I needed my script to email admin if there is a problem, and the company only uses Gmail. Following a few posts instructions I was able to set up mailx using a .mailrc file. there was first the error of nss-config-dir I solved that by copying some .db files from a firefox directory. to ./certs and aiming to it in mailrc. A mail was sent.
However, the error above came up. By some miracle, there was a Google certificate in the .db. It showed up with this command:
~]$ certutil -L -d certs Certificate Nickname Trust Attributes SSL,S/MIME,JAR/XPI GeoTrust SSL CA ,, VeriSign Class 3 Secure Server CA - G3 ,, Microsoft Internet Authority ,, VeriSign Class 3 Extended Validation SSL CA ,, Akamai Subordinate CA 3 ,, MSIT Machine Auth CA 2 ,, Google Internet Authority ,,
Most likely, it can be ignored, because the mail worked anyway. Finally, after pulling some hair and many googles, I found out how to rid myself of the annoyance.
First, export the existing certificate to a ASSCII file:
~]$ certutil -L -n 'Google Internet Authority' -d certs -a > google.cert.asc
Now re-import that file, and mark it as a trusted for SSL certificates, ala:
~]$ certutil -A -t "C,," -n 'Google Internet Authority' -d certs -i google.cert.asc
After this, listing shows it trusted:
~]$ certutil -L -d certs Certificate Nickname Trust Attributes SSL,S/MIME,JAR/XPI ... Google Internet Authority C,,
And mailx sends out with no hitch.
~]$ /bin/mailx -A gmail -s "Whadda ya no" email@example.com ho ho ho EOT ~]$
I hope it is helpful to someone looking to be done with the error.
Also, I am curious about somethings.
How could I get this certificate, if it were not in the mozilla database by chance? Is there for instance, something like this?
~]$ certutil -A -t "C,," \ -n 'gmail.com' \ -d certs \ -i 'http://google.com/cert/this...'