p11-kit-0.25.10

Installation of p11-kit

Prepare the distribution specific anchor hook:

sed '20,$ d' -i trust/trust-extract-compat &&

cat >> trust/trust-extract-compat << "EOF"
# Copy existing anchor modifications to /etc/ssl/local
/usr/libexec/make-ca/copy-trust-modifications

# Update trust stores
/usr/sbin/make-ca -r
EOF

Configure p11-kit by running the following commands:

meson setup p11-build     \
      --prefix=/usr       \
      --buildtype=release \
      -D trust_paths=/etc/pki/anchors

Now Compile p11-kit by running the following commands:

ninja -C p11-build

To test the results, issue:

ninja -C p11-build test

Now, Install p11-kit by running the following:

ninja -C p11-build install
ln -sfv /usr/libexec/p11-kit/trust-extract-compat \
        /usr/bin/update-ca-certificates
ln -sfv ./pkcs11/p11-kit-trust.so /usr/lib/libnssckbi.so

Note

The p11-kit trust module (/usr/lib/pkcs11/p11-kit-trust.so) can be used as a drop-in replacement for /usr/lib/libnssckbi.so to transparently make the system CAs available to NSS aware applications, rather than the static list provided by /usr/lib/libnssckbi.so.