Date: Sat, 17 May 2014 12:52:20 +0200 From: Kurt Jaeger <pi@FreeBSD.org> To: FreeBSD-gnats-submit@freebsd.org Subject: bin/189882: fetch -no-verify-peer no longer disables SSL verification Message-ID: <E1WlcE0-000Mzw-UO@f10.opsec.eu> Resent-Message-ID: <201405171100.s4HB04xD046268@freefall.freebsd.org>
next in thread | raw e-mail | index | archive | help
>Number: 189882 >Category: bin >Synopsis: fetch -no-verify-peer no longer disables SSL verification >Confidential: no >Severity: non-critical >Priority: low >Responsible: freebsd-bugs >State: open >Quarter: >Keywords: >Date-Required: >Class: sw-bug >Submitter-Id: current-users >Arrival-Date: Sat May 17 11:00:04 UTC 2014 >Closed-Date: >Last-Modified: >Originator: Kurt Jaeger >Release: FreeBSD 10.0-RELEASE-p3 amd64 >Organization: - >Environment: System: FreeBSD f10.opsec.eu 10.0-RELEASE-p3 FreeBSD 10.0-RELEASE-p3 #0: Tue May 13 18:31:10 UTC 2014 root@amd64-builder.daemonology.net:/usr/obj/usr/src/sys/GENERIC amd64 >Description: fetch -no-verify-peer allows to fetch from https even if the remote site can not be verified. It no longer works. --------- f10# fetch -v -no-verify-peer https://gist.githubusercontent.com/anonymous/eb379038510a6f15c0cb/raw/cc836df6365e975fd19b49f9eedee5f1ebfa4e46/mnemosyne-2.3.diff looking up gist.githubusercontent.com connecting to gist.githubusercontent.com:443 SSL options: 81004bff Peer verification enabled Using CA cert file: /etc/ssl/cert.pem Certificate verification failed for /C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert SHA2 High Assurance Server CA 34380826280:error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed:/usr/src/secure/lib/libssl/../../../crypto/openssl/ssl/s3_clnt.c:1168: fetch: https://gist.githubusercontent.com/anonymous/eb379038510a6f15c0cb/raw/cc836df6365e975fd19b49f9eedee5f1ebfa4e46/mnemosyne-2.3.diff: Authentication error --------- The cause seems to be that the system-ssl-lib no longer supports disabling the verification via setenv("SSL_NO_VERIFY_PEER", "", 1); which it did in the past ? (/usr/src/usr.bin/fetch/fetch.c, line 1034) >How-To-Repeat: see above >Fix: TODO: Find a fix. >Release-Note: >Audit-Trail: >Unformatted:
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?E1WlcE0-000Mzw-UO>