Adobe
Sign in Privacy My Adobe

How do certificate stores in Adobe AIR Linux 1.5 work?

Adobe Community Help


Products Affected

Contact support

Adobe AIR 1.5 for Linux has three separate certificate stores:

  • Code signing certificate store
  • SSL certificate store
  • DRM certificate store

There are three separate certificate stores because the DRM certificate store requires certificates in NSS (cert8.db) format; however, the code signing certificate store was designed for certificates in the PEM format. The SSL certificate store has the requirement that a user should be able to modify it without any problems; therefore, a per user certificate store was created that may be modified by the user.

Code signing certificate store

The location of the code signing certificate store is: /etc/opt/Adobe/certificates/crypt/. This store is used by the XML Signature module for signature verification (for example, publisher ID verification during AIR application installation). This certificate store can only be modified by the Root of the system. Only CA certificates are stored in this certificate store. The certificates are bundled in a separate package and shipped along with the AIR installer. The utility aucm (Adobe Unix Certificate Manager) is shipped with the AIR runtime and it allows the Root to view, modify, or update the certificate store.

Modifying the code signing certificate store

The aucm utility can be used to modify the code signing certificate store, and provides the following command-line operations:

-?, --help Show help options
-l, --list List all the certificates in the store
-a, --add Add certificate to the store
-d, --delete Delete certificate from the store
-p, --print Print the certificate
-f, --certFile=cert.pem/cert.der Add certificate to the store
-n, --certName Name of the certificate to perform the operation on
-A, --trustAnchor=true/false Marks the certificate trustAnchor
-t, --trusted=true/false/default Marks the certificate is trusted or un-trusted
-c, --trustCodeSigning=true/false/default Set code signing trust of the certificate

Listing certificates in the store

To list certificates in the store, use the following command:

aucm -l

Which produces the following result:

  2. 2afc57aa.0: /C=DE/O=TC TrustCenter GmbH/OU=TC TrustCenter Class 2 CA/CN=TC TrustCenter Class 2 CA II
  3. 7651b327.0: /C=US/O=VeriSign, Inc./OU=Class 3 Public Primary Certification Authority
  4. 54edfa5d.0: /C=DE/ST=Hamburg/L=Hamburg/O=TC TrustCenter for Security in Data Networks GmbH/OU=TC TrustCenter Class 3 CA/emailAddress=certificate@trustcenter.de
  5. 256fd83b.0: /C=DE/ST=Hamburg/L=Hamburg/O=TC TrustCenter for Security in Data Networks GmbH/OU=TC TrustCenter Class 2 CA/emailAddress=certificate@trustcenter.de
  6. 673b5b.0: /C=US/O=thawte, Inc./OU=Certification Services Division/OU=(c) 2006 thawte, Inc. - For authorized use only/CN=thawte Primary Root CA
  7. c1e65b0d.0: /C=DE/O=TC TrustCenter GmbH/OU=TC TrustCenter Class 4 CA/CN=TC TrustCenter Class 4 CA II
  8. facacbc6.0: /C=US/O=VeriSign, Inc./OU=VeriSign Trust Network/OU=(c) 2006 VeriSign, Inc. - For authorized use only/CN=VeriSign Class 3 Public Primary Certification Authority - G5
  9. 7a481e66.0: /C=DE/O=TC TrustCenter GmbH/OU=TC TrustCenter Class 3 CA/CN=TC TrustCenter Class 3 CA II
  10. 7d453d8f.0: /C=US/O=VeriSign, Inc./OU=VeriSign Trust Network/OU=(c) 1999 VeriSign, Inc. - For authorized use only/CN=VeriSign Class 3 Public Primary Certification Authority - G3
  11. 5021a0a2.0: /C=DE/O=TC TrustCenter GmbH/OU=TC TrustCenter Universal CA/CN=TC TrustCenter Universal CA I
  12. 693dcfe1.0: /C=DE/O=TC TrustCenter GmbH/OU=TC TrustCenter Universal CA/CN=TC TrustCenter Universal CA II
  13. c33a80d4.0: /C=ZA/ST=Western Cape/L=Cape Town/O=Thawte Consulting cc/OU=Certification Services Division/CN=Thawte Premium Server CA/emailAddress=premium-server@thawte.com

The first column is the name of the certificate that will be used to refer to a particular certificate in the store.

Printing a certificate in the store

To print a VeriSign certificate (for example: 2) 7651b327.0: /C=US/O=VeriSign, Inc./OU=Class 3 Public Primary Certification Authority ), use the following command:

aucm -n 7651b327.0 -p

Which produces the following result: 

 User Specified Properties (7651b327.0):
		
	--------------------------------------
		
	Is a Trust Anchor: true
		
	Is Trusted: true
		
	Trusted for Code Signing: true
		
	Trusted for SSL Server Authentication: true
		
	
		
	Certificate Properties:
		
	-------------------------
		
	Certificate:
		
	    Data:
		
	        Version: 1 (0x0)
		
	        Serial Number:
		
	            70:ba:e4:1d:10:d9:29:34:b6:38:ca:7b:03:cc:ba:bf
		
	        Signature Algorithm: md2WithRSAEncryption
		
	        Issuer: C=US, O=VeriSign, Inc., 
		
	OU=Class 3 Public Primary Certification Authority
		
	        Validity
		
	            Not Before: Jan 29 00:00:00 1996 GMT
		
	            Not After : Aug  1 23:59:59 2028 GMT
		
	        Subject: C=US, O=VeriSign, Inc., 
		
	OU=Class 3 Public Primary Certification Authority
		
	        Subject Public Key Info:
		
	            Public Key Algorithm: rsaEncryption
		
	            RSA Public Key: (1024 bit)
		
	                Modulus (1024 bit):
		
	                    00:c9:5c:59:9e:f2:1b:8a:01:14:b4:10:df:04:40:
		
	                    db:e3:57:af:6a:45:40:8f:84:0c:0b:d1:33:d9:d9:
		
	                    11:cf:ee:02:58:1f:25:f7:2a:a8:44:05:aa:ec:03:
		
	                    1f:78:7f:9e:93:b9:9a:00:aa:23:7d:d6:ac:85:a2:
		
	                    63:45:c7:72:27:cc:f4:4c:c6:75:71:d2:39:ef:4f:
		
	                    42:f0:75:df:0a:90:c6:8e:20:6f:98:0f:f8:ac:23:
		
	                    5f:70:29:36:a4:c9:86:e7:b1:9a:20:cb:53:a5:85:
		
	                    e7:3d:be:7d:9a:fe:24:45:33:dc:76:15:ed:0f:a2:
		
	                    71:64:4c:65:2e:81:68:45:a7
		
	                Exponent: 65537 (0x10001)
		
	    Signature Algorithm: md2WithRSAEncryption
		
	        bb:4c:12:2b:cf:2c:26:00:4f:14:13:dd:a6:fb:fc:0a:11:84:
		
	        8c:f3:28:1c:67:92:2f:7c:b6:c5:fa:df:f0:e8:95:bc:1d:8f:
		
	        6c:2c:a8:51:cc:73:d8:a4:c0:53:f0:4e:d6:26:c0:76:01:57:
		
	        81:92:5e:21:f1:d1:b1:ff:e7:d0:21:58:cd:69:17:e3:44:1c:
		
	        9c:19:44:39:89:5c:dc:9c:00:0f:56:8d:02:99:ed:a2:90:45:
		
	        4c:e4:bb:10:a4:3d:f0:32:03:0e:f1:ce:f8:e8:c9:51:8c:e6:
		
	        62:9f:e6:9f:c0:7d:b7:72:9c:c9:36:3a:6b:9f:4e:a8:ff:64:
		
	        0d:64

Adding a certificate to the store

To add a certificate to the store, use the following command:

aucm -a -f /certs/cacert.cer

Deleting a certificate from the store

To delete a VeriSign certificate (for example: 2) 7651b327.0: /C=US/O=VeriSign, Inc./OU=Class 3 Public Primary Certification Authority ), use the following command:

aucm -n 7651b327.0 -d

Marking a certificate as trust anchor

To make a VeriSign certificate (for example: 2) 7651b327.0: /C=US/O=VeriSign, Inc./OU=Class 3 Public Primary Certification Authority ) a trust anchor, use the following command:

aucm -n 7651b327.0 -A true

Marking a certificate as trusted

To print a VeriSign certificate (for example: 2) 7651b327.0: /C=US/O=VeriSign, Inc./OU=Class 3 Public Primary Certification Authority ), use the following command:

aucm -n 7651b327.0 -c true

Marking a certificate as trusted for code signing

To print a VeriSign certificate (for example: 2) 7651b327.0: /C=US/O=VeriSign, Inc./OU=Class 3 Public Primary Certification Authority ), use the following command:

aucm -n 7651b327.0 -t true

SSL certificate store

The location of the SSL certificate store is: ~/.appdata/Adobe/AIR/Certs. This store is used by curl for SSL connections. curl provides the networking layer for AIR 1.5 for Linux. This store can be modified by the user. The certificates are picked up from the system using a set of search paths and copied in to the certificate store location mentioned above. On one of the supported distributions, Ubuntu 7.10, the system does not provide any certificates. For Ubuntu 7.10 and similar distros, basic certificates are shipped with the runtime installer so that major sites are accessible without installing extra certificates. Also, a script (InstallCertificate) is shipped with the AIR runtime that allows the user to add a certificate to the store.

Modifying the SSL certificate store

To add a certificate, use the following procedure:

  2. Get the certificate you want to add.
  3. If the certificate is not in PEM format, you can convert it using the following command:



    openssl -inform DER -outform PEM -in -out cert.pem



  4. Calculate the hash of the certificate using this command:

    openssl x509 -hash -noout -in cert.pem



  5. Go to ~/.appdata/Adobe/AIR/Certs folder to make sure that the certificate has been added.

DRM certificate store

The location of the DRM certificate store is: /etc/opt/Adobe/certificates/nss/. This store is used by the DRM module. The certificates in the NSS (cert8.db) format are bundled with the AIR runtime and copied from the installation folder on first use. The Mozilla certutil utility must to be used to modify the certificate store.

Modifying the DRM certificate store

The documentation for doing this is available here: http://www.mozilla.org/projects/security/pki/nss/tools/certutil.html.

Keywords: kb408085

This work is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 Unported License  Twitter™ and Facebook posts are not covered under the terms of Creative Commons.

Legal Notices   |   Online Privacy Policy

Products

Download

Support & Learning

Buy

Company

Choose your region

Copyright © 2013 Adobe Systems Incorporated. All rights reserved.

Terms of Use | Privacy | Cookies

Reviewed by TRUSTe: site privacy statement