Date: Fri, 13 Feb 2015 11:53:09 +0100 From: Matthias Petermann <matthias@petermann-it.de> To: freebsd-questions@freebsd.org Subject: Comodo root certificate missing - what to =?UTF-8?Q?do=3F?= Message-ID: <b98505f18ca6663a06603a94a401f0b2@mail.d2ux.org>
next in thread | raw e-mail | index | archive | help
Hello, I try to update a dynamic DNS entry at EuroDNS using ddclient(EuroDynDNS). Ddclient is configured so that it accesses https://update.eurodyndns.org. When I open this URL in Firefox, the certificate is accepted. The situation is different with ddclient or the openssl client. Both clients complain about the lack of local publisher certificate (see below). The following findings from various forums I've checked: * I use OpenSSL in base * Ca_root_nss-3.17.4_1 from the ports installed * Link from /etc/ssl/cert.pem exixtiert on /usr/local/share/certs/ca-root-nss.crt (manually created) I have also tried the Comodo SSL certificates from https://support.comodo.com/index.php?/Default/Knowledgebase/Article/View/979/108/domain-validation-sha-2 attach it to /etc/ssl/cert.pem. None of this has brought an improvement. Where could the problem be? Thanks in advance and best regards, Matthias root@bsdberry:/usr/local/share/certs # openssl s_client -CAfile /etc/ssl/cert.pem -connect update.eurodyndns.org:443 CONNECTED(00000003) depth=0 OU = Domain Control Validated, OU = COMODO SSL, CN = update.eurodyndns.org verify error:num=20:unable to get local issuer certificate verify return:1 depth=0 OU = Domain Control Validated, OU = COMODO SSL, CN = update.eurodyndns.org verify error:num=27:certificate not trusted verify return:1 depth=0 OU = Domain Control Validated, OU = COMODO SSL, CN = update.eurodyndns.org verify error:num=21:unable to verify the first certificate verify return:1 --- Certificate chain 0 s:/OU=Domain Control Validated/OU=COMODO SSL/CN=update.eurodyndns.org i:/C=GB/ST=Greater Manchester/L=Salford/O=COMODO CA Limited/CN=COMODO SSL CA --- Server certificate -----BEGIN CERTIFICATE----- MIIFCDCCA/CgAwIBAgIQWrYgr7Hn0XCbNU1k3bTIfjANBgkqhkiG9w0BAQUFADBw MQswCQYDVQQGEwJHQjEbMBkGA1UECBMSR3JlYXRlciBNYW5jaGVzdGVyMRAwDgYD VQQHEwdTYWxmb3JkMRowGAYDVQQKExFDT01PRE8gQ0EgTGltaXRlZDEWMBQGA1UE AxMNQ09NT0RPIFNTTCBDQTAeFw0xNDA4MjIwMDAwMDBaFw0xNTA4MjkyMzU5NTla MFgxITAfBgNVBAsTGERvbWFpbiBDb250cm9sIFZhbGlkYXRlZDETMBEGA1UECxMK Q09NT0RPIFNTTDEeMBwGA1UEAxMVdXBkYXRlLmV1cm9keW5kbnMub3JnMIIBIjAN BgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAvpdpoTcpiA69SRoQHgpTgpnZ8hGQ SG/ssUx7hYdpYv8zNiaLSxJoBNRzn2zKI/2783SHctFaX8HpjY1iEe1mCWV+XCNV H+YM6wSo6QJ36VUwv/JmaMswPpwYJR+huUtFt2WSIlr/kknDvQ10N4NpqbaF+ryk lXUm/L4kuf/3hJ4wehxLf/KTGtng1aISBk4MrlVI0R7vFvY9zfthTR97AQ24yggz OHZnXPk0VcdTHPh8UPl1zvd2hKddmfXXxrkiVhxukgk+/o3i2DWVO3dD8ssS7c+i tubFIXxnIZoOql+Y7koVwm1E4KCzrcpL0WEar5R5Pry01KDESkyickQiQwIDAQAB o4IBtDCCAbAwHwYDVR0jBBgwFoAUG2u9H4pJGJRUN1W0IBftN7l3GH0wHQYDVR0O BBYEFPVfl0OTHa0e4bVZ08XUnEh+R8iVMA4GA1UdDwEB/wQEAwIFoDAMBgNVHRMB Af8EAjAAMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjBPBgNVHSAESDBG MDoGCysGAQQBsjEBAgIHMCswKQYIKwYBBQUHAgEWHWh0dHBzOi8vc2VjdXJlLmNv bW9kby5jb20vQ1BTMAgGBmeBDAECATA4BgNVHR8EMTAvMC2gK6AphidodHRwOi8v Y3JsLmNvbW9kb2NhLmNvbS9DT01PRE9TU0xDQS5jcmwwaQYIKwYBBQUHAQEEXTBb MDMGCCsGAQUFBzAChidodHRwOi8vY3J0LmNvbW9kb2NhLmNvbS9DT01PRE9TU0xD QS5jcnQwJAYIKwYBBQUHMAGGGGh0dHA6Ly9vY3NwLmNvbW9kb2NhLmNvbTA7BgNV HREENDAyghV1cGRhdGUuZXVyb2R5bmRucy5vcmeCGXd3dy51cGRhdGUuZXVyb2R5 bmRucy5vcmcwDQYJKoZIhvcNAQEFBQADggEBAJlb7hOlIhfdQQP7EGo3lpwH7dYm gVPL78bLN+Xe+TIuCvq8bewv9Tv7FuwLGOwVcZQ0mfadsE9mY2aixMhwCwmUhtUx tF0ebRg616WF3p27rTksdLyvA9R+GUmwL4CawCOvyWSj5KwUS6gGuVgt+XCGiITQ dUfCYIBs2w9bwBRNbRGIhlWrdJVnzIsxiGpLZBXXDe0WPGXEmOJcRZCNEU1ZdIPj E6j+0R0z5JZHyMIsm1vuBOlohiTR/Em/kyT8N1boH0mGSa9oXlP32ip7p5KGSSht FKheeoE4rTAn4SWvxdvvV2P5M+uDWOa2RSTMoYmNzvjVqfvMw15I1QByDTs= -----END CERTIFICATE----- subject=/OU=Domain Control Validated/OU=COMODO SSL/CN=update.eurodyndns.org issuer=/C=GB/ST=Greater Manchester/L=Salford/O=COMODO CA Limited/CN=COMODO SSL CA --- No client certificate CA names sent --- SSL handshake has read 2009 bytes and written 521 bytes --- New, TLSv1/SSLv3, Cipher is DHE-RSA-AES128-SHA Server public key is 2048 bit Secure Renegotiation IS supported Compression: NONE Expansion: NONE SSL-Session: Protocol : TLSv1.2 Cipher : DHE-RSA-AES128-SHA Session-ID: E0996764ACCDE112BAE4307B4A15255C33917699528F12FF31A94AE445C9C83C Session-ID-ctx: Master-Key: 2AB611143A51C8D2967F630DA1DD4555BB065BDA7B12C12A6F78E70D7E9A8AE465DEBD3AD551F8E7BE6D4CB75F2597E1 Key-Arg : None PSK identity: None PSK identity hint: None SRP username: None Start Time: 1423827038 Timeout : 300 (sec) Verify return code: 21 (unable to verify the first certificate) ---
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?b98505f18ca6663a06603a94a401f0b2>