>From upgrade log:
Paramétrage de libglib2.0-0:i386 (2.29.92-0ubuntu1) ...
Paramétrage de ca-certificates (20110502+nmu1ubuntu3) ...
Clearing symlinks in /etc/ssl/certs...done.
Updating certificates in /etc/ssl/certs... WARNING: Skipping duplicate
certificate UbuntuOne-Go_Daddy_Class_2_CA.pem
WARNING: Skipping duplicate certificate UbuntuOne-Go_Daddy_Class_2_CA.pem
WARNING: Skipping duplicate certificate IGC_A.pem
WARNING: Skipping duplicate certificate IGC_A.pem
155 added, 0 removed; done.
Running hooks in /etc/ca-certificates/update.d....
Replacing debian:brasil.gov.br.pem
Replacing debian:cacert.org.pem
Replacing debian:ca.pem
Replacing debian:cert_igca_dsa.pem
Replacing debian:cert_igca_rsa.pem
Replacing debian:AOL_Time_Warner_Root_Certification_Authority_1.pem
Replacing debian:AOL_Time_Warner_Root_Certification_Authority_2.pem
Replacing debian:AddTrust_External_Root.pem
Replacing debian:AddTrust_Low-Value_Services_Root.pem
Replacing debian:AddTrust_Public_Services_Root.pem
Replacing debian:AddTrust_Qualified_Certificates_Root.pem
Replacing debian:America_Online_Root_Certification_Authority_1.pem
Replacing debian:America_Online_Root_Certification_Authority_2.pem
Replacing debian:Baltimore_CyberTrust_Root.pem
Replacing debian:COMODO_Certification_Authority.pem
Replacing debian:Camerfirma_Chambers_of_Commerce_Root.pem
Replacing debian:Camerfirma_Global_Chambersign_Root.pem
Replacing debian:Certplus_Class_2_Primary_CA.pem
Replacing debian:Certum_Root_CA.pem
Replacing debian:Comodo_AAA_Services_root.pem
Replacing debian:Comodo_Secure_Services_root.pem
Replacing debian:Comodo_Trusted_Services_root.pem
Replacing debian:DST_ACES_CA_X6.pem
Replacing debian:DST_Root_CA_X3.pem
Replacing debian:DigiCert_Assured_ID_Root_CA.pem
Replacing debian:DigiCert_Global_Root_CA.pem
Replacing debian:DigiCert_High_Assurance_EV_Root_CA.pem
Replacing debian:Digital_Signature_Trust_Co._Global_CA_1.pem
Replacing debian:Digital_Signature_Trust_Co._Global_CA_3.pem
Replacing debian:Entrust.net_Premium_2048_Secure_Server_CA.pem
Replacing debian:Entrust.net_Secure_Server_CA.pem
Replacing debian:Entrust_Root_Certification_Authority.pem
Replacing debian:Equifax_Secure_CA.pem
Replacing debian:Equifax_Secure_eBusiness_CA_1.pem
Replacing debian:Equifax_Secure_eBusiness_CA_2.pem
Replacing debian:Firmaprofesional_Root_CA.pem
Replacing debian:GTE_CyberTrust_Global_Root.pem
Replacing debian:GeoTrust_Global_CA.pem
Replacing debian:GeoTrust_Global_CA_2.pem
Replacing debian:GeoTrust_Primary_Certification_Authority.pem
Replacing debian:GeoTrust_Universal_CA.pem
Replacing debian:GeoTrust_Universal_CA_2.pem
Replacing debian:GlobalSign_Root_CA.pem
Replacing debian:GlobalSign_Root_CA_-_R2.pem
Replacing debian:Go_Daddy_Class_2_CA.pem
Replacing debian:NetLock_Business_=Class_B=_Root.pem
Replacing debian:NetLock_Express_=Class_C=_Root.pem
Replacing debian:NetLock_Notary_=Class_A=_Root.pem
Replacing debian:NetLock_Qualified_=Class_QA=_Root.pem
Replacing debian:QuoVadis_Root_CA.pem
Replacing debian:QuoVadis_Root_CA_2.pem
Replacing debian:QuoVadis_Root_CA_3.pem
Replacing debian:RSA_Root_Certificate_1.pem
Replacing debian:RSA_Security_2048_v3.pem
Replacing debian:SecureTrust_CA.pem
Replacing debian:Secure_Global_CA.pem
Replacing debian:Security_Communication_Root_CA.pem
Replacing debian:Sonera_Class_1_Root_CA.pem
Replacing debian:Sonera_Class_2_Root_CA.pem
Replacing debian:Staat_der_Nederlanden_Root_CA.pem
Replacing debian:Starfield_Class_2_CA.pem
Replacing debian:StartCom_Certification_Authority.pem
Replacing debian:SwissSign_Gold_CA_-_G2.pem
Replacing debian:SwissSign_Platinum_CA_-_G2.pem
Replacing debian:SwissSign_Silver_CA_-_G2.pem
Replacing debian:Swisscom_Root_CA_1.pem
Replacing debian:TC_TrustCenter__Germany__Class_2_CA.pem
Replacing debian:TC_TrustCenter__Germany__Class_3_CA.pem
Replacing debian:TDC_Internet_Root_CA.pem
Replacing debian:TDC_OCES_Root_CA.pem
Replacing debian:TURKTRUST_Certificate_Services_Provider_Root_1.pem
Replacing debian:TURKTRUST_Certificate_Services_Provider_Root_2.pem
Replacing debian:Taiwan_GRCA.pem
Replacing debian:Thawte_Personal_Freemail_CA.pem
Replacing debian:Thawte_Premium_Server_CA.pem
Replacing debian:Thawte_Server_CA.pem
Replacing debian:Thawte_Time_Stamping_CA.pem
Replacing debian:UTN_DATACorp_SGC_Root_CA.pem
Replacing debian:UTN_USERFirst_Email_Root_CA.pem
Replacing debian:UTN_USERFirst_Hardware_Root_CA.pem
Replacing debian:ValiCert_Class_1_VA.pem
Replacing debian:ValiCert_Class_2_VA.pem
Replacing
debian:VeriSign_Class_3_Public_Primary_Certification_Authority_-_G5.pem
Replacing debian:Verisign_Class_1_Public_Primary_Certification_Authority.pem
Replacing
debian:Verisign_Class_1_Public_Primary_Certification_Authority_-_G2.pem
Replacing
debian:Verisign_Class_1_Public_Primary_Certification_Authority_-_G3.pem
Replacing debian:Verisign_Class_2_Public_Primary_Certification_Authority.pem
Replacing
debian:Verisign_Class_2_Public_Primary_Certification_Authority_-_G2.pem
Replacing
debian:Verisign_Class_2_Public_Primary_Certification_Authority_-_G3.pem
Replacing debian:Verisign_Class_3_Public_Primary_Certification_Authority.pem
Replacing
debian:Verisign_Class_3_Public_Primary_Certification_Authority_-_G2.pem
Replacing
debian:Verisign_Class_3_Public_Primary_Certification_Authority_-_G3.pem
Replacing
debian:Verisign_Class_4_Public_Primary_Certification_Authority_-_G2.pem
Replacing
debian:Verisign_Class_4_Public_Primary_Certification_Authority_-_G3.pem
Replacing debian:Visa_eCommerce_Root.pem
Replacing debian:Wells_Fargo_Root_CA.pem
Replacing debian:XRamp_Global_CA_Root.pem
Replacing debian:thawte_Primary_Root_CA.pem
Replacing debian:signet_ca1_pem.pem
Replacing debian:signet_ca2_pem.pem
Replacing debian:signet_ca3_pem.pem
Replacing debian:signet_ocspklasa2_pem.pem
Replacing debian:signet_ocspklasa3_pem.pem
Replacing debian:signet_pca2_pem.pem
Replacing debian:signet_pca3_pem.pem
Replacing debian:signet_rootca_pem.pem
Replacing debian:signet_tsa1_pem.pem
Replacing debian:spi-ca-2003.pem
Replacing debian:spi-cacert-2008.pem
Replacing debian:COMODO_ECC_Certification_Authority.pem
Replacing debian:Network_Solutions_Certificate_Authority.pem
Replacing debian:WellsSecure_Public_Root_Certificate_Authority.pem
Replacing debian:ACEDICOM_Root.pem
Replacing debian:AC_Raíz_Certicámara_S.A..pem
Replacing debian:ApplicationCA_-_Japanese_Government.pem
Replacing debian:Autoridad_de_Certificacion_Firmaprofesional_CIF_A62634068.pem
Replacing debian:Buypass_Class_2_CA_1.pem
Replacing debian:Buypass_Class_3_CA_1.pem
Replacing debian:CA_Disig.pem
Replacing debian:Certigna.pem
Replacing debian:certSIGN_ROOT_CA.pem
Replacing debian:Chambers_of_Commerce_Root_-_2008.pem
Replacing debian:CNNIC_ROOT.pem
Replacing debian:ComSign_CA.pem
Replacing debian:ComSign_Secured_CA.pem
Replacing debian:Cybertrust_Global_Root.pem
Replacing debian:Deutsche_Telekom_Root_CA_2.pem
Replacing debian:EBG_Elektronik_Sertifika_Hizmet_Sağlayıcısı.pem
Replacing debian:E-Guven_Kok_Elektronik_Sertifika_Hizmet_Saglayicisi.pem
Replacing debian:ePKI_Root_Certification_Authority.pem
Replacing debian:GeoTrust_Primary_Certification_Authority_-_G2.pem
Replacing debian:GeoTrust_Primary_Certification_Authority_-_G3.pem
Replacing debian:Global_Chambersign_Root_-_2008.pem
Replacing debian:GlobalSign_Root_CA_-_R3.pem
Replacing debian:Hongkong_Post_Root_CA_1.pem
Replacing debian:IGC_A.pem
Replacing debian:Izenpe.com.pem
Replacing debian:Juur-SK.pem
Replacing debian:Microsec_e-Szigno_Root_CA_2009.pem
Replacing debian:Microsec_e-Szigno_Root_CA.pem
Replacing debian:NetLock_Arany_=Class_Gold=_Főtanúsítvány.pem
Replacing debian:OISTE_WISeKey_Global_Root_GA_CA.pem
Replacing debian:SecureSign_RootCA11.pem
Replacing debian:Security_Communication_EV_RootCA1.pem
Replacing debian:Staat_der_Nederlanden_Root_CA_-_G2.pem
Replacing debian:S-TRUST_Authentication_and_Encryption_Root_CA_2005_PN.pem
Replacing debian:TC_TrustCenter_Class_2_CA_II.pem
Replacing debian:TC_TrustCenter_Class_3_CA_II.pem
Replacing debian:TC_TrustCenter_Universal_CA_I.pem
Replacing debian:TC_TrustCenter_Universal_CA_III.pem
Replacing debian:thawte_Primary_Root_CA_-_G2.pem
Replacing debian:thawte_Primary_Root_CA_-_G3.pem
Replacing debian:TÜBİTAK_UEKAE_Kök_Sertifika_Hizmet_Sağlayıcısı_-_Sürüm_3.pem
Replacing
debian:VeriSign_Class_3_Public_Primary_Certification_Authority_-_G4.pem
Replacing debian:VeriSign_Universal_Root_Certification_Authority.pem
done.
done.
Paramétrage de libcurl3-gnutls (7.21.6-3ubuntu3) ...
The host with the problematic certificate might not be serving all the
intermediate certificates, this is the issuer for the target certificate:
Issuer: C=US, ST=Arizona, L=Scottsdale, O=GoDaddy.com, Inc.,
OU=http://certificates.godaddy.com/repository, CN=Go Daddy Secure Certification
Authority/serialNumber=07969287
>From https://certs.godaddy.com/anonymous/repository.seam I got all the
>certificates from the "Godaddy Certificate Chain" section and ran openssl x509
>-text -in $file on them and got:
gd_bundle.crt
Issuer: C=US, O=The Go Daddy Group, Inc., OU=Go Daddy Class 2
Certification Authority
Subject: C=US, ST=Arizona, L=Scottsdale, O=GoDaddy.com, Inc.,
OU=http://certificates.godaddy.com/repository, CN=Go Daddy Secure Certification
Authority/serialNumber=07969287
gd-class2-root.cer
unable to load certificate
139661136733856:error:0906D06C:PEM routines:PEM_read_bio:no start
line:pem_lib.c:696:Expecting: TRUSTED CERTIFICATE
gd-class2-root.crt
Issuer: C=US, O=The Go Daddy Group, Inc., OU=Go Daddy Class 2
Certification Authority
Subject: C=US, O=The Go Daddy Group, Inc., OU=Go Daddy Class 2
Certification Authority
gd_cross_intermediate.crt
Issuer: L=ValiCert Validation Network, O=ValiCert, Inc., OU=ValiCert
Class 2 Policy Validation Authority,
CN=http://www.valicert.com//[email protected]
Subject: C=US, O=The Go Daddy Group, Inc., OU=Go Daddy Class 2
Certification Authority
gd_iis_intermediates.p7b
unable to load certificate
139958471874208:error:0906D06C:PEM routines:PEM_read_bio:no start
line:pem_lib.c:696:Expecting: TRUSTED CERTIFICATE
gd_intermediate.crt
Issuer: C=US, O=The Go Daddy Group, Inc., OU=Go Daddy Class 2
Certification Authority
Subject: C=US, ST=Arizona, L=Scottsdale, O=GoDaddy.com, Inc.,
OU=http://certificates.godaddy.com/repository, CN=Go Daddy Secure Certification
Authority/serialNumber=07969287
gdroot-g2.crt
Issuer: C=US, ST=Arizona, L=Scottsdale, O=GoDaddy.com, Inc., CN=Go
Daddy Root Certificate Authority - G2
Subject: C=US, ST=Arizona, L=Scottsdale, O=GoDaddy.com, Inc., CN=Go
Daddy Root Certificate Authority - G2
"openssl s_client -CAfile gd_intermediate.crt" worked fine, so this is
the certificate that openssl misses to verify the target host.
The chain is apparently:
* host certificate signed by
* C=US, ST=Arizona, L=Scottsdale, O=GoDaddy.com, Inc.,
OU=http://certificates.godaddy.com/repository, CN=Go Daddy Secure Certification
Authority/serialNumber=07969287 (gd_intermediate.crt) signed by
* C=US, O=The Go Daddy Group, Inc., OU=Go Daddy Class 2 Certification Authority
(gd-class2-root.crt) signed by itself
"openssl x509 -hash -noout -in $file" gives f081611a on the root CA and
598630ad on the intermediate one, and I do have a symlink in
/etc/ssl/certs for the root CA, but not for the intermediate one.
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/855454
Title:
Breaks some roots
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/ca-certificates/+bug/855454/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
