From nobody Fri Feb 23 16:48:06 2024 X-Original-To: freebsd-questions@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4ThGCr0qJ8z5B5PD for ; Fri, 23 Feb 2024 16:48:08 +0000 (UTC) (envelope-from des@freebsd.org) Received: from smtp.freebsd.org (smtp.freebsd.org [96.47.72.83]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "smtp.freebsd.org", Issuer "R3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4ThGCq4ynzz4Ygb; Fri, 23 Feb 2024 16:48:07 +0000 (UTC) (envelope-from des@freebsd.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1708706887; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=iquRCuTkePgG1cU8FFddcO3w3Nd/PC4E3yXJO/r8ow8=; b=A1SizasbAuLL/8W1v0s0ggwrAKqVGB/4lNr7TUzy1uxYp1UzLwO788gRyX9qP0wsSczRm0 GxfejUGk0nXe2AxA9bMZSoWPUaTRd9QGTN0SSZLaqp2nZ7Bk4gGgNghte6kfyCMgnsO+Qp Ckz5jec+qLyAgDcxKraBNk+ooaEMDzY6L/26HmJQJdQiXTKwC4UbIoDCBRU7hcCK8av83U f1+PzeOSi3xien9cOIeQi5p5Sth4egwYu/LzFRG4WwhF7d6qbxQcxJ51/ZFSL1FutdriTB BsfUKcshrazbjNsA65zeoCfNHnmL4L3Ywr8LlMjXX1LkjxFl+asJ9oqDYc4DcQ== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1708706887; a=rsa-sha256; cv=none; b=SqoCz0f2+yPpbRwA/4K0hA3DixpwEoJMdO4jb6pepB5odO7F7tnqDuUKvI9hlOM9cVA4oh L6dxV0ek4townj/wz4LwsLwKdboiP5Pk6eCu9ZbebWxaMJtTtdIXWZ8OdXxw4JW7H/M6eV KcTD7Nlf9HNPw7XiuRI3fShc15e2FVqAtfpnQvNa53m/OBqdlRAY25G5rkNxDkS+8Yv0Yk 6hyowSd0G3DsesqhvgDeQYLT6HgfeZhMVu7QgfEZXR/Y1uLJgcsKDE8ZjCMrAXnuyvPj5L S6FyW+SVOAmpI9HobsdMIrRpPv7lQ/oQfTBQobC6TnslZRL822fwLVnViB3MZQ== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1708706887; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=iquRCuTkePgG1cU8FFddcO3w3Nd/PC4E3yXJO/r8ow8=; b=rKF+aKDLIMikUHDi4aftXnFW3bi6Y35TcX/ZkryhGwNXvZ/TBw0UE/rGfySRuvf+uaiS+X 1J/slTftQEvVOePIr7Pw5na3+uuHLiZbDkisxielLxy0Y2Lj1sjfomMzflyyMqQhyoh9/Y TC7gHnXSEWFmpF820dDN8V7L5xNLRCNinqiCTQKwWG985O5LXZ0q4StYPQ+J+lgVyagU/g tSpsLv/N6xNbRF393dJD5Qs3H9oQVl2Z+h6K6py4edjJesbfD9G7BWKnPIswhZqe/L/Nm+ /U0CyPFYv2TwDPAgBvFj+jBz5YADm9Xx3YC8SJIWETwoup9OvrSmc12SjPijRg== Received: from ltc.des.no (2a02-8428-0993-f001-922e-16ff-fef1-acef.rev.sfr.net [IPv6:2a02:8428:993:f001:922e:16ff:fef1:acef]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) (Authenticated sender: des) by smtp.freebsd.org (Postfix) with ESMTPSA id 4ThGCq3H9Rz12BW; Fri, 23 Feb 2024 16:48:07 +0000 (UTC) (envelope-from des@freebsd.org) Received: by ltc.des.no (Postfix, from userid 1001) id 346942840F; Fri, 23 Feb 2024 17:48:06 +0100 (CET) From: =?utf-8?Q?Dag-Erling_Sm=C3=B8rgrav?= To: "Dave Cottlehuber" Cc: freebsd-questions Subject: Re: certctl, self-signed certificates and localhost with nginx, fetch and curl In-Reply-To: (Dave Cottlehuber's message of "Sun, 22 Oct 2023 15:16:40 +0000") References: User-Agent: Gnus/5.13 (Gnus v5.13) Date: Fri, 23 Feb 2024 17:48:06 +0100 Message-ID: <86il2fcek9.fsf@ltc.des.no> List-Id: User questions List-Archive: https://lists.freebsd.org/archives/freebsd-questions List-Help: List-Post: List-Subscribe: List-Unsubscribe: Sender: owner-freebsd-questions@freebsd.org X-BeenThere: freebsd-questions@freebsd.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable "Dave Cottlehuber" writes: > Any idea what I'm doing wrong here? Do I need a proper CA and not > just a local cert? You need to create a separate CA certificate, which you use to sign the server certificate, and store that, not the server certificate, in your trust root. DES --=20 Dag-Erling Sm=C3=B8rgrav - des@FreeBSD.org