[Nook Touch General] nmyshkin:
Part 2

How do you remove dead certificates?

Note: ALWAYS keep a backup copy of your cacerts.bks file. If you mess up, you need to be able to go back. Also, before returning an updated cacerts.bks file to your device, you should have made a complete device backup. A faulty cacerts.bks file will cause a bootloop. The only recovery is a forced shutdown (not easy in itself) and a restoration of the nandroid backup with NookManager or similar.

Let's pretend that you have a dead certificate and a check of the calist.txt file created as described above reveals that its "alias" is 27. Certificates sometimes have ridiculously complicated names so in the cacerts.bks file they are often given numerical aliases. Here's how to get rid of one (presumably before you replace it):

Open a command prompt window and execute the following:

cd C:\Program Files\Java\jdk1.6.0_45\bin

[for 32-bit: cd C:\Program Files (x86)\Java\jdk1.6.0_45\bin]

Copy the text below and adjust the paths for your situation, then copy and paste the result into the command prompt window. Press Enter.

keytool.exe -keystore C:\Users\nmyshkin\Documents\cacerts.bks -storetype BKS -provider org.bouncycastle.jce.provider.BouncyCastleProvider -providerpath "C:\Program Files\Java\jdk1.6.0_45\lib\ext\bcprov-jdk15on-146.jar" -storepass changeit -v -delete -alias 27

You would need to replace "nmyshkin\Documents", the alias number, and potentially "Program Files" (if you are using 32 bit) to customize the command.

Importing/updating a certificate

Well, this is the "real deal". Someday that Amazon certificate is going to expire again and render the Kindle app useless (assuming Amazon doesn't abandon it first). Or something else may crop up that you'd like to fix (like the FBReader issue I mentioned earlier). To some extent, this may also address website access issues, but most--if not all--of those are more broadly SSL related and that is another kettle of fish altogether.

Importing a certificate is no more difficult than any of the other operations already described (once you have the command written out!). The difficulty is in obtaining the certificate to import! Here is where these instructions get a little squishy because they are initially based on information obtained from your PC's browser (and even its version). I happen to use an up-to-date version of Firefox so that's how I am approaching this. If you use a different browser, you will have to figure out this part on your own, but Googling will doubtless help.

Let's say the Amazon certificate has expired (again...). My first best guess is that the same certificate(s) used on Amazon.com are used for the Kindle app. So I head on over to Amazon.com with Firefox. When I arrive I note that there is a little "lock" symbol just before the "https:...." in the url line. Mousing over this symbol I see "Verfied by: DigiCert Inc." So it's some kind of DigiCert certificate. Clicking on the lock symbol I see site information for Amazon including "Connection Secure" which can be expanded to show "Verified by DigiCert Inc." and at the bottom of that little window is "More information". Clicking there gives me a lot more stuff, but what I want is just the "Security" tab where I can see "View Certificate". Aha! Clicking on that reveals that there are at least two certificates, DigiCert Global CA G2 and DigiCert Global Root G2. I may need only one, but it's safer to have both. Still, I need actual copies of the certificates. In an older version of Firefox you could click on the lock and get to a place where you could export copies of the certificates. No more. That was too easy. Now it's like this:

1. Navigate to the site (Amazon.com) and discover which certificates are used, as described above

2. Open the browser menu to access "Options"

3. Click on "Privacy and Security" in the left-hand menu

4. Scroll down to "Certificates"

5. This takes you to a window in which you want the last option, "Authorities"

5. Scroll to find the certificate(s) discovered by the steps described above.

6. Click on the certificate and then on "Export". Accept the default file type (X.509 Certificate (PEM) (*.crt;*.pem)) and the ".crt" extension. Save.

7. Change the file extension on the saved certificate to ".cer".

OK! Do this for whatever certificate(s) you need. Now it's time to get them into the cacerts.bks file. Make sure the saved certificates are in some directory on your PC for which you have rights (like "Documents" or "Downloads").

Open a command prompt window and execute the following:

cd C:\Program Files\Java\jdk1.6.0_45\bin

[for 32-bit: cd C:\Program Files (x86)\Java\jdk1.6.0_45\bin]

Copy the text below and adjust the paths for your situation, then copy and paste the result into the command prompt window. Press Enter.

keytool.exe -storetype BKS -keystore "C:\Users\nmyshkin\Documents\cacerts.bks" -provider org.bouncycastle.jce.provider.BouncyCastleProvider -providerpath "C:\Program Files\Java\jdk1.6.0_45\lib\ext\bcprov-jdk15on-146.jar" -storepass changeit -importcert -alias Amazon -file "C:\Users\nmyshkin\Documents\DigiCertGlobalRootG2.cer"

You would need to replace "nmyshkin\Documents", potentially "Program Files", the alias string or number as well as the certificate file name to customize. The "alias" is a number in our cacerts.bks file, but you can use a string instead. Otherwise, you need to choose a number that is not already used or use the same number(s) for the expired certificate(s) that you previously removed.

You will see a series of things scroll through the window, stopping at a confirmation dialog. You need to enter "yes" to accept the certificate.

Repeat if there are additional certificates to import/update.

The Proof in the Pudding

IF you have done these steps correctly, you should be good to go. You need to move the revised cacerts.bks file back to your NST/G (/system/etc/security/cacerts.bks). Be sure the file permissions are set to rw-r--r--, then reboot. If you get stuck in a bootloop you goofed. Try to interrupt the boot sequence with the power button. Eventually you will succeed and can restore a backup using something like NookManager. Try again :)