Unable to update PKI - p11-kit does not support 'extract' command

[Andrey Repin]

Greetings, Ken Brown!

> On 6/1/2022 4:54 AM, Andrey Repin wrote:
>> Greetings, All!
>> > My root CA key expired recently and I'm battling to update my infrastructure.
>> The most unexpected issue so far is a change in Cygwin's p11-kit, that made
>> update-ca-trust script unusable.
>> > Running `p11-kit extract …` immediately fails with code 2 and its manual does
>> not mention `extract` command anywhere.

> $ man p11-kit

> NAME
>         p11-kit - Tool for operating on configured PKCS#11 modules

> SYNOPSIS
>         p11-kit list-modules

>         p11-kit extract ...

> [...]

> EXTRACT
>         Extract certificates from configured PKCS#11 modules.

>         This operation has been moved to a separate command trust extract. See
>         trust(1) for more information

That explains the [2] error code - there's no "trust" command available.
Turned out, my AV ate it.


-- 
With best regards,
Andrey Repin
Saturday, June 4, 2022 15:34:02

Sorry for my terrible english...