Re: EIS64, inadyn , secure-ssl, Umzug

Das hat alles so nicht funktioniert.

haber dann folgendes mal gemacht:

### Download

Eis64 # wget -U "Mozilla/5.0" -O /usr/local/ssl/certs/isrg_root_x2.pem 
https://letsencrypt.org/certs/isrg-root-x2.pem
--2026-08-07 11:40:42--  https://letsencrypt.org/certs/isrg-root-x2.pem
Auflösen des Hostnamens letsencrypt.org (letsencrypt.org)… 
35.157.26.135, 63.176.8.218, 2a05:d014:58f:6200::259, ...
Verbindungsaufbau zu letsencrypt.org 
(letsencrypt.org)|35.157.26.135|:443 … verbunden.
HTTP-Anforderung gesendet, auf Antwort wird gewartet … 200 OK
Länge: 790 [application/x-pem-file]
Wird in »/usr/local/ssl/certs/isrg_root_x2.pem« gespeichert.

/usr/local/ssl/certs/isrg_root_x2.pem 
100%[============================================================================>] 
     790  --.-KB/s    in 0s


2026-08-07 11:40:42 (577 MB/s) - »/usr/local/ssl/certs/isrg_root_x2.pem« 
gespeichert [790/790]

Eis64 # ls -l /usr/local/ssl/certs/ | grep isrg
-rw-r--r-- 1 root   root     1939  7. Aug 11:40 isrg_root_x1.pem
-rw-r--r-- 1 root   root      790  7. Aug 11:40 isrg_root_x2.pem

### rehash geht nicht

Eis64 # openssl rehash /usr/local/ssl/certs/
rehash: warning: skipping duplicate certificate in apache.pem
 >> rehash: warning: skipping duplicate certificate in isrg_root_x1.pem
 >> rehash: warning: skipping duplicate certificate in isrg_root_x2.pem
rehash: warning: skipping duplicate certificate in pure-ftpd.pem

Eis64 # ls -l /usr/local/ssl/certs/ | grep isrg
-rw-r--r-- 1 root   root     1939  7. Aug 11:40 isrg_root_x1.pem
-rw-r--r-- 1 root   root      790  7. Aug 11:40 isrg_root_x2.pem

## rehash ist offensichtlich case sensitive

Eis64 # ls -l /usr/local/ssl/certs/ | grep -E 'isrg|4042bcee|0b9bc432'
lrwxrwxrwx 1 root   root       16  7. Aug 11:18 0b9bc432.0 -> 
ISRG_Root_X2.pem
lrwxrwxrwx 1 root   root       16  7. Aug 11:18 4042bcee.0 -> 
ISRG_Root_X1.pem
-rw-r--r-- 1 root   root     1939  7. Aug 11:40 isrg_root_x1.pem
-rw-r--r-- 1 root   root      790  7. Aug 11:40 isrg_root_x2.pem

Eis64 # rm -f /usr/local/ssl/certs/4042bcee.0
Eis64 # rm -f /usr/local/ssl/certs/0b9bc432.0

Eis64 # openssl rehash /usr/local/ssl/certs/
rehash: warning: skipping duplicate certificate in apache.pem
 >> rehash: warning: skipping duplicate certificate in isrg_root_x1.pem
 >> rehash: warning: skipping duplicate certificate in isrg_root_x2.pem
rehash: warning: skipping duplicate certificate in pure-ftpd.pem

Eis64 # ls -l /usr/local/ssl/certs/ | grep -E 'isrg|4042bcee|0b9bc432'
lrwxrwxrwx 1 root   root       16  7. Aug 11:43 0b9bc432.0 -> 
ISRG_Root_X2.pem
lrwxrwxrwx 1 root   root       16  7. Aug 11:43 4042bcee.0 -> 
ISRG_Root_X1.pem
-rw-r--r-- 1 root   root     1939  7. Aug 11:40 isrg_root_x1.pem
-rw-r--r-- 1 root   root      790  7. Aug 11:40 isrg_root_x2.pem

### Umbenennen

Eis64 # mv /usr/local/ssl/certs/isrg_root_x1.pem 
/usr/local/ssl/certs/ISRG_Root_X1.pem
Eis64 # mv /usr/local/ssl/certs/isrg_root_x2.pem 
/usr/local/ssl/certs/ISRG_Root_X2.pem

### noch mal

Eis64 # openssl rehash /usr/local/ssl/certs/
rehash: warning: skipping duplicate certificate in apache.pem
rehash: warning: skipping duplicate certificate in pure-ftpd.pem

Eis64 # ls -l /usr/local/ssl/certs/ | grep -E 'ISRG|isrg|4042bcee|0b9bc432'
lrwxrwxrwx 1 root   root       16  7. Aug 11:43 0b9bc432.0 -> 
ISRG_Root_X2.pem
lrwxrwxrwx 1 root   root       16  7. Aug 11:43 4042bcee.0 -> 
ISRG_Root_X1.pem
-rw-r--r-- 1 root   root     1939  7. Aug 11:40 ISRG_Root_X1.pem
-rw-r--r-- 1 root   root      790  7. Aug 11:40 ISRG_Root_X2.pem

### es scheint zumindest keine Fehler mehr zu geben.

Eis64 # curl -I https://letsencrypt.org
HTTP/2 200
accept-ranges: bytes
age: 39300
cache-control: public,max-age=0,must-revalidate
cache-status: "Netlify Edge"; hit; ttl=31496700
content-security-policy: default-src 'none'; font-src 'self' 
https://doublethedonation.com https://rsms.me http://rsms.me ; style-src 
'self' 'unsafe-inline' https://donorbox.org 
https://doublethedonation.com https://rsms.me http://rsms.me ; 
script-src 'unsafe-eval' 'unsafe-inline' 'self' data: 
https://www.google-analytics.com https://www.googleadservices.com 
https://www.googletagmanager.com https://cdn.jsdelivr.net 
http://cdn.jsdelivr.net https://googleads.g.doubleclick.net 
https://donorbox.org https://doublethedonation.com https://js.stripe.com 
https://jspm.dev https://js.stripe.com/v3/ https://sdks.shopifycdn.com 
https://www.paypal.com https://www.paypalobjects.com 
https://widget.thegivingblock.com https://*.shift4.com ; img-src 'self' 
data: blob: https://www.google-analytics.com https://donorbox.org 
https://doublethedonation.com https://*.paypal.com 
https://www.paypalobjects.com https://ak2s.abmr.net 
https://ak1s.abmr.net https://www.google.com https://cdn.shopify.com 
https://v.shopify.com ; frame-src https://donorbox.org 
https://www.youtube.com https://www.youtube-nocookie.com 
https://bid.g.doubleclick.net https://js.stripe.com/v3/ 
https://js.stripe.com/v2/ https://www.paypal.com 
https://outreach.abetterinternet.org https://app.netlify.com 
https://widget.thegivingblock.com/ ; connect-src 'self' 
https://d4twhgtvn0ff5.cloudfront.net/ https://donorbox.org 
https://doublethedonation.com https://letsencrypt-merch.myshopify.com 
https://monorail-edge.shopifysvc.com https://www.paypal.com 
https://www.google-analytics.com ; frame-ancestors 'none';
content-type: text/html; charset=UTF-8
date: Fri, 07 Aug 2026 09:45:36 GMT
etag: "ed223bc3863fe3b41d3eb52b06e40ad0-ssl"
permissions-policy: geolocation=(), midi=(), sync-xhr=(), microphone=(), 
camera=(), magnetometer=(), gyroscope=(), fullscreen=(self), 
interest-cohort=()
referrer-policy: no-referrer
server: Netlify
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
x-frame-options: DENY
x-nf-request-id: 01KZDST8GGF6Z2QFYNFSDHKXT9
x-xss-protection: 1; mode=block
content-length: 90209