Re: Cert problem when attemping build of mesa
| Newsgroups | gmane.linux.lfs.beyond.support |
|---|---|
| Message-ID | <[email protected]> |
Sent from my Galaxy -------- Original message --------From: "Xi Ruoyao([email protected] via blfs-support Mailing List)" <[email protected]> Date: 2025-08-31 7:48 p.m. (GMT-06:00) To: [email protected] Subject: Re: [blfs-support] Cert problem when attemping build of mesa On Sun, 2025-08-31 at 23:59 +0000, Richard wrote:/* snip */> lfs [ ~ ]$ wget https://crates.io/api/v1/crates/syn/2.0.68/download> --2025-08-31 11:50:05-- > https://crates.io/api/v1/crates/syn/2.0.68/download> Resolving crates.io (crates.io)... 3.169.149.82, 3.169.149.7,> 3.169.149.97, ...> Connecting to crates.io (crates.io)|3.169.149.82|:443... connected.> ERROR: cannot verify crates.io's certificate, issued by ‘CN=Amazon RSA> 2048> M02,O=Amazon,C=US’:> Unable to locally verify the issuer's authority.> To connect to crates.io insecurely, use `--no-check-certificate'.> > And yet firefox 140.2.0 has no problem downloading the file...> > lfs [ ~/Downloads ]$ ls -latr> total 64040> drwxr-xr-x 30 lfs lfs 4096 Aug 31 11:49 ..> -rw-r--r-- 1 lfs lfs 265035 Aug 31 11:52 syn-2.0.68.crate> drwxr-xr-x 2 lfs lfs 4096 Aug 31 11:52 .> > Any advice would be appreciated. Thanks very much in advance.Firefox uses a different SSL implementation from wget. Firefox usesNSS, and wget uses openssl (if you don't deviate from the book).And NSS uses an internal certificate store (unrelated to the system oneset by make-ca) if you didn't use the ln -sfv ./pkcs11/p11-kit-trust.so/usr/lib/libnssckbi.so command.So there are two possibilities here, if you used the ln command it meansthe system certificate store is fine but somehow openssl cannot get it,for reasons like make-ca has failed to export it to /etc/ssl/certs oropenssl has been simply misconfigured in LFS (I did it once by mistypingthe --openssldir=/etc/ssl option).If you didn't use the ln command, maybe your system certificate store isjust wrong.Try the "trust list" command and it should list everything in the systemcertificate store. Then try the ls /etc/ssl/certs command which shouldshows the store exported for openssl.-- Xi Ruoyao <[email protected]>I do have the soft link to p11-kit-trust.so I will look closer at the ssl configuration. Thanks.http://lists.linuxfromscratch.org/sympa/info/blfs-supportUnsubscribe: See the above information page -- http://lists.linuxfromscratch.org/sympa/info/blfs-support Unsubscribe: See the above information page