Trust Policy Module

Files loaded by the Module
Using the Trust Policy Module with NSS
Using the Trust Policy Module with glib-networking
Disabling the Trust Policy Module

The trust module provides system certificate anchors, blacklists and other trust policy to crypto libraries applications. This information is exposed as PKCS#11 objects.

Files loaded by the Module

The trust module loads certificates and trust policy information from preconfigured directories and allows them to be looked up via PKCS#11. The directories can be determined with using the following commands:

  • System Anchors: certificates in these locations are automatically treated as certificate authority anchors unless they contain information that prevents that. To check which locations are being used, run the following command:

    $ pkg-config --variable p11_system_anchors p11-kit-1
    /etc/pki/tls/certs/ca-bundle.trust.crt:/etc/pki/tls/anchors
    
  • System Certificates: certificates in these locations are not treated as anchors, but simply made available through the module. To find out which directory is used, run the following command:

    $ pkg-config --variable p11_system_certificates p11-kit-1
    /etc/pki/tls/other-certs
    

Files in the following formats are supported for loading by the trust policy module:

X.509 certificates

X.509 certificates in raw DER format.

OpenSSL trust certificates

OpenSSL specific certificates in PEM format that contain trust information. These have a TRUSTED CERTIFICATE PEM header. Both trust policy and blacklist information can be loaded from these files.