ca_root.pem suddenly outside of flashfxp portable directory during upgrade

hi bigstar

im using ffxp portable directory and i remember that during last time i upgrade from 390x to 3905 during the upgrade process i think i left the directory to an upper directory and just let the update process proceed during that time. i dont think this could/would be a problem for flashfxp.exe if it upgrades itself with the liveupdate downloaded latest build .

today i saw that ca_root.pem file (date 13th december 2015) was just outside that directory :

sha1: 3E72EBA0BCA80FCB0022DB227EE9AE257D915D0F
ca_root.pem

inside the ffxp directory there was an older ca_root.pem file dated with 30th november 2015 . i just took the 13th december one and overwrote.

well this file is regularly updated by you regarding root/sub/intermediate CA's i think . is there any internal check of flashfxp.exe to have this file e.g. digitally signed so no MITM could just exchange that file? is this file modified by user itself if adding/removing CA's ? not sure . most of the ssl/tls servers out there use self-signed certitifcates instead of wildcard CN certs from valid/official CAs.

i just wondered why the file is laying outside and wanted to report.

thanks
ben

this is what it looks like , and inside ffxp directory it looks like this :



the checksum is :


sha1: 3E72EBA0BCA80FCB0022DB227EE9AE257D915D0F
ca_root.pem


perhaps you can explain what happenend here,

thanks
ben

Build 3903 was released with some debug code that set the location of the ca_root.pem to d:\temp\ for debugging purposes.

During a code review the mistake was realized and immediately corrected with build 3905.

When FlashFXP starts up it reads the Windows root certificate store to memory, it then compares the copy in memory with the ca_root.pem stored on disk, if they differ then the file on disk is updated, if not then the file on disk doesn't change.

This file is loaded and used by OpenSSL to verify the trust of a x.509 chain during the server connection login.

The windows root certificate store doesn't change very often maybe a couple times year via windows update, perhaps more often if the changes are made by the user.