OpenSSL 1.0.2 certificates

Hi,

I want to check if I am doing something very stupid here, since I am unable to properly
use any apps linking to openssl100-shlibs (among others wget and python) since approximately
the update to openssl-1.0.2, as it refuses to accept almost any host certificate:

ariel:15579> curl -O https://www.openssl.org/source/openssl-1.0.2j.tar.gz                                                                                      
% Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                            Dload  Upload   Total   Spent    Left  Speed
100 5183k  100 5183k    0     0   985k      0  0:00:05  0:00:05 --:--:-- 1266k
ariel:15580> wget https://www.openssl.org/source/openssl-1.0.2j.tar.gz                                                                                         
--2017-01-02 15:03:01--  https://www.openssl.org/source/openssl-1.0.2j.tar.gz
Resolving www.openssl.org... 2600:1406:1a:38f::c1e, 2600:1406:1a:38e::c1e, 104.91.180.27
Connecting to www.openssl.org|2600:1406:1a:38f::c1e|:443... connected.
ERROR: cannot verify www.openssl.org's certificate, issued by ‘CN=Let's Encrypt Authority X3,O=Let's Encrypt,C=US’:
Unable to locally verify the issuer's authority.
To connect to www.openssl.org insecurely, use `--no-check-certificate'.
ariel:15581> wget --ca-certificate=/etc/ssl/cert.pem https://www.openssl.org/source/openssl-1.0.2j.tar.gz                                                      
--2017-01-02 15:03:10--  https://www.openssl.org/source/openssl-1.0.2j.tar.gz
Resolving www.openssl.org... 2600:1406:1a:38f::c1e, 2600:1406:1a:38e::c1e, 104.91.180.27
Connecting to www.openssl.org|2600:1406:1a:38f::c1e|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 5307912 (5.1M) [application/x-gzip]
Saving to: ‘openssl-1.0.2j.tar.gz.1’

openssl-1.0.2j.tar.gz.1                   100%[===============================================================================>]   5.06M  1.38MB/s    in 3.7s    

2017-01-02 15:03:15 (1.38 MB/s) - ‘openssl-1.0.2j.tar.gz’ saved [5307912/5307912]

ariel:15582> wget --ca-certificate=/sw/etc/ssl/certs/ca-bundle.crt  https://www.openssl.org/source/openssl-1.0.2j.tar.gz                                       
--2017-01-02 15:31:49--  https://www.openssl.org/source/openssl-1.0.2j.tar.gz
Resolving www.openssl.org... 2600:1406:1a:38f::c1e, 2600:1406:1a:38e::c1e, 104.91.180.27
Connecting to www.openssl.org|2600:1406:1a:38f::c1e|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 5307912 (5.1M) [application/x-gzip]
Saving to: ‘openssl-1.0.2j.tar.gz.2’

openssl-1.0.2j.tar.gz.2                 100%[===============================================================================>]   5.06M  1.40MB/s    in 3.6s    

2017-01-02 15:31:55 (1.40 MB/s) - ‘openssl-1.0.2j.tar.gz.3’ saved [5307912/5307912]
This happens regardless of whether the certificate updates from ca-bundle are installed or not
(which are almost a year old now anyway), but as the last two examples show, it obviously accepts
both the system-provided certificates in /etc/ssl or the ca-certs one if directed explicitly to them.
Since I’ve never seen any other message about this problem popping up on the list, I am still
wondering if I am doing something blatantly wrong, but as it is, the CERTIFICATE_VERIFY_FAILED
errors causes a number of package builds to fail tests that require downloading things.

Is there some way to have openssl100 automatically recognise any of the installed certificate lists?
There is a /sw/etc/ssl/openssl.cnf however belonging to openssl_1.1.0c, and its locations don’t seem
to make any sense at all:

[ CA_default ]

dir             = ./demoCA              # Where everything is kept
certs           = $dir/certs            # Where the issued certs are kept
crl_dir         = $dir/crl              # Where the issued crl are kept

as there is no demo* subdirectory present whatsoever (otherwise I would have suspected yet another
bit of trouble due to a case-sensitive file system). Trying to modify this installed openssl.cnf to point to
any of the actual certificate locations did not get me any further either.

If I am really the only one having this problem I’m wondering what could possibly be broken here after
rebuilding and reinstalling all openssl packages...


Thanks for any help,
					Derek







------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most 
engaging tech sites, SlashDot.org! http://sdm.link/slashdot
_______________________________________________
Fink-devel mailing list
[email protected]
List archive:
https://sourceforge.net/p/fink/mailman/fink-devel
Subscription management:
https://lists.sourceforge.net/lists/listinfo/fink-devel