[Solved] SSL CA cert

[pogwizd]

Hi everybody,

I just got a new laptop, and made a fresh install of Gentoo, but unfortunetely I am having a problem with the SSL certificates.
I am trying to initialize the ClamAV database and a third party repository, and I 'got every time the same problem with the SSL certificates:

Code: Select all

# emaint sync  -r nest
>>> Syncing repository 'nest' into '/var/db/repos/nest'...
/usr/bin/git clone --depth 1 https://github.com/gentoo-mirror/nest.git .
Cloning into '.'...
fatal: unable to access 'https://github.com/gentoo-mirror/nest.git/': Problem with the SSL CA cert (path? access rights?)
!!! git clone error in /var/db/repos/nest
!!! Repository 'nest' is missing masters attribute in '/var/db/repos/nest/metadata/layout.conf'
!!! Set 'masters = gentoo' in this file for future compatibility

Action: sync for repo: nest, returned code = 128

Code: Select all

# freshclam 
ClamAV update process started at Wed Feb 16 17:09:31 2022
daily database available for download (remote version: 26455)
WARNING: Download failed (77) WARNING:  Message: Problem with the SSL CA cert (path? access rights?)
WARNING: Can't download daily.cvd from https://database.clamav.net/daily.cvd
Trying again in 5 secs...
daily database available for download (remote version: 26455)
WARNING: Download failed (77) WARNING:  Message: Problem with the SSL CA cert (path? access rights?)
WARNING: Can't download daily.cvd from https://database.clamav.net/daily.cvd
Trying again in 5 secs...
daily database available for download (remote version: 26455)
ERROR: Download failed (77) ERROR:  Message: Problem with the SSL CA cert (path? access rights?)
ERROR: Can't download daily.cvd from https://database.clamav.net/daily.cvd
Giving up on https://database.clamav.net...
ERROR: Update failed for database: daily
ERROR: Database update process failed: Connection failed
ERROR: Update failed.

I really do not get it, especially that before I did not had any issues with those.
For info, here is my USE flags:

Code: Select all

# emerge --info | grep USE
USE="7z 7zip X a52 aac aalib acl acpi activities aio alisp alsa alsa-plugin amd64 amr ao ap apache2 appstream argon2 aspell atm audiofile avif bash-completion bluetooth branding brotli browser-integration bs2b bzip2 cacert cairo caps cdda cddb cdio cdparanoia cdr cgi chm chromium clamdtop clamonacc clamsubmit clang cli client colord colordiff concheck context corefonts cplugins creds cron crypt cscope css ctype cups curl custom-modes cvs cxx dbus declarative dga discover display-manager djvu dovecot-sasl dri driver drm dropbox dts dv dvb dvd dvdr efiemu egl emoji enca encode eps epspdf epub equalizer evdev exif exiscan-acl expat extra extras fam farstream fastcgi fbcon ffmpeg fileinfo firewall flac flatfile fluidsynth fontconfig fontforge fonts fortran fpm freetype ftp gbm gd gdbm gdm gegl geoip geolocation ggi gif gimp git gles gles2 gles3 glib glut gnuefi gnuplot gnutls gphoto2 gpm gps graphics graphviz grub gssapi gstreamer gtk gui gzip harfbuzz hash hddtemp hdri heif hostonly hscolour humanities hunspell hwloc iconv icu id3tag idn imagemagick imagequant imap imlib importwizard infinality inotify intl introspection iproute2 ipv6 jack java javascript jbig jpeg jpeg2k kde kdesu kerberos kms kwallet ladspa lame lash lastfm latex lcms ldap leaps-timezone lha libass libcaca libcxx libglvnd libkms libmpv libnotify libressl libtirpc lm-sensors lto luatex lz4 lzma lzo m17n-lib mad maildir matroska mdnsresponder-compat memcached metapost midi mikmod minizip mktemp mms mng mod modplug modules mount mp3 mp4 mpeg mpris mtp multilib multimedia musepack music nas nat ncurses networkmanager nfs nfsv41 nls nptl nscd nsplugin ntfsdecrypt objc objc++ objc-gc ocaml ocamlopt odbc odk ogg openal openexr opengl openmp openssl opus orc osc p2p pam pango pcntl pcre pda pdf pdfannotextractor pdfimport pdo perl phonon php pkcs11 plasma plotutils plugins plymouth png policykit postfix postgres postscript ppds prdr printsupport proprietary-codecs publishers pulseaudio pvr python qml qrcode qt5 quicktime radius rar raw rdp readline realtime recode repart rpm rpm4 ruby samba sasl scanner science screencast sctp sddm sdl seccomp semantic-desktop session sftp share shorten smp snappy sndfile snmp sockets socks5 sound spamassassin spell split-usr sqlite ssl sssd startup-notification sudo suexec suid svg sync-plugin-portage syslog systemd szip taglib tcmalloc tcpd tdls tex4ht texi2html themes theora threads thunderbolt tidy tiff timidity tokenizer truetype uchardet udev udisks uefi uncommon-eap-types unicode unwind upnp upnp-av upower urandom usb user-session uuid uvm v4l vaapi vcd vdpau vhosts vim-syntax vnc vorbis vpx vulkan wavpack webengine webkit webp webrtc-aec webui widevine widgets wifi winbind wmf woff2 wps wxwidgets x264 x265 xattr xcb xcomposite xcsecurity xetex xface xft xindy xine xinerama xkb xml xmlreader xmlrpc xmlwriter xmpp xosd xpm xscreensaver xslt xv xvid xvmc zeroconf zink zip zlib zstd" ABI_X86="32 64" ADA_TARGET="gnat_2020" APACHE2_MODULES="access_compat actions alias auth_basic auth_digest authn_alias authn_anon authn_core authn_dbd authn_dbm authn_default authn_file authn_socache authz_core authz_dbm authz_default authz_groupfile authz_host authz_owner authz_user autoindex brotli cache cache_socache cgi cgid dav dav_fs dav_lock dbd deflate dir disk_cache env expires ext_filter file_cache filter headers include info log_config logio mem_cache mime mime_magic negotiation rewrite setenvif socache_shmcb speling status unique_id unixd userdir usertrack vhost_alias asis authz_dbd cache_disk cern_meta charset_lite dumpio http2 ident imagemap lbmethod_bybusyness lbmethod_byrequests lbmethod_bytraffic lbmethod_heartbeat log_forensic macro proxy proxy_ajp proxy_balancer proxy_connect proxy_fcgi proxy_ftp proxy_html proxy_http proxy_http2 proxy_scgi proxy_wstunnel ratelimit remoteip reqtimeout session session_cookie session_crypto session_dbd slotmem_shm socache_memcache substitute version watchdog xml2enc"

And of course, the package [profile=]app-misc/ca-certificates-20210119.3.66[/profile] is installed.

Do anyone has any ideas? Am I missing something???

Thanks,

[grknight]

Did you set some strange umask somewhere?

The permissions should be something like the following (all files in the directories should have similar permissions):

Code: Select all

$ ls -ld /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/
drwxr-xr-x 3 root root  12288 Dec 16 11:16 /etc/ssl/certs/
-rw-r--r-- 1 root root 200374 Nov  8 10:21 /etc/ssl/certs/ca-certificates.crt

 $ ls -ldh /usr/share/ca-certificates/mozilla/{,Secure_Global_CA.crt} /usr/share/ca-certificates
drwxr-xr-x 3 root root 21 Oct 12  2016 /usr/share/ca-certificates/
drwxr-xr-x 2 root root 8.0K Nov  8 10:21 /usr/share/ca-certificates/mozilla/
-rw-r--r-- 1 root root 1.4K Nov  8 10:21 /usr/share/ca-certificates/mozilla/Secure_Global_CA.crt

[pogwizd]

No, nothing of the sort.
To be franc, I never change anything in those folders...

Here are mine, to be in the safe place

Code: Select all

~ # ls -ld /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/
drwxr-xr-x 3 root root  12288 02-04 23:35 /etc/ssl/certs/
-rw-r--r-- 1 root root 201341 02-04 23:01 /etc/ssl/certs/ca-certificates.crt

Code: Select all

~ # ls -ldh /usr/share/ca-certificates/mozilla/{,Secure_Global_CA.crt} /usr/share/ca-certificates
drwxr-xr-x 4 root root 4.0K 02-04 23:01 /usr/share/ca-certificates
drwxr-xr-x 2 root root  12K 02-04 23:01 /usr/share/ca-certificates/mozilla/
-rw-r--r-- 1 root root 1.4K 02-04 23:01 /usr/share/ca-certificates/mozilla/Secure_Global_CA.crt

[Hu]

Please show instead namei -l /etc/ssl/certs/ca-certificates.crt /usr/share/ca-certificates/mozilla/Secure_Global_CA.crt, so that we see the permissions on every step of the path.

[pogwizd]

Here you go

Code: Select all

~ # namei -l /etc/ssl/certs/ca-certificates.crt /usr/share/ca-certificates/mozilla/Secure_Global_CA.crt
f: /etc/ssl/certs/ca-certificates.crt
drwxr-xr-x root root /
drwxr-xr-x root root etc
drwxr-xr-x root root ssl
drwxr-xr-x root root certs
-rw-r--r-- root root ca-certificates.crt
f: /usr/share/ca-certificates/mozilla/Secure_Global_CA.crt
drwxr-xr-x root root /
drwxr-xr-x root root usr
drwxr-xr-x root root share
drwxr-xr-x root root ca-certificates
drwxr-xr-x root root mozilla
-rw-r--r-- root root Secure_Global_CA.crt

[pogwizd]

Hi everyone,

Ok, so I've got this finally working. For this, here is what I had to do:

• Add the nss flag to net-misc/curl
• Emerge manually the package dev-libs/nss-pem

The solution was given thanks to Ionen (from the following post: viewtopic-p-8498190.html#8498190)
The only difference from this post is that I have net-misc/curl installed with both nss and openssl flags:

So for info:

Code: Select all

# emerge net-misc/curl -p

These are the packages that would be merged, in order:

Calculating dependencies... done!
[ebuild   R    ] net-misc/curl-7.81.0::gentoo  USE="brotli ftp gnutls http2 idn imap ipv6 kerberos ldap nss openssl pop3 progress-meter samba smtp ssl tftp threads zstd -adns -alt-svc -gopher -hsts -mbedtls (-nghttp3) -quiche -rtmp -ssh -sslv3 -static-libs -telnet -test" ABI_X86="32 (64) (-x32)" CURL_SSL="nss -gnutls -mbedtls -openssl" 0 KiB