lmi
[Top][All Lists]
Advanced

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[lmi] savannah.gnu.org certificate expiration


From: Greg Chicares
Subject: [lmi] savannah.gnu.org certificate expiration
Date: Fri, 29 Oct 2021 00:02:25 +0000
User-agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Thunderbird/78.13.0

https://savannah.nongnu.org/forum/forum.php?forum_id=10054

| On September 30, 2021, as planned the DST Root CA X3 cross-sign has
| expired for the Let's Encrypt trust chain.  That was a normal and
| planned event.  However coupled with a verification error in the code
| of libraries authenticating certificates it caused some clients that
| have not been updated to fixed versions to have problems validating
| certificates.
|
| If you are experiencing invalid certificate chain problems with Let's
| Encrypt certificates (not a Savannah problem) then please upgrade
| your client to the latest security patches for your system.

That seemed worth mentioning in general. In particular, it happens to
matter for our corporate redhat server:
 - To determine whether gnu.org is blocked, we do this:
      curl 'https://git.savannah.nongnu.org:443'
   Formerly, that always failed, so scripts would use github instead.
 - Now, to my surprise, that 'curl' command succeeds; but subsequent
   'wget' commands fail unless we add '--no-check-certificate'.
I think I might add '--no-check-certificate' liberally. I could
probably figure out how to update the server's certificates, but
the corporate overseers might look askance at that.


reply via email to

[Prev in Thread] Current Thread [Next in Thread]