Re: pkg 1.18.4 refuses local CAcert on 13.1-RELEASE-p2
Christoph Moench-Tegeder <[email protected]>
| Newsgroups | gmane.os.freebsd.security.general |
|---|---|
| Message-ID | <[email protected]> |
## Axel Rau ([email protected]): > but openssl verify shows successful verification: > - - - > # openssl s_client -connect some_fqdn:443 -6 -verify_return_error | grep verify > depth=1 some_internal_CA Home-brewed CA? Sure that the extensions have been set correctly? (Most commonly missed/wrong is the CA flag in Basic Constraints). Standard openssl verification is not helpful, you'll need at least "-strict -policy_check". TL;DR: use Let's Encrypt. Regards, Christoph -- Spare Space