[Nook Touch General] nmyshkin:
Part 1 (thanks to a new character limit...)

By now many of you know that the small file on the NST/G which contains web certificates (/system/etc/security/cacerts.bks) is slowly becoming out-of-date. The first important certificate to expire was for Amazon and that crippled the Kindle app until member @tshoulihane worked out a way to update the expired certificate. In 2020, one of the certificates needed to negotiate syncing of books with FBReader expired and I finally took the plunge and figured out how to update the certificate for that. Although @tshoulihane had provided directions in the original post, I was too dense to follow them correctly. Now, as promised, I am providing what I hope is an overly-explicit set of instructions (my specialty) so that anyone can do this, even when I am dead (!).

This guide is for Windows (10, in my case). If you're not using Windows you may be much happier but you'll have to figure this out for yourself. If you are using Windows, you know that we will have to wait for some of that happiness in the next life ;-)

Assembling the tools

jdk-6u45 (download-32 bit, download-64 bit). Oracle now requires a sign-up, etc., to get at these old files, so I have archived them.

bcprov-jdk15on-146.jar (download). This old file is required to make all the magic happen.

Setting up the tools

Install jdk-6u45, using defaults--unless you have some specific reason for changing things. Don't worry if you have other JDK versions installed. They can coexist. Once the JDK is installed, use Windows File Explorer to locate the installation, something like Program Files/Java/jdk1.6.0_45 (that could be Program Files (x86) if you installed the 32-bit version). Find the sub-folder "lib". If there isn't one, create it. Inside that folder create another folder, "ext" (if it doesn't already exist). Place in that folder the jar file you downloaded. So, just to be clear, you should end up with:

(64-bit) Program Files/Java/jdk1.6.0_45/lib/ext/bcprov-jdk15on-146.jar

(32-bit) Program Files (x86)/Java/jdk1.6.0_45/lib/ext/bcprov-jdk15on-146.jar

Looking at cacerts.bks (optional)

If you want to see what the "innards" of your cacerts.bks file looks like copy out /system/etc/security/cacerts.bks from your device to your PC (use some readily accessible directory like "Documents" or "Downloads"--someplace you have rights).

Open a Windows command prompt window. Execute the following:

cd C:\Program Files\Java\jdk1.6.0_45\bin

[for 32-bit: cd C:\Program Files (x86)\Java\jdk1.6.0_45\bin]

Windows 10 allows you to paste text into the command prompt window. I suggest you copy the following command to a text editor, adjust it to your situation, and paste into the command prompt window. Then hit Enter. The text is perilous to type and you can get very frustrated by small errors.

keytool.exe -keystore C:\Users\nmyshkin\Documents\cacerts.bks -storetype BKS -provider org.bouncycastle.jce.provider.BouncyCastleProvider -providerpath "C:\Program Files\Java\jdk1.6.0_45\lib\ext\bcprov-jdk15on-146.jar" -storepass changeit -v -list > C:\Users\nmyshkin\Documents\calist.txt

Note that a path which contains spaces requires the use of quotation marks or you will get an error. You would need to replace "nmyshkin\Documents" with whatever path is correct for you.

The resulting text file (calist.txt) contains a list of all of the certificates and information about them, including their expiration dates.

Housekeeping

Some time ago I came across a Honeycomb ROM (last stop before ICS and cacerts which update on the fly) and extracted its cacerts.bks file, reasoning that it would be more up-to-date than our version. This proved to be true (the Amazon certificate, for example, has not yet expired), and there were also many more certificates--not a bad thing. There were also a lot of dead certificates. So for a sort of baseline, I have attached a zipped copy of that file with all the dead stuff removed. It also has a functioning Amazon certificate and the update for FBReader book sync. You're welcome.

The good stuff follows in the next post...