all messages for Guix-related lists mirrored at yhetil.org
 help / color / mirror / code / Atom feed
From: Tobias Geerinckx-Rice <me@tobias.gr>
To: Giovanni Biscuolo <g@xelera.eu>
Cc: help-guix@gnu.org
Subject: Re: curl server certificate verification failed for a few sites
Date: Sat, 06 Jun 2020 16:29:26 +0200	[thread overview]
Message-ID: <87img49sjd.fsf@nckx> (raw)
In-Reply-To: <87tuzok0zk.fsf@roquette.i-did-not-set--mail-host-address--so-tickle-me>

[-- Attachment #1: Type: text/plain, Size: 1513 bytes --]

Giovanni,

Giovanni Biscuolo 写道:
> ...and sorry again to all other Guix users for the "noise": this 
> is not
> strictly related to Guix but just to the most recent version of
> curl/wget

Don't be.  It was a legitimate bug in a Guix package.  Thanks to 
Marius for the quick fix, by the way!

> I still I don't understand the differences between curl (and 
> wget)
> behaviour and the last Guix available ungoogled-chromium (see 
> below).

The expiration of the Sectigo root triggered a dormant bug in 
GnuTLS.  Users of other crypto libraries were unaffected.

> I guess that this information, client side, is the same for all 
> browsers
> and CLI interfaces (like curl) since long ago: right?

Yes.  Including GnuTLS.  It had the right data but drew the wrong 
conclusion from it.

> It seems that ungoogled-chromium stops the verification at the 
> level=1 certificate:

As your browser and SSLLabs knew, there *was* a valid chain (two, 
even) and GnuTLS should have returned success.  Instead it 
reported failure because there was *also* an invalid expired one.

At the risk of being flamed for oversimplifying: paranoid GnuTLS 
was using AND where it should have used OR.

Here's the actual bug report: 
<https://gitlab.com/gnutls/gnutls/-/issues/1008>.

(I think the server's still sending too many intermediates, but at 
least now all clients will correctly ignore them.  They'll just 
waste some bandwidth on every handshake.)

Kind regards,

T G-R

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 227 bytes --]

      parent reply	other threads:[~2020-06-06 14:29 UTC|newest]

Thread overview: 8+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2020-06-04 13:13 curl server certificate verification failed for a few sites Giovanni Biscuolo
2020-06-04 14:40 ` Jack Hill
2020-06-04 16:14   ` Giovanni Biscuolo
2020-06-04 16:43     ` Tobias Geerinckx-Rice
2020-06-06  9:16       ` Giovanni Biscuolo
2020-06-06 13:44         ` Marius Bakke
2020-06-08 17:52           ` Giovanni Biscuolo
2020-06-06 14:29         ` Tobias Geerinckx-Rice [this message]

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=87img49sjd.fsf@nckx \
    --to=me@tobias.gr \
    --cc=g@xelera.eu \
    --cc=help-guix@gnu.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
Code repositories for project(s) associated with this external index

	https://git.savannah.gnu.org/cgit/guix.git

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.