Date: Fri, 2 Jun 2017 02:13:50 +0000 From: Marcin Cieslak <saper@saper.info> To: Freddie Cash <fjwcash@gmail.com> Cc: FreeBSD Ports Mailing List <ports@freebsd.org>, Jov <zhao6014@gmail.com> Subject: Re: Hosting distfiles on HTTPS w/Let's Encrypt - how? Message-ID: <nycvar.OFS.7.76.1706020205380.65985@z.fncre.vasb> In-Reply-To: <CAOjFWZ4evDm_tMos2BZhGBZMiNLrVUMTubFRS_rDuCqo=d=sDQ@mail.gmail.com> References: <nycvar.OFS.7.76.1705312355300.37923@z.fncre.vasb> <CADyrUxPNzd_49dxg0yfjEC8vjb-OgqOCnVZQTjDM3wJ9D2bcnQ@mail.gmail.com> <nycvar.OFS.7.76.1706012303400.58953@z.fncre.vasb> <CAOjFWZ4evDm_tMos2BZhGBZMiNLrVUMTubFRS_rDuCqo=d=sDQ@mail.gmail.com>
next in thread | previous in thread | raw e-mail | index | archive | help
[-- Attachment #1 --] On Thu, 1 Jun 2017, Freddie Cash wrote: > In your web server configuration, are you using the Let's Encrypt cert.pem > or fullchain.pem? fullchain.pem > If you use the former, then any client that doesn't have the DST Root CA > pre-installed will error out. The latest versions of browsers will work, as > they include the DST Root CA. My fullchain.pem as delivered by dehydrated does not include the DST Root CA. > If you use the latter, then it will just work, as the server will send all > the intermediate certificate info needed to reach the root. To test this theory, I have added DST Root CA to my customized fullchain.pem which now contains: Certificate chain 0 s:/CN=marcincieslak.com i:/C=US/O=Let's Encrypt/CN=Let's Encrypt Authority X3 1 s:/C=US/O=Let's Encrypt/CN=Let's Encrypt Authority X3 i:/O=Digital Signature Trust Co./CN=DST Root CA X3 2 s:/O=Digital Signature Trust Co./CN=DST Root CA X3 i:/O=Digital Signature Trust Co./CN=DST Root CA X3 so now we have "DST Root CA X3" extra. And the result is: => INIT.2014-12-24.tgz doesn't seem to exist in /portdistfiles/ksh93. => Attempting to fetch https://distfile.net/local-ports-distfiles/INIT.2014-12-24.tgz Certificate verification failed for /O=Digital Signature Trust Co./CN=DST Root CA X3 34374329736:error:14090086:SSL routines:ssl3_get_server_certificate:certificate verify failed:/usr/src/secure/lib/libssl/../../../crypto/openssl/ssl/s3_clnt.c:1264: fetch: https://distfile.net/local-ports-distfiles/INIT.2014-12-24.tgz: Authentication error => Attempting to fetch http://distcache.FreeBSD.org/ports-distfiles/ksh93/INIT.2014-12-24.tgz fetch: http://distcache.FreeBSD.org/ports-distfiles/ksh93/INIT.2014-12-24.tgz: Not Found so it cannot validate "DST Root CA X3" now, because it does not have the pre-installed CA bundle. Marcin Cielak [-- Attachment #2 --] 0K *H <0810 `He 0 *H 00HjD\=H 0 *H 0L1 0 U GlobalSign Root CA - R310U GlobalSign10U GlobalSign0 160615000000Z 240615000000Z0]1 0 UBE10U GlobalSign nv-sa1301U*GlobalSign PersonalSign 1 CA - SHA256 - G30"0 *H 0 ʰkM 8}feA}; 1 M< &8d;rT\dEބqNU{ܣx Ij:+j ;P@ q3DG>#cj l1yƆ: 43A,DPi\dR0*[x=KtL@Dʢ.(Cu͓(؟PFyxxi26 t AYw;>eYM#x d0`0U 0'U % 0 +++ 0U 0 0 U '¥ zzdco2Ҙ±0 U #0K.E$MPc0>+2000.+0"http://ocsp2.globalsign.com/rootr306U /0-0+)'%http://crl.globalsign.com/root-r3.crl0YU R0P0 +2(0A +2_0402+&https://www.globalsign.com/repository/0 *H wF |NR ,ȎwبkEoB"s)!YbUy\a،Ğ8wIrۅJmϦPa9 Q_ A Mz%-Mmf!=EL8TfP&G)\`9\( # $v.OlVGc ViV C7_)P{YXDHKr˟*˜ 2: q4wt \I$ ϱ.jp!?00٠ N{a 90 *H 0]1 0 UBE10U GlobalSign nv-sa1301U*GlobalSign PersonalSign 1 CA - SHA256 - G30 170525084416Z 200525084416Z0<10U saper@saper.info1 0 *H saper@saper.info0"0 *H 0 ÷in YcYuFp\اtyc@/W<lL\@.kWW3Ø٤&55IN15PQdw],(;p..3E }zgAN3̑m\'IR"@{d֘P$ 'ɹ Sxi~"5H dA !ڲQi-̓[73zB&Tgˆ P?c V+jAT{'dusѧS]\be3p' F=xG6_{<8([ݤ2 +,+Jr+z!Y%!- gAJ5*Xoc -! ,xr)b ֆT7w9z ͝ YIVp No U`Ale@εL[b-t=lJ)m I# 00U 0+00M+0Ahttp://secure.globalsign.com/cacert/gspersonalsign1sha2g3ocsp.crt0=+01http://ocsp2.globalsign.com/gspersonalsign1sha2g30LU E0C0A +2(0402+&https://www.globalsign.com/repository/0 U 0 0DU =0;09753http://crl.globalsign.com/gspersonalsign1sha2g3.crl0U 0saper@saper.info0 U %0++0 U ^ZB¬(F0 U #0'¥ zzdco2Ҙ±0 *H EJ2JyN*Wm{* 8_fEe `&t4C $Z$Ԅ;&nU`s'{0iED,WʍI8 LN)- ߓfū,wmmθhWobLfLpIk%,7kdA_ @ֵ@ȇDAW-o j;iړ|̠|HZZw_GX)Fqjsʵ3Ķu埰10{0m0]1 0 UBE10U GlobalSign nv-sa1301U*GlobalSign PersonalSign 1 CA - SHA256 - G3 N{a 90 `He 0 *H 1 *H 0 *H 1 170602021350Z0/ *H 1" +D .EdB <S/0y *H 1l0j0 `He*0 `He0 `He0 *H 0*H 0 *H @0+0 *H (0 *H sH3TP^\?(Х8 dbU&}JZ *eaI w B 9x Cr]9Ͻ*Fn0((x$5 D|AxGҲsɄM@3Vh:{K(Yav۴XYɱ ڔt_@6afW2^q>w/0G<t ~ T tk,i4s X0ߥQKkQ8I A77عQ杦Hђ L &3"{ h0dS(/+'tŚ5EJOuġUjQ;y7:ZɆFP y{mZZNV>-jb m ŝ|(Ȥ2/>?䭹qb鎐*gGv +G֮Ffk7(Pїbh~u'' esL L7pxl iIoj{Kțd5cU,xBmch ~w8[
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?nycvar.OFS.7.76.1706020205380.65985>