I am getting this error in terminal on start for a long time and I wonder if maybe it's causing me some problems when trying to access some https: places whose certificates are blamed as "risky" :/ $ google-chrome-stable [2915:2944:1021/130821:ERROR:nss_util.cc(853)] After loading Root Certs, loaded==false: NSS error code: -8018 I don't know if there is a way for making the error a bit more verbose, but that error is shown every time I simply launch google-chrome $ emerge --info google-chrome Portage 2.2.20.1 (python 2.7.10-final-0, default/linux/amd64/13.0/desktop/gnome/systemd, gcc-4.9.3, glibc-2.20-r2, 4.0.5-gentoo x86_64) ================================================================= System Settings ================================================================= System uname: Linux-4.0.5-gentoo-x86_64-Intel-R-_Core-TM-2_Duo_CPU_E7500_@_2.93GHz-with-gentoo-2.2 KiB Mem: 3916424 total, 174588 free KiB Swap: 4194300 total, 4143856 free Timestamp of repository gentoo: Fri, 16 Oct 2015 14:30:01 +0000 sh bash 4.3_p39 ld GNU ld (Gentoo 2.25.1 p1.1) 2.25.1 ccache version 3.1.9 [enabled] app-shells/bash: 4.3_p39::gentoo dev-java/java-config: 2.2.0::gentoo dev-lang/perl: 5.20.2::gentoo dev-lang/python: 2.7.10::gentoo, 3.4.3::gentoo dev-util/ccache: 3.1.9-r4::gentoo dev-util/cmake: 3.3.1-r1::gentoo dev-util/pkgconfig: 0.28-r2::gentoo sys-apps/baselayout: 2.2::gentoo sys-apps/openrc: 0.17::gentoo sys-apps/sandbox: 2.6-r1::gentoo sys-devel/autoconf: 2.13::gentoo, 2.69::gentoo sys-devel/automake: 1.11.6-r1::gentoo, 1.14.1::gentoo, 1.15::gentoo sys-devel/binutils: 2.25.1-r1::gentoo sys-devel/gcc: 4.9.3::gentoo sys-devel/gcc-config: 1.7.3::gentoo sys-devel/libtool: 2.4.6::gentoo sys-devel/make: 4.1-r1::gentoo sys-kernel/linux-headers: 3.18::gentoo (virtual/os-headers) sys-libs/glibc: 2.20-r2::gentoo Repositories: gentoo location: /usr/portage sync-type: rsync sync-uri: rsync://rsync.gentoo.org/gentoo-portage priority: -1000 vmware location: /usr/portage/local/layman/vmware masters: gentoo priority: 0 science location: /usr/portage/local/layman/science masters: gentoo priority: 1 x-portage location: /usr/local/portage masters: gentoo priority: 2 ACCEPT_KEYWORDS="amd64" ACCEPT_LICENSE="*" CBUILD="x86_64-pc-linux-gnu" CFLAGS="-O2 -pipe -march=native -fno-stack-protector" CHOST="x86_64-pc-linux-gnu" CONFIG_PROTECT="/etc /usr/lib64/libreoffice/program/sofficerc /usr/share/config /usr/share/gnupg/qualified.txt" CONFIG_PROTECT_MASK="/etc/ca-certificates.conf /etc/dconf /etc/env.d /etc/fonts/fonts.conf /etc/gconf /etc/gentoo-release /etc/revdep-rebuild /etc/sandbox.d /etc/terminfo /etc/texmf/language.dat.d /etc/texmf/language.def.d /etc/texmf/updmap.d /etc/texmf/web2c" CXXFLAGS="-O2 -pipe -march=native -fno-stack-protector" DISTDIR="/usr/distfiles" EMERGE_DEFAULT_OPTS="--quiet-build=n --autounmask-write --keep-going" FCFLAGS="-O2 -pipe" FEATURES="assume-digests binpkg-logs ccache config-protect-if-modified distlocks ebuild-locks fixlafiles merge-sync news parallel-fetch preserve-libs protect-owned sandbox sfperms split-log strict unknown-features-warn unmerge-logs unmerge-orphans userfetch userpriv usersandbox usersync xattr" FFLAGS="-O2 -pipe" GENTOO_MIRRORS="http://ftp.heanet.ie/pub/gentoo/" LANG="es_ES.utf8" LDFLAGS="-Wl,-O1 -Wl,--as-needed" MAKEOPTS="-j3" PKGDIR="/usr/local/portage/packages" PORTAGE_CONFIGROOT="/" PORTAGE_RSYNC_OPTS="--recursive --links --safe-links --perms --times --omit-dir-times --compress --force --whole-file --delete --stats --human-readable --timeout=180 --exclude=/distfiles --exclude=/local --exclude=/packages" PORTAGE_TMPDIR="/var/tmp" USE="X a52 aac acl acpi alsa amd64 applet avahi bash-completion berkdb branding bzip2 cairo ccache cdda cddb cdr cli colord cracklib crypt cups cvs cxx dbus djvu dri dts dvd dvdr dvi eds emboss enchant encode evo exif fam fat ffmpeg firefox flac fortran fuse gdbm gif glamor gnome gnome-keyring gnome-online-accounts gphoto2 gpm gstreamer gtk gtk3 gtkstyle gui hfs http iconv infinality introspection irc jabber jpeg kpathsea latex lcms ldap libnotify libsecret libvisual lyx mad mms mmx mmxext mng modules monolithic-build mp3 mp4 mpeg multilib musicbrainz nautilus ncurses network-cron networkmanager nls nptl ntfs numa ogg opengl openmp optimized-qmake pam pango pch pdf png policykit ppds pulseaudio qt3support qt4 readline reiserfs scanner sdl seccomp session smp spell sse sse2 ssl startup-notification svg systemd t1lib tcpd theora threads tiff tracker truetype udev udisks unicode upnp upnp-av upower usb v4l vaapi vala vcd vdpau vorbis wifi wxwidgets x264 xattr xcb xfs xml xv xvid youtube zeroconf zlib" ABI_X86="64" ALSA_CARDS="hda-intel" APACHE2_MODULES="authn_core authz_core socache_shmcb unixd actions alias auth_basic authn_alias authn_anon authn_dbm authn_default authn_file authz_dbm authz_default authz_groupfile authz_host authz_owner authz_user autoindex cache cgi cgid dav dav_fs dav_lock deflate dir disk_cache env expires ext_filter file_cache filter headers include info log_config logio mem_cache mime mime_magic negotiation rewrite setenvif speling status unique_id userdir usertrack vhost_alias" CALLIGRA_FEATURES="kexi words flow plan sheets stage tables krita karbon braindump author" CAMERAS="ptp2" COLLECTD_PLUGINS="df interface irq load memory rrdtool swap syslog" CPU_FLAGS_X86="mmx mmxext sse sse2 sse3 sse4_1 ssse3" ELIBC="glibc" GPSD_PROTOCOLS="ashtech aivdm earthmate evermore fv18 garmin garmintxt gpsclock itrax mtk3301 nmea ntrip navcom oceanserver oldstyle oncore rtcm104v2 rtcm104v3 sirf superstar2 timing tsip tripmate tnt ublox ubx" INPUT_DEVICES="evdev" KERNEL="linux" LCD_DEVICES="bayrad cfontz cfontz633 glk hd44780 lb216 lcdm001 mtxorb ncurses text" LIBREOFFICE_EXTENSIONS="presenter-console presenter-minimizer" LINGUAS="es es_ES en_US" OFFICE_IMPLEMENTATION="libreoffice" PHP_TARGETS="php5-5" PYTHON_SINGLE_TARGET="python2_7" PYTHON_TARGETS="python2_7 python3_4" RUBY_TARGETS="ruby20 ruby21" USERLAND="GNU" VIDEO_CARDS="fbdev vesa radeon" XTABLES_ADDONS="quota2 psd pknock lscan length2 ipv4options ipset ipp2p iface geoip fuzzy condition tee tarpit sysrq steal rawnat logmark ipmark dhcpmac delude chaos account" Unset: CC, CPPFLAGS, CTARGET, CXX, INSTALL_MASK, LC_ALL, PORTAGE_BUNZIP2_COMMAND, PORTAGE_COMPRESS, PORTAGE_COMPRESS_FLAGS, PORTAGE_RSYNC_EXTRA_OPTS, USE_PYTHON ================================================================= Package Settings ================================================================= www-client/google-chrome-46.0.2490.71_p1::gentoo was built with the following: USE="plugins" ABI_X86="64" LINGUAS="es -am -ar -bg -bn -ca -cs -da -de -el -en_GB -es_LA -et -fa -fi -fil -fr -gu -he -hi -hr -hu -id -it -ja -kn -ko -lt -lv -ml -mr -ms -nb -nl -pl -pt_BR -pt_PT -ro -ru -sk -sl -sr -sv -sw -ta -te -th -tr -uk -vi -zh_CN -zh_TW"
This looks like a more general error as I also see evolution warning about the same: feb 20 13:49:19 belkin5 evolution.desktop[13860]: [13736:13877:0220/134919:ERROR:nss_util.cc(837)] After loading Root Certs, loaded==false: NSS error Is nss_util.cc belonging to nss? (I have nss-3.21-r2)
I get the same thing and chrome lags on start this helps but it's not perfect google-chrome-stable --password-store=basic
NSS error code -8018 is SEC_ERROR_UNKNOWN_PKCS11_ERROR. I'm not sure what that means. https://hg.mozilla.org/projects/nss/file/tip/lib/util/secerr.h#l203 However, I doubt it is causing sites to be erroneously flagged as "risky".
Thanks for the posts. Same problem here on a machine not updated since January. Downgraded to nss-3.20.1 and Google sites are working again.
It's the same with chromium-51.0.2704.63
www-client/chromium-53.0.2785.34 and www-client/google-chrome-52.0.2743.116 don't seem to be recognizing revoked certs as revoked, could this be related? I try the "Revoked" links in the "Test URL" column here: https://www.amazontrust.com/repository/ , every broswer I can find except chromium/google-chrome show the certs as revoked
(In reply to Ben Kohler from comment #6) They don't show up as revoked in Chrome on Windows either. http://www.computerworld.com/article/2501274/desktop-apps/google-chrome-will-no-longer-check-for-revoked-ssl-certificates-online.html
Re-open if this still happens.
Yeah, it still happens :/ $ google-chrome-stable [451899:451899:0714/212056.957680:ERROR:sandbox_linux.cc(374)] InitializeSandbox() called with multiple threads in process gpu-process. [451901:451905:0714/212058.196134:ERROR:nss_util.cc(283)] After loading Root Certs, loaded==false: NSS error code: -8018
I can't reproduce this issue on my dev workstation. Since it's been a week or so, are you still seeing this issue? Based on the source code[1], this is just reporting an error _from_ NSS; there's not much we can do about it within the package space. NSS does not like something that it's finding. Mozilla have some helpful docs[2] which suggest that `-8018` is `SEC_ERROR_UNKNOWN_PKCS11_ERROR`. Since it _seems_ to be trying to load Root Certs but failing, is there anything unusual in your local trust store? I don't think that there's much that we can do here on the Chromium side. This is Chrom{e,ium} behaving as designed: if NSS errors output the error code. Mozilla team, any thoughts? 1: https://chromium.googlesource.com/chromium/src/crypto/+/refs/heads/main/nss_util.cc#344 2: https://mozilla.github.io/python-nss-docs/nss.error-module.html
