On Thu, Dec 03, 2020 at 04:57:53PM -0600, Bob Willcox wrote:
> I am trying to upgrade a 12.1-stable system installed back in July to
> 12.2-stable.
> I downloaded the new ports hierarchy and now when I attempt to run 'make
> fetchindex'
> I get these errors:
>
> /usr/bin/env fetch -am -o /usr/ports/INDEX-12.bz2
> https://www.FreeBSD.org/ports/INDEX-12.bz2
> Certificate verification failed for /C=US/O=Let's Encrypt/CN=Let's Encrypt
> Authority X3
> 546533376:error:1416F086:SSL
> routines:tls_process_server_certificate:certificate verify
> failed:/usr/src/crypto/openssl/ssl/statem/statem_clnt.c:1915:
> fetch: https://www.FreeBSD.org/ports/INDEX-12.bz2: Authentication error
> Certificate verification failed for /C=US/O=Let's Encrypt/CN=Let's Encrypt
> Authority X3
> 546533376:error:1416F086:SSL
> routines:tls_process_server_certificate:certificate verify
> failed:/usr/src/crypto/openssl/ssl/statem/statem_clnt.c:1915:
>
> Can someone help?
Can you run the command by hand? I can, although I'm using:
12.2-RELEASE-p1 r368257+2ab1386b6891(releng/12.2).
I seem to recall some work on the certificate repository pre 12.2-RELEASE, so
you might be stuck in a weird spot.
If I do this little bit of uglyness, we can see some details:
openssl s_client -showcerts -connect www.freebsd.org:https < /dev/null
| \
perl -ne '(/-BEGIN CERTIFICATE-/../-END
CERTIFICATE-/) && print' | \
while read LINE;
do
case "$LINE" in
"-BEGIN CERTIFICATE-") CERT="$LINE";;
"-END CERTIFICATE-")echo -e "$CERT\n$LINE" |
openssl x509 -text -noout;;
*) CERT="$CERT\n$LINE";;
esac
done | \
grep -E '^Certificate:|Not|Issuer:|Subject:'
depth=1 C = US, O = Let's Encrypt, CN = Let's Encrypt Authority X3
verify return:1
depth=0 CN = www.freebsd.org
verify return:1
DONE
Certificate:
Issuer: C = US, O = Let's Encrypt, CN = Let's Encrypt Authority
X3
Not Before: Oct 17 20:36:10 2020 GMT
Not After : Jan 15 20:36:10 2021 GMT
Subject: CN = www.freebsd.org
Certificate:
Issuer: O = Digital Signature Trust Co., CN = DST Root CA X3
Not Before: Mar 17 16:40:46 2016 GMT
Not After : Mar 17 16:40:46 2021 GMT
Subject: C = US, O = Let's Encrypt, CN = Let's Encrypt
Authority X3
So, do you have the glue for the current Let's Encrypt root in your store?
As I recall, that had some intermediate cross-signing stuff expire recently.
Doesn't seem like it would be an issue here.
openssl x509 -text < /usr/share/certs/trusted/DST_Root_CA_X3.pem | \
grep -E '^Certificate:|Not|Issuer:|Subject:'
Certificate:
Issuer: O = Digital Signature Trust Co., CN = DST Root CA X3
Not Before: Sep 30 21:12:19 2000 GMT
Not After : Sep 30 14:01:15 2021 GMT
Subject: O = Digital Signature Trust Co., CN = DST Root CA X3
As a one-off, fetch has the --no-verify-hostname and --no-verify-peer options,
but you'll probably want to update your system past a bad store since there
are probably a bunch of Let's Encrypt certs out there these days.
___
freebsd-stable@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/freebsd-stable
To unsubscribe, send any mail to "freebsd-stable-unsubscr...@freebsd.org"
