| Newsgroups |
gmane.linux.lfs.beyond.devel |
| Message-ID |
<[email protected]> |
On 4/7/25 3:01 PM, "Douglas R. Reno" ([email protected] via blfs-dev
Mailing List) wrote:
> Good afternoon folks,
>
> I'm in the process of continuing to rebuild my development system, and I've
> encountered an issue with make-ca.
>
> When running "make-ca -g", I get the following output:
>
> renodr [ /tmp ]$ sudo make-ca -g
> Checking for new version of certdata.txt...done.
> Unable to get revision from server! Exiting.
>
> In the past, this has been due to a certificate problem with the bundled mozilla-ca-
> root certificate that we install with make-ca.
>
> This time appears to be a bit different. I reviewed the output of certdata.txt.log in
> the temporary directory that was created, and the certificate validation looks fine.
>
> The problem now is that the download URL for the certificate data redirects from
> hg.mozilla.org to hg-edge.mozilla.org. I noticed that in my web browser, but it does
> it via wget as well:
>
> renodr [ /sources ]$ wget https://hg.mozilla.org/projects/nss/raw-file/tip/lib/ckfw/
> builtins/certdata.txt
> --2025-04-07 14:37:49-- https://hg.mozilla.org/projects/nss/raw-file/tip/lib/ckfw/
> builtins/certdata.txt
> Resolving hg.mozilla.org (hg.mozilla.org)... 63.245.208.203
> Connecting to hg.mozilla.org (hg.mozilla.org)|63.245.208.203|:443... connected.
> HTTP request sent, awaiting response... 302 Found
> Location: https://hg-edge.mozilla.org/projects/nss/raw-file/tip/lib/ckfw/builtins/
> certdata.txt [following]
> --2025-04-07 14:37:49-- https://hg-edge.mozilla.org/projects/nss/raw-file/tip/lib/
> ckfw/builtins/certdata.txt
> Resolving hg-edge.mozilla.org (hg-edge.mozilla.org)... 151.101.1.91, 151.101.65.91,
> 151.101.193.91, ...
> Connecting to hg-edge.mozilla.org (hg-edge.mozilla.org)|151.101.1.91|:443... connected.
> HTTP request sent, awaiting response... 200 OK
> Length: 1403491 (1.3M) [text/plain]
> Saving to: ‘certdata.txt’
>
> certdata.txt
> 100%[=====================================================================>] 1.34M
> 4.48MB/s in 0.3s
>
> 2025-04-07 14:37:50 (4.48 MB/s) - ‘certdata.txt’ saved [1403491/1403491]
>
>
> I suspect what's happening here is that since the URL is now redirecting, the
> download will fail. We're using s_client from OpenSSL to download the file (via
> openssl s_client). The certificate for hg-edge.mozilla.org is different than that of
> hg.mozilla.org, as it is signed with LetsEncrypt instead of DigiCert. Here's an
> example of what appears if we just change the url from 'hg.mozilla.org' to 'hg-
> edge.mozilla.org':
>
> CONNECTED(00000003)
> ---
> Certificate chain
> 0 s:CN=hg-edge.mozilla.org
> i:C=US, O=Let's Encrypt, CN=R11
> a:PKEY: rsaEncryption, 2048 (bit); sigalg: RSA-SHA256
> v:NotBefore: Mar 20 13:11:15 2025 GMT; NotAfter: Jun 18 13:11:14 2025 GMT
> 1 s:C=US, O=Let's Encrypt, CN=R11
> i:C=US, O=Internet Security Research Group, CN=ISRG Root X1
> a:PKEY: rsaEncryption, 2048 (bit); sigalg: RSA-SHA256
> v:NotBefore: Mar 13 00:00:00 2024 GMT; NotAfter: Mar 12 23:59:59 2027 GMT
> ---
> no peer certificate available
> ---
> No client certificate CA names sent
> Server Temp Key: X25519, 253 bits
> ---
> SSL handshake has read 2816 bytes and written 344 bytes
> Verification error: unable to get local issuer certificate
> ---
> New, TLSv1.3, Cipher is TLS_AES_128_GCM_SHA256
> Protocol: TLSv1.3
> This TLS version forbids renegotiation.
> Compression: NONE
> Expansion: NONE
> No ALPN negotiated
> Early data was not sent
> Verify return code: 20 (unable to get local issuer certificate)
> ---
>
>
> Meanwhile, the old certificate chain was:
>
> CONNECTED(00000003)
> ---
> Certificate chain
> 0 s:C=US, ST=California, L=San Francisco, O=Mozilla Foundation, CN=hg.mozilla.org
> i:C=US, O=DigiCert Inc, CN=DigiCert Global G2 TLS RSA SHA256 2020 CA1
> a:PKEY: rsaEncryption, 4096 (bit); sigalg: RSA-SHA256
> v:NotBefore: Sep 3 00:00:00 2024 GMT; NotAfter: Sep 18 23:59:59 2025 GMT
> 1 s:C=US, O=DigiCert Inc, CN=DigiCert Global G2 TLS RSA SHA256 2020 CA1
> i:C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert Global Root G2
> a:PKEY: rsaEncryption, 2048 (bit); sigalg: RSA-SHA256
> v:NotBefore: Mar 30 00:00:00 2021 GMT; NotAfter: Mar 29 23:59:59 2031 GMT
> ---
> [Certificate Trimmed]
>
> -----END CERTIFICATE-----
> subject=C=US, ST=California, L=San Francisco, O=Mozilla Foundation, CN=hg.mozilla.org
> issuer=C=US, O=DigiCert Inc, CN=DigiCert Global G2 TLS RSA SHA256 2020 CA1
> ---
> No client certificate CA names sent
> Peer signing digest: SHA256
> Peer signature type: RSA-PSS
> Server Temp Key: ECDH, prime256v1, 256 bits
> ---
> SSL handshake has read 4191 bytes and written 777 bytes
> Verification: OK
> ---
> New, TLSv1.3, Cipher is TLS_AES_256_GCM_SHA384
> Protocol: TLSv1.3
> Server public key is 4096 bit
> This TLS version forbids renegotiation.
> Compression: NONE
> Expansion: NONE
> No ALPN negotiated
> Early data was not sent
> Verify return code: 0 (ok)
> ---
> ---
> Post-Handshake New Session Ticket arrived:
> SSL-Session:
> Protocol : TLSv1.3
> Cipher : TLS_AES_256_GCM_SHA384
> Session-ID: 996C0B9D6523BBA88A86FA8F94D8D391A64098B2F2C80B7685637F81E2EFDFC7
> Session-ID-ctx:
> Resumption PSK:
> 05E1FE928267D4412B2F3E097FE6AC3773EEC6D3315A1A81DE440A97E9505082E3AF319F8DAFE522905902A42BA86707
> PSK identity: None
> PSK identity hint: None
> SRP username: None
> TLS session ticket lifetime hint: 14400 (seconds)
> TLS session ticket:
> 0000 - 01 b3 14 6b e9 bf 63 c5-67 8f 46 7d 8e eb 31 e9 ...k..c.g.F}..1.
> 0010 - d2 f1 8e c7 02 4a 5d b6-9d f2 a0 42 fb 85 f2 ac .....J]....B....
> 0020 - 74 fb 80 1c 63 a5 f0 c8-ab c5 90 4e 4d a0 1d 39 t...c......NM..9
> 0030 - 7e e4 31 b2 5e 46 80 23-c4 62 e8 cd b1 e3 67 88 ~.1.^F.#.b....g.
> 0040 - a4 48 0b 66 58 ad 54 90-73 35 79 be fb 77 99 ac .H.fX.T.s5y..w..
> 0050 - 04 5e e4 b5 53 42 15 55-82 8f 78 23 b0 74 5e b9 .^..SB.U..x#.t^.
> 0060 - 2d a8 d3 46 07 ec f4 25-85 1f ec 5b 13 95 70 a3 -..F...%...[..p.
> 0070 - 3a d8 04 9d f9 de 85 f2-ed 2b ab 12 52 d6 98 df :........+..R...
> 0080 - 0c 95 2d 2b 2b 79 4a b7-ff 0e 50 fe c5 77 bd 3f ..-++yJ...P..w.?
> 0090 - b2 c3 65 a3 22 55 fa 26-0d c0 16 8b 8f 01 56 05 ..e."U.&......V.
> 00a0 - 90 fa 24 96 85 06 32 20-e4 f2 09 81 05 69 14 65 ..$...2 .....i.e
> 00b0 - 7a z
>
> Start Time: 1744053927
> Timeout : 7200 (sec)
> Verify return code: 0 (ok)
> Extended master secret: no
> Max Early Data: 0
> ---
> read R BLOCK
> closed
>
>
> (Note that the above output happens if you run make-ca -g as it is shipped currently,
> but you never get a certdata.txt file and the reason for that wasn't originally
> apparent to me - which is why I tried downloading the file in a web browser and via
> wget, and that redirected to hg-edge.mozilla.org).
>
> I've also tried downloading certdata.txt with cURL and here's the output from that:
>
> root [ /tmp/tmp.SMbxC0i3cs ]# curl https://hg.mozilla.org/projects/nss/raw-file/tip/
> lib/ckfw/builtins/certdata.txt -v
> * Host hg.mozilla.org:443 was resolved.
> * IPv6: (none)
> * IPv4: 63.245.208.203
> * Trying 63.245.208.203:443...
> * ALPN: curl offers h2,http/1.1
> * TLSv1.3 (OUT), TLS handshake, Client hello (1):
> * CAfile: none
> * CApath: /etc/ssl/certs
> * TLSv1.3 (IN), TLS handshake, Server hello (2):
> * TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):
> * TLSv1.3 (OUT), TLS handshake, Client hello (1):
> * TLSv1.3 (IN), TLS change cipher, Change cipher spec (1):
> * TLSv1.3 (IN), TLS handshake, Server hello (2):
> * TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):
> * TLSv1.3 (IN), TLS handshake, Certificate (11):
> * TLSv1.3 (IN), TLS handshake, CERT verify (15):
> * TLSv1.3 (IN), TLS handshake, Finished (20):
> * TLSv1.3 (OUT), TLS handshake, Finished (20):
> * SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384 / secp256r1 / RSASSA-PSS
> * ALPN: server accepted h2
> * Server certificate:
> * subject: C=US; ST=California; L=San Francisco; O=Mozilla Foundation;
> CN=hg.mozilla.org
> * start date: Sep 3 00:00:00 2024 GMT
> * expire date: Sep 18 23:59:59 2025 GMT
> * subjectAltName: host "hg.mozilla.org" matched cert's "hg.mozilla.org"
> * issuer: C=US; O=DigiCert Inc; CN=DigiCert Global G2 TLS RSA SHA256 2020 CA1
> * SSL certificate verify ok.
> * Certificate level 0: Public key type RSA (4096/152 Bits/secBits), signed using
> sha256WithRSAEncryption
> * Certificate level 1: Public key type RSA (2048/112 Bits/secBits), signed using
> sha256WithRSAEncryption
> * Certificate level 2: Public key type RSA (2048/112 Bits/secBits), signed using
> sha256WithRSAEncryption
> * Connected to hg.mozilla.org (63.245.208.203) port 443
> * using HTTP/2
> * [HTTP/2] [1] OPENED stream for https://hg.mozilla.org/projects/nss/raw-file/tip/
> lib/ckfw/builtins/certdata.txt
> * [HTTP/2] [1] [:method: GET]
> * [HTTP/2] [1] [:scheme: https]
> * [HTTP/2] [1] [:authority: hg.mozilla.org]
> * [HTTP/2] [1] [:path: /projects/nss/raw-file/tip/lib/ckfw/builtins/certdata.txt]
> * [HTTP/2] [1] [user-agent: curl/8.12.1]
> * [HTTP/2] [1] [accept: */*]
> > GET /projects/nss/raw-file/tip/lib/ckfw/builtins/certdata.txt HTTP/2
> > Host: hg.mozilla.org
> > User-Agent: curl/8.12.1
> > Accept: */*
> >
> * Request completely sent off
> * TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
> < HTTP/2 302
> < content-type: text/html
> < date: Mon, 07 Apr 2025 19:56:06 GMT
> < location: https://hg-edge.mozilla.org/projects/nss/raw-file/tip/lib/ckfw/builtins/
> certdata.txt
> < access-control-allow-origin: *
> < content-length: 0
> <
> * Connection #0 to host hg.mozilla.org left intact
>
> Changing the URL to say 'hg-edge.mozilla.org' does result in cURL dumping the
> certificate data, but that's similar to wget/Firefox already since they just follow
> the redirection. Doing that on my new development system results in an error about
> SSL certificates which makes sense since I haven't been able to run make-ca because
> of this problem yet.
>
> What makes me think that it's a problem with the URL redirection is that other
> systems which have had make-ca installed already are now unable to get certificate
> data updates as well, and they show the exact same log as above with the Mozilla/
> DigiCert chain. The hg-edge.mozilla.org server does not appear to use the Mozilla
> certificate root either as it's setup with LetsEncrypt, so just updating the URL in /
> usr/sbin/make-ca does not work on new systems.
>
> To reproduce this, just run 'make-ca -g' on any system and it should fail.
>
> Can anyone else reproduce this? If so what should we do here?
Confirmed.
$ sudo make-ca -g
Checking for new version of certdata.txt...done.
Unable to get revision from server! Exiting.
-- Bruce
--
http://lists.linuxfromscratch.org/sympa/info/blfs-dev
Unsubscribe: See the above information page