Re: Cert problem when attemping build of mesa

On 8/31/25 19:47, Xi Ruoyao ([email protected] via blfs-support Mailing 
List) wrote:

> On Sun, 2025-08-31 at 23:59 +0000, Richard wrote:
>
> /* snip */
>
>> lfs [ ~ ]$ wget  https://crates.io/api/v1/crates/syn/2.0.68/download
>> --2025-08-31 11:50:05--
>> https://crates.io/api/v1/crates/syn/2.0.68/download
>> Resolving crates.io (crates.io)... 3.169.149.82, 3.169.149.7,
>> 3.169.149.97, ...
>> Connecting to crates.io (crates.io)|3.169.149.82|:443... connected.
>> ERROR: cannot verify crates.io's certificate, issued by ‘CN=Amazon RSA
>> 2048
>> M02,O=Amazon,C=US’:
>>    Unable to locally verify the issuer's authority.
>> To connect to crates.io insecurely, use `--no-check-certificate'.
>>
>> And yet firefox 140.2.0 has no problem downloading the file...
>>
>> lfs [ ~/Downloads ]$ ls -latr
>> total 64040
>> drwxr-xr-x 30 lfs lfs     4096 Aug 31 11:49 ..
>> -rw-r--r--  1 lfs lfs   265035 Aug 31 11:52 syn-2.0.68.crate
>> drwxr-xr-x  2 lfs lfs     4096 Aug 31 11:52 .
>>
>> Any advice would be appreciated.  Thanks very much in advance.
> Firefox uses a different SSL implementation from wget.  Firefox uses
> NSS, and wget uses openssl (if you don't deviate from the book).
>
> And NSS uses an internal certificate store (unrelated to the system one
> set by make-ca) if you didn't use the ln -sfv ./pkcs11/p11-kit-trust.so
> /usr/lib/libnssckbi.so command.
>
> So there are two possibilities here, if you used the ln command it means
> the system certificate store is fine but somehow openssl cannot get it,
> for reasons like make-ca has failed to export it to /etc/ssl/certs or
> openssl has been simply misconfigured in LFS (I did it once by mistyping
> the --openssldir=/etc/ssl option).
>
> If you didn't use the ln command, maybe your system certificate store is
> just wrong.
>
> Try the "trust list" command and it should list everything in the system
> certificate store.  Then try the ls /etc/ssl/certs command which should
> shows the store exported for openssl.
>
> Your are absolutely right, it was openssl.  I had earlier upgraded to 
> 3.5.2 and that broke it.  This time, I moved directory /etc/ssl 
> somewhere else and re-installed the package.  Then ran "make-ca -g" to 
> get back the certdata.txt file and everything worked fine. I had 
> previously run make-ca -g --force when the mesa problem showed up, but 
> that had not fixed the problem while the re-install did.  I also got 
> difference in count in the certs subdirectory before and after, so 
> something did change:
root@funkyvac:/root/tmp/ssl/certs# ls -la | wc
     549    5662   45770
root@funkyvac:/root/tmp/ssl/certs# cd /etc/ssl/certs
root@funkyvac:/lfs/etc/ssl/certs# ls -la | wc
     543    5600   45261

Again, thanks for the help.

-- 
http://lists.linuxfromscratch.org/sympa/info/blfs-support
Unsubscribe: See the above information page