feat(ca): configure browser trust policies for Chrome, Chromium, Brave and Firefox (v1.0.1)

sources/bnhmeijer_ca_certificates/bin/build.sh

@@ -35,6 +35,7 @@ echo "Building package: $PACKAGE_NAME ($VERSION) [$ARCH] -> $DEB_FILENAME"
 
 # Ensure correct Debian directory permissions
 find "packaging/$PACKAGE_NAME" -type d -exec chmod 755 {} +
+find "packaging/$PACKAGE_NAME" -type f -exec chmod 644 {} +
 find "packaging/$PACKAGE_NAME/DEBIAN" -type f -exec chmod 755 {} + 2>/dev/null || true
 
 # Build debian binary package

sources/bnhmeijer_ca_certificates/bnhmeijer-ca-certificates.control

@@ -1,12 +1,14 @@
 Package: bnhmeijer-ca-certificates
-Version: 1.0.0
+Version: 1.0.1
 Section: utils
 Priority: optional
 Architecture: all
 Depends: ca-certificates
+Recommends: libnss3-tools
 Maintainer: Bart Meijer <info@bnhmeijer.nl>
 Description: Bnhmeijer Homelab Root CA certificate
  Installs the Bnhmeijer Homelab Root CA certificate into the system trust store
- (/usr/local/share/ca-certificates/bnhmeijer/) and updates the CA trust list.
+ (/usr/local/share/ca-certificates/bnhmeijer/) and configures system policies
+ for Firefox, Google Chrome, Chromium and Brave browsers.
  Ensures all homelab internal services (*.lan and *.bnhmeijer.nl) signed by
  cert-service are automatically trusted by the OS and browsers.

sources/bnhmeijer_ca_certificates/packaging/bnhmeijer-ca-certificates/DEBIAN/postinst

@@ -1,12 +1,40 @@
 #!/bin/sh
 set -e
 
+CA_CRT="/usr/local/share/ca-certificates/bnhmeijer/bnhmeijer-root-ca.crt"
+CA_NICKNAME="Bnhmeijer Homelab Root CA"
+
 case "$1" in
     configure|abort-upgrade)
+        # 1. Update OS system trust store
         if command -v update-ca-certificates >/dev/null 2>&1; then
-            echo "Updating system trusted CA certificates..."
+            echo "Bijwerken van systeem trusted CA certificaten..."
             update-ca-certificates >/dev/null 2>&1 || true
         fi
+
+        # 2. Link Firefox distribution policies if application dir exists
+        if [ -d /usr/lib/firefox ]; then
+            mkdir -p /usr/lib/firefox/distribution
+            if [ ! -e /usr/lib/firefox/distribution/policies.json ] || [ -L /usr/lib/firefox/distribution/policies.json ]; then
+                ln -sf /etc/firefox/policies/policies.json /usr/lib/firefox/distribution/policies.json
+            fi
+        fi
+
+        # 3. Import into NSS databases if certutil is installed
+        if command -v certutil >/dev/null 2>&1 && [ -f "$CA_CRT" ]; then
+            for user_home in /root $(awk -F: '$3 >= 1000 && $3 < 60000 {print $6}' /etc/passwd 2>/dev/null); do
+                user_name=$(stat -c '%U' "$user_home" 2>/dev/null || echo "root")
+                for pki_dir in "$user_home/.pki/nssdb" "$user_home/.local/share/pki/nssdb"; do
+                    if [ -d "$pki_dir" ]; then
+                        certutil -d "sql:$pki_dir" -A -t "TC,," -n "$CA_NICKNAME" -i "$CA_CRT" >/dev/null 2>&1 || true
+                        chown -R "$user_name:" "$pki_dir" 2>/dev/null || true
+                    fi
+                done
+            done
+        fi
+
+        echo "Bnhmeijer Root CA is geconfigureerd voor OS, Firefox en Chromium/Chrome."
+        echo "Herstart actieve browsers om de nieuwe certificaatvertrouwenslijst te laden."
     ;;
 esac
 exit 0

sources/bnhmeijer_ca_certificates/packaging/bnhmeijer-ca-certificates/DEBIAN/postrm

@@ -1,12 +1,31 @@
 #!/bin/sh
 set -e
 
+CA_NICKNAME="Bnhmeijer Homelab Root CA"
+
 case "$1" in
     remove|purge|disappear)
+        # 1. Update OS system trust store
         if command -v update-ca-certificates >/dev/null 2>&1; then
-            echo "Removing certificate from system trust store..."
+            echo "Verwijderen van certificaat uit systeem trust store..."
             update-ca-certificates --fresh >/dev/null 2>&1 || true
         fi
+
+        # 2. Clean up Firefox symlink if it points to our policy
+        if [ -L /usr/lib/firefox/distribution/policies.json ]; then
+            rm -f /usr/lib/firefox/distribution/policies.json 2>/dev/null || true
+        fi
+
+        # 3. Remove from NSS databases if certutil is installed
+        if command -v certutil >/dev/null 2>&1; then
+            for user_home in /root $(awk -F: '$3 >= 1000 && $3 < 60000 {print $6}' /etc/passwd 2>/dev/null); do
+                for pki_dir in "$user_home/.pki/nssdb" "$user_home/.local/share/pki/nssdb"; do
+                    if [ -d "$pki_dir" ]; then
+                        certutil -d "sql:$pki_dir" -D -n "$CA_NICKNAME" >/dev/null 2>&1 || true
+                    fi
+                done
+            done
+        fi
     ;;
 esac
 exit 0

sources/bnhmeijer_ca_certificates/packaging/bnhmeijer-ca-certificates/etc/brave/policies/managed/bnhmeijer-ca.json

@@ -0,0 +1,5 @@
+{
+  "CACertificates": [
+    "MIIFZzCCA0+gAwIBAgIRALCvASaMQ9DZPQrGDIYTVkswDQYJKoZIhvcNAQELBQAwTTEiMCAGA1UEAwwZQm5obWVpamVyIEhvbWVsYWIgUm9vdCBDQTEaMBgGA1UECgwRQm5obWVpamVyIEhvbWVsYWIxCzAJBgNVBAYTAk5MMB4XDTI2MTAyMDIwMjQ0OVoXDTM2MTAxNzIwMjQ0OVowTTEiMCAGA1UEAwwZQm5obWVpamVyIEhvbWVsYWIgUm9vdCBDQTEaMBgGA1UECgwRQm5obWVpamVyIEhvbWVsYWIxCzAJBgNVBAYTAk5MMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAuOKEFT0p9uzcxf5hfPyvjFDdFs2GxN3nUNJ+6fzdwR3Bf0yeFYLIHA8C/7hMApt5JGW/ndnYEA7hk0Oj2mbXUo7oj7zIKke5OALBO3SSvJSywwBOsaZ95sSTfkYvmCOLojH/EUmLA6+MmUtSTWMIm1doki2H8BEdXzeE4XtI/Fw8v1kRX0AYA3l4+AB8ejVSHIuhcWgbrwGKkRZFBEAJMXEpIKkYiYPxAZ4AUy4FJHVJwpdK9JLc6ORQS4kpBWJRGROwSePs2hfMn3tSg3xfyOK/c8bOyGTx9O1tjWcfN2cPbGhJ5Uo9j5uyZnAvdkR0mniELB6/G6jM4UzKfmVvQEMtjH76vowFzJmDiKWRJgmq1rEEdSVPDowateLEac5YkGIc9e+/1G3yKQH+eqcHbGvQORnQF03rB5jNWUHdF5WSbMHPszOndMHnUYMrHC025ApIKXcO8R1/ld0DsMRGY4sSwQfRQW5oVOOxQkPMk2LcC4v9Gz/ox9DuAhBXqQUpoXkZ/Zdd2zI2eKLnKuYqkiUvUOUJAUapyztQCCWpxeU9gxTBOrN1g5sSVy3p5lrSWNMQUNXNyOr3ylj3XVQFZxtRWM64tHb8M4UpHYvLG7Bw7m59BgwgEJP686ShnQg/CpE0XpILU+GH8FPL2k8Zl9RBH3jJjLrGEjexiv0KdDcCAwEAAaNCMEAwDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMCAQYwHQYDVR0OBBYEFH1zTZdKh8Q63s5JV5UwrfHB6rAYMA0GCSqGSIb3DQEBCwUAA4ICAQBQmMk725RF2qzN5Me+MuY/N0GdJGNauZ9KvzSybyCIrXfycmidvwU+g1j3nFwVs2FSH3cU6s06jH1Lr0soz74cEmU/Zn94G3Yp8nMh3Nz+qwmJenD1ffF9bTgk2b/jhSRRNU4nDm0HvdfUGLTxgmtAkI45dAmmtynGhKhaFqyxbosxz/PrCqzo6SSrKYx7bHj8Wk2wdB6hDY5UbzOvBVWq8JqZCJiSLNjZNgD64YFUtbBTK3kDCLJhesuf6Qg8UBUL34NqIHfTC5J6G2AlFOLBi6DKBc7rnTlHCCesUUGZqxQy58nCMSlRLKRg3tqQq1Hy839Vb/llmpQDujWDaQ7ptN1bn2ATzdruc+PW2pPv6Ffs3lS7o+69mk5/NDhkqNCM1EYK2hDEkO1jdiyUgmXi0i7ni7Qea3HSK2WYAtHPTIDHAGCzO2Lvfbeq70rfGIf2FJRItIqmS8OjOggGp++ED2d49hvw3Tfxnw108SqYFph2QN/drt8kvcXkMNGQXE7eIqyY5sgI3tJuYpy2r7BWsg0EFwYVphZ0o/SFZTleSTKSxGprNLXKcqxyEYCmZfZLiWRcvTFOkzCqnLQZGJMMdk3Nkq6IwAaZiyRtW6QBHLaIHX/vUX0C3FD+bSuRfZbZGcTmdHVLKAdCOfMp0w/oW5X4vURcjoGJNbd8z0UU0A=="
+  ]
+}

sources/bnhmeijer_ca_certificates/packaging/bnhmeijer-ca-certificates/etc/chromium/policies/managed/bnhmeijer-ca.json

@@ -0,0 +1,5 @@
+{
+  "CACertificates": [
+    "MIIFZzCCA0+gAwIBAgIRALCvASaMQ9DZPQrGDIYTVkswDQYJKoZIhvcNAQELBQAwTTEiMCAGA1UEAwwZQm5obWVpamVyIEhvbWVsYWIgUm9vdCBDQTEaMBgGA1UECgwRQm5obWVpamVyIEhvbWVsYWIxCzAJBgNVBAYTAk5MMB4XDTI2MTAyMDIwMjQ0OVoXDTM2MTAxNzIwMjQ0OVowTTEiMCAGA1UEAwwZQm5obWVpamVyIEhvbWVsYWIgUm9vdCBDQTEaMBgGA1UECgwRQm5obWVpamVyIEhvbWVsYWIxCzAJBgNVBAYTAk5MMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAuOKEFT0p9uzcxf5hfPyvjFDdFs2GxN3nUNJ+6fzdwR3Bf0yeFYLIHA8C/7hMApt5JGW/ndnYEA7hk0Oj2mbXUo7oj7zIKke5OALBO3SSvJSywwBOsaZ95sSTfkYvmCOLojH/EUmLA6+MmUtSTWMIm1doki2H8BEdXzeE4XtI/Fw8v1kRX0AYA3l4+AB8ejVSHIuhcWgbrwGKkRZFBEAJMXEpIKkYiYPxAZ4AUy4FJHVJwpdK9JLc6ORQS4kpBWJRGROwSePs2hfMn3tSg3xfyOK/c8bOyGTx9O1tjWcfN2cPbGhJ5Uo9j5uyZnAvdkR0mniELB6/G6jM4UzKfmVvQEMtjH76vowFzJmDiKWRJgmq1rEEdSVPDowateLEac5YkGIc9e+/1G3yKQH+eqcHbGvQORnQF03rB5jNWUHdF5WSbMHPszOndMHnUYMrHC025ApIKXcO8R1/ld0DsMRGY4sSwQfRQW5oVOOxQkPMk2LcC4v9Gz/ox9DuAhBXqQUpoXkZ/Zdd2zI2eKLnKuYqkiUvUOUJAUapyztQCCWpxeU9gxTBOrN1g5sSVy3p5lrSWNMQUNXNyOr3ylj3XVQFZxtRWM64tHb8M4UpHYvLG7Bw7m59BgwgEJP686ShnQg/CpE0XpILU+GH8FPL2k8Zl9RBH3jJjLrGEjexiv0KdDcCAwEAAaNCMEAwDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMCAQYwHQYDVR0OBBYEFH1zTZdKh8Q63s5JV5UwrfHB6rAYMA0GCSqGSIb3DQEBCwUAA4ICAQBQmMk725RF2qzN5Me+MuY/N0GdJGNauZ9KvzSybyCIrXfycmidvwU+g1j3nFwVs2FSH3cU6s06jH1Lr0soz74cEmU/Zn94G3Yp8nMh3Nz+qwmJenD1ffF9bTgk2b/jhSRRNU4nDm0HvdfUGLTxgmtAkI45dAmmtynGhKhaFqyxbosxz/PrCqzo6SSrKYx7bHj8Wk2wdB6hDY5UbzOvBVWq8JqZCJiSLNjZNgD64YFUtbBTK3kDCLJhesuf6Qg8UBUL34NqIHfTC5J6G2AlFOLBi6DKBc7rnTlHCCesUUGZqxQy58nCMSlRLKRg3tqQq1Hy839Vb/llmpQDujWDaQ7ptN1bn2ATzdruc+PW2pPv6Ffs3lS7o+69mk5/NDhkqNCM1EYK2hDEkO1jdiyUgmXi0i7ni7Qea3HSK2WYAtHPTIDHAGCzO2Lvfbeq70rfGIf2FJRItIqmS8OjOggGp++ED2d49hvw3Tfxnw108SqYFph2QN/drt8kvcXkMNGQXE7eIqyY5sgI3tJuYpy2r7BWsg0EFwYVphZ0o/SFZTleSTKSxGprNLXKcqxyEYCmZfZLiWRcvTFOkzCqnLQZGJMMdk3Nkq6IwAaZiyRtW6QBHLaIHX/vUX0C3FD+bSuRfZbZGcTmdHVLKAdCOfMp0w/oW5X4vURcjoGJNbd8z0UU0A=="
+  ]
+}

sources/bnhmeijer_ca_certificates/packaging/bnhmeijer-ca-certificates/etc/firefox/policies/policies.json

@@ -0,0 +1,10 @@
+{
+  "policies": {
+    "Certificates": {
+      "ImportEnterpriseRoots": true,
+      "Install": [
+        "/usr/local/share/ca-certificates/bnhmeijer/bnhmeijer-root-ca.crt"
+      ]
+    }
+  }
+}

sources/bnhmeijer_ca_certificates/packaging/bnhmeijer-ca-certificates/etc/opt/chrome/policies/managed/bnhmeijer-ca.json

@@ -0,0 +1,5 @@
+{
+  "CACertificates": [
+    "MIIFZzCCA0+gAwIBAgIRALCvASaMQ9DZPQrGDIYTVkswDQYJKoZIhvcNAQELBQAwTTEiMCAGA1UEAwwZQm5obWVpamVyIEhvbWVsYWIgUm9vdCBDQTEaMBgGA1UECgwRQm5obWVpamVyIEhvbWVsYWIxCzAJBgNVBAYTAk5MMB4XDTI2MTAyMDIwMjQ0OVoXDTM2MTAxNzIwMjQ0OVowTTEiMCAGA1UEAwwZQm5obWVpamVyIEhvbWVsYWIgUm9vdCBDQTEaMBgGA1UECgwRQm5obWVpamVyIEhvbWVsYWIxCzAJBgNVBAYTAk5MMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAuOKEFT0p9uzcxf5hfPyvjFDdFs2GxN3nUNJ+6fzdwR3Bf0yeFYLIHA8C/7hMApt5JGW/ndnYEA7hk0Oj2mbXUo7oj7zIKke5OALBO3SSvJSywwBOsaZ95sSTfkYvmCOLojH/EUmLA6+MmUtSTWMIm1doki2H8BEdXzeE4XtI/Fw8v1kRX0AYA3l4+AB8ejVSHIuhcWgbrwGKkRZFBEAJMXEpIKkYiYPxAZ4AUy4FJHVJwpdK9JLc6ORQS4kpBWJRGROwSePs2hfMn3tSg3xfyOK/c8bOyGTx9O1tjWcfN2cPbGhJ5Uo9j5uyZnAvdkR0mniELB6/G6jM4UzKfmVvQEMtjH76vowFzJmDiKWRJgmq1rEEdSVPDowateLEac5YkGIc9e+/1G3yKQH+eqcHbGvQORnQF03rB5jNWUHdF5WSbMHPszOndMHnUYMrHC025ApIKXcO8R1/ld0DsMRGY4sSwQfRQW5oVOOxQkPMk2LcC4v9Gz/ox9DuAhBXqQUpoXkZ/Zdd2zI2eKLnKuYqkiUvUOUJAUapyztQCCWpxeU9gxTBOrN1g5sSVy3p5lrSWNMQUNXNyOr3ylj3XVQFZxtRWM64tHb8M4UpHYvLG7Bw7m59BgwgEJP686ShnQg/CpE0XpILU+GH8FPL2k8Zl9RBH3jJjLrGEjexiv0KdDcCAwEAAaNCMEAwDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMCAQYwHQYDVR0OBBYEFH1zTZdKh8Q63s5JV5UwrfHB6rAYMA0GCSqGSIb3DQEBCwUAA4ICAQBQmMk725RF2qzN5Me+MuY/N0GdJGNauZ9KvzSybyCIrXfycmidvwU+g1j3nFwVs2FSH3cU6s06jH1Lr0soz74cEmU/Zn94G3Yp8nMh3Nz+qwmJenD1ffF9bTgk2b/jhSRRNU4nDm0HvdfUGLTxgmtAkI45dAmmtynGhKhaFqyxbosxz/PrCqzo6SSrKYx7bHj8Wk2wdB6hDY5UbzOvBVWq8JqZCJiSLNjZNgD64YFUtbBTK3kDCLJhesuf6Qg8UBUL34NqIHfTC5J6G2AlFOLBi6DKBc7rnTlHCCesUUGZqxQy58nCMSlRLKRg3tqQq1Hy839Vb/llmpQDujWDaQ7ptN1bn2ATzdruc+PW2pPv6Ffs3lS7o+69mk5/NDhkqNCM1EYK2hDEkO1jdiyUgmXi0i7ni7Qea3HSK2WYAtHPTIDHAGCzO2Lvfbeq70rfGIf2FJRItIqmS8OjOggGp++ED2d49hvw3Tfxnw108SqYFph2QN/drt8kvcXkMNGQXE7eIqyY5sgI3tJuYpy2r7BWsg0EFwYVphZ0o/SFZTleSTKSxGprNLXKcqxyEYCmZfZLiWRcvTFOkzCqnLQZGJMMdk3Nkq6IwAaZiyRtW6QBHLaIHX/vUX0C3FD+bSuRfZbZGcTmdHVLKAdCOfMp0w/oW5X4vURcjoGJNbd8z0UU0A=="
+  ]
+}