Pandora etc inside PND?


Silent-Hunter

Hardcore Member
Joined
May 29, 2010
Messages
3,485
I am attempting to fix TTYtter, as some people can't seem to install ca-certificates on their NAND. I found where they are, but they are in /etc/ssl/certs. I created that path inside the PND, but I don't know what environment variable controls where it looks for etc.

And I already tried Googling it, I can't find that information.
 
Last edited by a moderator:
Tere could be a compiletime switch where it has to look for it.


Try ./configure --help
 
Last edited by a moderator:
ekianjo can't seem to install them for some reason.

It's a Perl script, it has no configure.
 
The script need to know where to look for them somehow so you could search the sourcecode and redirect the calls.
 
So etc can't be done as an environment variable? I could search through the source, but I may have to rebuild Perl itself, and I already tried that. I cannot get it to work.
 
Is it not curl that does the magic with the certificates? you can declare an external variable:

       --cacert <CA certificate>
              (SSL) Tells curl to use the specified certificate file to verify the peer. The file may contain multiple  CA  certificates.  The  certificate(s)
              must be in PEM format. Normally curl is built to use a default file for this, so this option is typically used to alter that default file.

              curl recognizes the environment variable named 'CURL_CA_BUNDLE' if it is set, and uses the given path as a path to a CA cert bundle. This option
              overrides that variable.

              The windows version of curl will automatically look for a CA certs file named ´curl-ca-bundle.crt´, either in the same directory as curl.exe, or
              in the Current Working Directory, or in any folder along your PATH.

              If curl is built against the NSS SSL library, the NSS PEM PKCS#11 module (libnsspem.so) needs to be available for this option to work properly.

              If this option is used several times, the last one will be used.

       --capath <CA certificate directory>
              (SSL) Tells curl to use the specified certificate directory to verify the peer. Multiple paths can be provided by separating them with ":" (e.g.
              "path1:path2:path3"). The certificates must be in PEM format, and if curl is built against OpenSSL, the directory must have been processed using
              the  c_rehash  utility  supplied  with OpenSSL. Using --capath can allow OpenSSL-powered curl to make SSL-connections much more efficiently than
              using --cacert if the --cacert file contains many CA certificates.

              If this option is set, the default capath value will be ignored, and if it is used several times, the last one will be used.
 


export CURL_CA_BUNDLE=/mnt/utmp/ttytter/certs
(cp -L from the certificate dir)
./bin/ttytter

And maybe ~/.curlrc can be used?

found this example, although it does not contain our variable, by example we can set it.  http://dotfiles.org/~mitry/.curlrc


# Without .curlrc

fbnil@pandora:~$ curl https://www.zoek.nl
curl: (51) SSL: no alternative certificate subject name matches target host name 'www.zoek.nl'

# With .curlrc (to an existing directory but without certificates)

fbnil@pandora:~$ cat .curlrc
CApath=/tmp
fbnil@pandora:~$ curl https://www.zoek.nl
curl: (60) SSL certificate problem: self signed certificate in certificate chain
More details here: http://curl.haxx.se/docs/sslcerts.html

curl performs SSL certificate verification by default, using a "bundle"
of Certificate Authority (CA) public keys (CA certs). If the default
bundle file isn't adequate, you can specify an alternate file
using the --cacert option.
If this HTTPS server uses a certificate signed by a CA represented in
the bundle, the certificate verification probably failed due to a
problem with the certificate (it might be expired, or the name might
not match the domain name in the URL).
If you'd like to turn off curl's verification of the certificate, use
the -k (or --insecure) option.
fbnil@pandora:~$


The error comes from the fact that www.zoek.nl uses a certificate from another site. I was unable to get it validated.

I dl the cerfificate with firefox, but found this website that tells you how to do it from the commandline using openssl: http://www.macfreek.nl/memory/Install_CA_Certificates
 
Last edited by a moderator:
Back
Top