ignoring the CA, but both browsers are. In our instructions for Firefox we have people loading p11-kit-trust.so as a security module. This does not work in my test, as the server's certificate is still not trusted by Firefox. What does seem to work is to add the CA under Authorities in the certificate manager, as you specified. I'm using Firefox ESR from the SNAP store. I haven't yet experimented with other flavors. But more importantly, since Brave is the default browser on Zorin we need to add instructions for it. The first thing, and probably the only part of this that is actually Zorin 17.3 specific, I found, was the .local wouldn't resolve in Brave, or the terminal using the ping command. This is because MulticastDNS is off by default in etc/system/resolved.conf. Once I turned that on, I was able to ping the StartOS server. After that, getting Brave to trust the server's certificate was as simple as adding the CA as a Custom Trusted Certificate in Brave's certificate manager. Even though Brave is chrome based, it seems to ignore the system store as well. This info needs to be added to our docs.
Thank you. I think I now have what I need to better help Zorin 17.3 used connect to their StartOS servers.
1 Like
I'm sorry if my question wasn't clear. I'm researching the fact that we were receiving more than a few reports from Zorin 17.3 users that our instructions were not working for them. I setup a test machine and was able to confirm the complication. Think I got it worked out. I really appreciate it!
2 Likes
That might be a Point. Using the .deb Version of Firefox could be better. Unfortunately, it would be neccessary to follow Mozilla's Instructions to add their Repo and then install the Browser.
1 Like