From: Eric Abrahamsen <eric@ericabrahamsen.net>
To: John Cummings <john@rootabega.net>
Cc: 50921@debbugs.gnu.org
Subject: bug#50921: GNU ELPA TLS errors: server is returning chain with expired root
Date: Thu, 30 Sep 2021 14:03:02 -0700 [thread overview]
Message-ID: <874ka1ixo9.fsf@ericabrahamsen.net> (raw)
In-Reply-To: <zxxszSz8TTR15gZHkOtEDShNLVI9a65i8d4QnMELDeQsnJ7NbXQ8FgryC9gTS3nsR0_uVoIAvAVUiGbu_S8WxpEknMcj7pEXXbIajVUTzG0=@rootabega.net> (John Cummings's message of "Thu, 30 Sep 2021 20:47:38 +0000")
John Cummings <john@rootabega.net> writes:
> John Cummings <john@rootabega.net> wrote:
>
>> It appears that elpa.gnu.org is returning a certificate chain referring
>> to a root certificate that expired today. (More info:
>> https://twitter.com/letsencrypt/status/1443621997288767491) I don't know
>> if GnuTLS is supposed to be able to work around this (Firefox seems to, for instance)
>
> One possibility (and note here that I'm clearly not a TLS expert) is that
> Firefox recognizes the intermediate cert "ISRG Root X1" as one that is also
> now a trusted root cert, and so short circuits the rest of the chain,
> ignoring the expired cross-signature. Is this something that is possible
> and desirable to have Emacs do with GnuTLS?
Not only that: I deleted the offending line from my ~/.ssh/known_hosts,
re-accepted the key as valid (of course I have no idea), and attempted
to pull, and it asked me for my Savannah password -- ie, did not go to
my local ssh key.
That really made me wonder -- does that mean we've switched machines
altogether, and the new machines don't have our public keys? I don't
know how all these things work well enough to know what's going on, but
it certainly seems broken.
next prev parent reply other threads:[~2021-09-30 21:03 UTC|newest]
Thread overview: 10+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-09-30 20:24 bug#50921: GNU ELPA TLS errors: server is returning chain with expired root John Cummings
2021-09-30 20:47 ` John Cummings
2021-09-30 21:03 ` Eric Abrahamsen [this message]
2021-10-01 5:49 ` Eli Zaretskii
[not found] ` <handler.50921.D50921.16330674029217.notifdone@debbugs.gnu.org>
2021-10-04 15:34 ` Glenn Morris
2021-10-04 19:50 ` Eric Abrahamsen
2021-10-04 21:28 ` Glenn Morris
2021-10-04 21:38 ` Glenn Morris
2021-10-04 21:47 ` Eric Abrahamsen
2021-10-04 20:21 ` John Cummings
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=874ka1ixo9.fsf@ericabrahamsen.net \
--to=eric@ericabrahamsen.net \
--cc=50921@debbugs.gnu.org \
--cc=john@rootabega.net \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
Code repositories for project(s) associated with this external index
https://git.savannah.gnu.org/cgit/emacs.git
https://git.savannah.gnu.org/cgit/emacs/org-mode.git
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.