TRIUMF Certificate Authority

System-Wide Installation

• On recent systems, install the triumf-cacert-nss RPM. See TRIUMF rpms
  OR
• Download the modified NSS library libnssckbi.so (from certdata.txt 2008/10/17)
  • SL5 x64 64-bit Scientific Linux 5
  • SL5 i386 32-bit Scientific Linux 5
  • SL4 x64 64-bit Scientific Linux 4
  • SL4 i386, maybe RH9,FC1 - SL3
  • RedHat 9 i386 (from 2006; missing some newer commercial root certs)
  
  Locate this file in the installed application, and overwrite it.
  For standard Mozilla tools, it is usually in /usr/local/application, e.g. /usr/local/mozilla,firefox,thunderbird
  For RedHat packaged Mozilla tools, it is often in /usr/lib/mozilla-version or /usr/lib (/usr/lib64). It may be located by e.g.
  rpm -qlf `which firefox` |grep libnssckbi.so
• Restart the application
• Note that subsequent software updates will overwrite this file, so keep a copy

This library contains the CA certificate compiled into the "Builtin Object Token". It will be used for new accounts, new browser profiles, and for users who have not edited any root certificate settings.

(for 64-bit Firefox 3 from RPM, this library is part of nss-devel)

See e.g. this paper on adding built-in CA certificates in Mozilla