Problem with SSL CA cert (path? access rights?) [RESOLVED]

Message

fredbear5150 · Post by **fredbear5150** » Sun Jul 25, 2021 8:15 am

I am currently building Gentoo on three old Thinkpads - all 32-bit with "pentium3", "pentium4" and "pentium-m" -march.

I am encountering the same SSL problem on all three of them when I try to add a specific overlay to them:

Code: Select all

┌─╼ root ╺─╸ tupa [~]
└────╼ layman -a miramir

 * Adding overlay...
 * Overlay "miramir" is not official. Continue installing? [y/n]: y
 * Running Git... # ( cd /var/lib/layman  && /usr/bin/git clone https://github.com/miramir/miramir-layman.git /var/lib/layman/miramir )
Cloning into '/var/lib/layman/miramir'...
fatal: unable to access 'https://github.com/miramir/miramir-layman.git/': Problem with the SSL CA cert (path? access rights?)
 * Failure result returned from Git
 * Running Git... # ( cd /var/lib/layman/miramir  && /usr/bin/git config user.name "layman" )
 * [Errno 2] No such file or directory: '/var/lib/layman/miramir'
 * Adding repository "miramir" failed!

 * CLI: Errors occurred processing action add
 * Adding repository "miramir" failed!

If I add steam-overlay in layman, it shows the same SSL error but I can still add and delete it.

I've also seen the same error in newsboat when curl tries to retrieve some specific newsfeeds.

I have unmerged and re-emerged both ca-certificates and openssl, but that doesn't fix the problem.

Here's my emerge --info:

Code: Select all

┌─╼ root ╺─╸ tupa [~]
└────╼ emerge --info
Portage 3.0.20 (python 3.9.5-final-0, default/linux/x86/17.0, gcc-10.3.0, glibc-2.33-r1, 5.10.52-gentoo i686)
=================================================================
System uname: Linux-5.10.52-gentoo-i686-Intel-R-_Core-TM-_Duo_CPU_T2400_@_1.83GHz-with-glibc2.33
KiB Mem:     3096908 total,   1766528 free
KiB Swap:    2097148 total,   2097148 free
Timestamp of repository gentoo: Fri, 23 Jul 2021 18:30:01 +0000
Head commit of repository gentoo: 38f74542b415b7d96c714b085f671cf21badd1ac
sh bash 5.1_p8
ld GNU ld (Gentoo 2.35.2 p1) 2.35.2
app-shells/bash:          5.1_p8::gentoo
dev-lang/perl:            5.34.0::gentoo
dev-lang/python:          3.8.10_p2::gentoo, 3.9.5_p2::gentoo
dev-lang/rust-bin:        1.52.1::gentoo
dev-util/cmake:           3.18.5::gentoo
sys-apps/baselayout:      2.7::gentoo
sys-apps/openrc:          0.42.1-r1::gentoo
sys-apps/sandbox:         2.24::gentoo
sys-devel/autoconf:       2.13-r1::gentoo, 2.69-r5::gentoo
sys-devel/automake:       1.16.3-r1::gentoo
sys-devel/binutils:       2.35.2::gentoo
sys-devel/gcc:            10.3.0-r2::gentoo
sys-devel/gcc-config:     2.4::gentoo
sys-devel/libtool:        2.4.6-r6::gentoo
sys-devel/make:           4.3::gentoo
sys-kernel/linux-headers: 5.10::gentoo (virtual/os-headers)
sys-libs/glibc:           2.33-r1::gentoo
Repositories:

gentoo
    location: /var/db/repos/gentoo
    sync-type: rsync
    sync-uri: rsync://arcturus/gentoo-portage
    priority: -1000
    sync-rsync-verify-jobs: 1
    sync-rsync-verify-max-age: 24
    sync-rsync-verify-metamanifest: yes
    sync-rsync-extra-opts: 

steam-overlay
    location: /var/lib/layman/steam-overlay
    sync-type: laymansync
    sync-uri: git://github.com/anyc/steam-overlay.git
    masters: gentoo
    priority: 50

ACCEPT_KEYWORDS="x86"
ACCEPT_LICENSE="*"
CBUILD="i686-pc-linux-gnu"
CFLAGS="-march=pentium-m -O2 -pipe"
CHOST="i686-pc-linux-gnu"
CONFIG_PROTECT="/etc /usr/share/gnupg/qualified.txt"
CONFIG_PROTECT_MASK="/etc/ca-certificates.conf /etc/dconf /etc/env.d /etc/fonts/fonts.conf /etc/gconf /etc/gentoo-release /etc/revdep-rebuild /etc/sandbox.d /etc/terminfo /etc/texmf/language.dat.d /etc/texmf/language.def.d /etc/texmf/updmap.d /etc/texmf/web2c"
CXXFLAGS="-march=pentium-m -O2 -pipe"
DISTDIR="/var/cache/distfiles"
EMERGE_DEFAULT_OPTS="--jobs=3 --load-average=2"
ENV_UNSET="CARGO_HOME DBUS_SESSION_BUS_ADDRESS DISPLAY GOBIN GOPATH PERL5LIB PERL5OPT PERLPREFIX PERL_CORE PERL_MB_OPT PERL_MM_OPT XAUTHORITY XDG_CACHE_HOME XDG_CONFIG_HOME XDG_DATA_HOME XDG_RUNTIME_DIR"
FCFLAGS="-march=pentium-m -O2 -pipe"
FEATURES="assume-digests binpkg-docompress binpkg-dostrip binpkg-logs config-protect-if-modified distlocks ebuild-locks fixlafiles ipc-sandbox merge-sync multilib-strict network-sandbox news parallel-fetch pid-sandbox preserve-libs protect-owned qa-unresolved-soname-deps sandbox sfperms strict unknown-features-warn unmerge-logs unmerge-orphans userfetch userpriv usersandbox usersync xattr"
FFLAGS="-march=pentium-m -O2 -pipe"
GENTOO_MIRRORS="ftp://mirror.bytemark.co.uk/gentoo/ https://mirror.bytemark.co.uk/gentoo/ http://mirror.bytemark.co.uk/gentoo/ rsync://mirror.bytemark.co.uk/gentoo/ ftp://mirrors.gethosted.online/gentoo https://mirrors.gethosted.online/gentoo http://mirrors.gethosted.online/gentoo https://www.mirrorservice.org/sites/distfiles.gentoo.org/ http://www.mirrorservice.org/sites/distfiles.gentoo.org/ ftp://ftp.mirrorservice.org/sites/distfiles.gentoo.org/ rsync://rsync.mirrorservice.org/distfiles.gentoo.org/"
LANG="en_GB.utf8"
LDFLAGS="-Wl,-O1 -Wl,--as-needed"
LINGUAS="en en_GB"
MAKEOPTS="-j3 -l2"
PKGDIR="/var/cache/binpkgs"
PORTAGE_CONFIGROOT="/"
PORTAGE_RSYNC_OPTS="--recursive --links --safe-links --perms --times --omit-dir-times --compress --force --whole-file --delete --stats --human-readable --timeout=180 --exclude=/distfiles --exclude=/local --exclude=/packages --exclude=/.git"
PORTAGE_TMPDIR="/var/tmp"
USE="X a52 aac acl acpi alsa avahi bluetooth branding bzip2 cairo cdda cddb cdparanoia cdr cli crypt cups curl cvs dbus dga djvu dri dvb dvd dvdr elogind encode exif fbcon ffmpeg flac fontconfig fortran freetype gallium gdbm geoip gif gimp git gnome-keyring gphoto2 gpm gstreamer gtk gtk3 gui gzip hddtemp iconv icu imagemagick imap imlib inotify joystick jpeg lame latex libcaca libglvnd libnotify libtirpc lirc lm_sensors lz4 lzma lzo mad matroska midi mikmod mmx mmxext mng modplug mp3 mp4 mpeg mplayer mtp musepack musicbrainz ncurses networkmanager nls nntp nptl ogg openal opengl openmp pam pcmcia pcre pdf perl png policykit postscript pulseaudio raw rdp readline rss samba savedconfig scanner sdl seccomp session smp sndfile sound sox speex split-usr sse sse2 sse3 ssl subversion svga syslog szip taglib tcpd theora threads tiff timidity truetype udev unicode upnp upnp-av usb v4l vcd vim-syntax vorbis wavpack webp wifi wmf x264 x86 xattr xcomposite xft xine xinerama xmpp xpm xv xvid zeroconf zip zlib" ABI_X86="32" ADA_TARGET="gnat_2018" ALSA_CARDS="intel8x0" APACHE2_MODULES="authn_core authz_core socache_shmcb unixd actions alias auth_basic authn_alias authn_anon authn_dbm authn_default authn_file authz_dbm authz_default authz_groupfile authz_host authz_owner authz_user autoindex cache cgi cgid dav dav_fs dav_lock deflate dir disk_cache env expires ext_filter file_cache filter headers include info log_config logio mem_cache mime mime_magic negotiation rewrite setenvif speling status unique_id userdir usertrack vhost_alias" CALLIGRA_FEATURES="karbon sheets words" COLLECTD_PLUGINS="df interface irq load memory rrdtool swap syslog" CPU_FLAGS_X86="mmx mmxext sse sse2 sse3" CURL_SSL="openssl" ELIBC="glibc" GPSD_PROTOCOLS="ashtech aivdm earthmate evermore fv18 garmin garmintxt gpsclock greis isync itrax mtk3301 nmea ntrip navcom oceanserver oldstyle oncore rtcm104v2 rtcm104v3 sirf skytraq superstar2 timing tsip tripmate tnt ublox ubx" INPUT_DEVICES="evdev libinput synaptics" KERNEL="linux" L10N="en en-GB" LCD_DEVICES="bayrad cfontz cfontz633 glk hd44780 lb216 lcdm001 mtxorb ncurses text" LIBREOFFICE_EXTENSIONS="presenter-console presenter-minimizer" LUA_SINGLE_TARGET="lua5-1" LUA_TARGETS="lua5-1" OFFICE_IMPLEMENTATION="libreoffice" PHP_TARGETS="php7-3 php7-4" POSTGRES_TARGETS="postgres10 postgres11" PYTHON_SINGLE_TARGET="python3_9" PYTHON_TARGETS="python3_9" RUBY_TARGETS="ruby26" SANE_BACKENDS="canon" USERLAND="GNU" VIDEO_CARDS="intel i915" XTABLES_ADDONS="quota2 psd pknock lscan length2 ipv4options ipset ipp2p iface geoip fuzzy condition tee tarpit sysrq proto steal rawnat logmark ipmark dhcpmac delude chaos account"
Unset:  CC, CPPFLAGS, CTARGET, CXX, INSTALL_MASK, LC_ALL, PORTAGE_BINHOST, PORTAGE_BUNZIP2_COMMAND, PORTAGE_COMPRESS, PORTAGE_COMPRESS_FLAGS, PORTAGE_RSYNC_EXTRA_OPTS, RUSTFLAGS

spica · Post by **spica** » Sun Jul 25, 2021 8:59 am

Could you check (and show here) from the same network what certificate is returned when accessing github.com?
If you're behind mitm proxy then our results will be different

Code: Select all

$ echo | openssl s_client -connect github.com:443 -servername github.com | openssl x509 -text -noout
depth=2 C = US, O = DigiCert Inc, OU = www.digicert.com, CN = DigiCert High Assurance EV Root CA
verify return:1
depth=1 C = US, O = "DigiCert, Inc.", CN = DigiCert High Assurance TLS Hybrid ECC SHA256 2020 CA1
verify return:1
depth=0 C = US, ST = California, L = San Francisco, O = "GitHub, Inc.", CN = github.com
verify return:1
DONE
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            0e:8b:f3:77:0d:92:d1:96:f0:bb:61:f9:3c:41:66:be
        Signature Algorithm: ecdsa-with-SHA256
        Issuer: C = US, O = "DigiCert, Inc.", CN = DigiCert High Assurance TLS Hybrid ECC SHA256 2020 CA1
        Validity
            Not Before: Mar 25 00:00:00 2021 GMT
            Not After : Mar 30 23:59:59 2022 GMT
        Subject: C = US, ST = California, L = San Francisco, O = "GitHub, Inc.", CN = github.com
***

fredbear5150 · Post by **fredbear5150** » Sun Jul 25, 2021 9:18 am

Here's the output, but I don't think it's relevant.

I ran the same command on the amd64 Gentoo PC that I am writing this message on and "diff" of the outputs of both commands is identical - and I don't get the error or overlay problems on this PC. The problem is more local to the 32-bit machines than that.

Code: Select all

┌─╼ root ╺─╸ tupa [~]
└────╼ echo | openssl s_client -connect github.com:443 -servername github.com | openssl x509 -text -noout
depth=2 C = US, O = DigiCert Inc, OU = www.digicert.com, CN = DigiCert High Assurance EV Root CA
verify return:1
depth=1 C = US, O = "DigiCert, Inc.", CN = DigiCert High Assurance TLS Hybrid ECC SHA256 2020 CA1
verify return:1
depth=0 C = US, ST = California, L = San Francisco, O = "GitHub, Inc.", CN = github.com
verify return:1
DONE
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            0e:8b:f3:77:0d:92:d1:96:f0:bb:61:f9:3c:41:66:be
        Signature Algorithm: ecdsa-with-SHA256
        Issuer: C = US, O = "DigiCert, Inc.", CN = DigiCert High Assurance TLS Hybrid ECC SHA256 2020 CA1
        Validity
            Not Before: Mar 25 00:00:00 2021 GMT
            Not After : Mar 30 23:59:59 2022 GMT
        Subject: C = US, ST = California, L = San Francisco, O = "GitHub, Inc.", CN = github.com
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (256 bit)
                pub:
                    04:ad:f6:f7:75:b1:d3:49:54:0a:5d:10:71:bd:dc:
                    25:06:4b:22:1c:a2:23:4e:9f:a1:fe:b9:d0:8c:bd:
                    39:bc:0c:23:c7:cf:91:a6:90:5a:d8:45:ab:03:13:
                    be:c1:23:7a:b9:c4:c8:9d:47:f6:96:e0:b9:76:6b:
                    50:36:66:f7:0d
                ASN1 OID: prime256v1
                NIST CURVE: P-256
        X509v3 extensions:
            X509v3 Authority Key Identifier: 
                keyid:50:61:A6:A0:D2:35:C4:11:2A:20:8D:1F:0F:AC:42:F0:CD:29:CF:4B

            X509v3 Subject Key Identifier: 
                27:B1:7E:9F:BB:26:99:50:D8:F3:C3:53:5B:FE:31:16:B0:BB:1E:72
            X509v3 Subject Alternative Name: 
                DNS:github.com, DNS:www.github.com
            X509v3 Key Usage: critical
                Digital Signature
            X509v3 Extended Key Usage: 
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 CRL Distribution Points: 

                Full Name:
                  URI:http://crl3.digicert.com/DigiCertHighAssuranceTLSHybridECCSHA2562020CA1.crl

                Full Name:
                  URI:http://crl4.digicert.com/DigiCertHighAssuranceTLSHybridECCSHA2562020CA1.crl

            X509v3 Certificate Policies: 
                Policy: 2.23.140.1.2.2
                  CPS: http://www.digicert.com/CPS

            Authority Information Access: 
                OCSP - URI:http://ocsp.digicert.com
                CA Issuers - URI:http://cacerts.digicert.com/DigiCertHighAssuranceTLSHybridECCSHA2562020CA1.crt

            X509v3 Basic Constraints: critical
                CA:FALSE
            CT Precertificate SCTs: 
                Signed Certificate Timestamp:
                    Version   : v1 (0x0)
                    Log ID    : 29:79:BE:F0:9E:39:39:21:F0:56:73:9F:63:A5:77:E5:
                                BE:57:7D:9C:60:0A:F8:F9:4D:5D:26:5C:25:5D:C7:84
                    Timestamp : Mar 25 18:57:33.978 2021 GMT
                    Extensions: none
                    Signature : ecdsa-with-SHA256
                                30:45:02:21:00:9E:E6:88:44:7F:FC:34:45:9C:32:4D:
                                9F:AB:94:86:06:AE:DD:63:2D:E2:F5:5F:63:97:46:8A:
                                0B:A5:39:D8:D7:02:20:48:54:27:D1:C6:32:B5:BF:81:
                                77:D7:EB:15:68:AC:F2:C8:EE:C9:01:AD:1F:CC:34:0C:
                                EE:C9:10:72:44:98:59
                Signed Certificate Timestamp:
                    Version   : v1 (0x0)
                    Log ID    : 22:45:45:07:59:55:24:56:96:3F:A1:2F:F1:F7:6D:86:
                                E0:23:26:63:AD:C0:4B:7F:5D:C6:83:5C:6E:E2:0F:02
                    Timestamp : Mar 25 18:57:34.009 2021 GMT
                    Extensions: none
                    Signature : ecdsa-with-SHA256
                                30:46:02:21:00:98:00:12:4A:09:41:18:AF:06:5C:28:
                                EF:1E:BB:DE:85:6C:7F:58:A9:D3:DE:96:B2:16:6A:99:
                                10:AE:2F:F2:69:02:21:00:DD:C5:F8:AD:BD:F0:68:B0:
                                CB:AB:80:B8:F0:D4:A8:52:67:30:E7:A3:F0:3B:F9:B6:
                                BB:09:D0:A6:B6:FE:CA:1D
    Signature Algorithm: ecdsa-with-SHA256
         30:44:02:20:2b:e2:af:ec:6f:bf:2a:45:a4:35:98:37:3d:c4:
         05:a7:ce:ba:67:b1:ba:b2:8c:68:6b:87:ad:49:9f:92:46:56:
         02:20:14:a2:5d:2d:b4:59:cf:b2:8c:3d:75:d6:73:f3:bd:05:
         02:7e:c3:f8:f8:32:99:dc:af:b6:18:ab:04:44:3e:9d

fredbear5150 · Post by **fredbear5150** » Sun Jul 25, 2021 9:38 am

I was just reading another web page about this problem and found this.

Here's my 32-bit machine failing with curl and SSL:

Code: Select all

┌─╼ root ╺─╸ tupa [~]
└╼ curl -vvv https://www.unixy.net
*   Trying 76.72.168.132:443...
* Connected to www.unixy.net (76.72.168.132) port 443 (#0)
* Initializing NSS with certpath: none
* WARNING: failed to load NSS PEM library libnsspem.so. Using OpenSSL PEM certificates will not work.
*  CAfile: /etc/ssl/certs/ca-certificates.crt
*  CApath: /etc/ssl/certs
* Closing connection 0
curl: (77) Problem with the SSL CA cert (path? access rights?)

Here's my 64-bit machine passing with the same command:

Code: Select all

 curl -vvv https://www.unixy.net | head -40
*   Trying 76.72.168.132:443...
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0* Connected to www.unixy.net (76.72.168.132) port 443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* successfully set certificate verify locations:
*  CAfile: /etc/ssl/certs/ca-certificates.crt
*  CApath: /etc/ssl/certs
} [5 bytes data]
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
} [512 bytes data]
* TLSv1.3 (IN), TLS handshake, Server hello (2):
{ [109 bytes data]
* NPN, negotiated HTTP2 (h2)
{ [5 bytes data]
* TLSv1.2 (IN), TLS handshake, Certificate (11):
{ [4628 bytes data]
* TLSv1.2 (IN), TLS handshake, Server key exchange (12):
{ [333 bytes data]
* TLSv1.2 (IN), TLS handshake, Server finished (14):
{ [4 bytes data]
* TLSv1.2 (OUT), TLS handshake, Client key exchange (16):
} [70 bytes data]
* TLSv1.2 (OUT), TLS change cipher, Change cipher spec (1):
} [1 bytes data]
* TLSv1.2 (OUT), TLS handshake, Next protocol (67):
} [36 bytes data]
* TLSv1.2 (OUT), TLS handshake, Finished (20):
} [16 bytes data]
* TLSv1.2 (IN), TLS handshake, Finished (20):
{ [16 bytes data]
* SSL connection using TLSv1.2 / ECDHE-RSA-AES256-GCM-SHA384
* ALPN, server did not agree to a protocol
* Server certificate:
*  subject: OU=Domain Control Validated; OU=PositiveSSL Wildcard; CN=*.unixy.net
*  start date: Sep 27 00:00:00 2019 GMT
*  expire date: Sep 26 23:59:59 2021 GMT
*  subjectAltName: host "www.unixy.net" matched cert's "*.unixy.net"
*  issuer: C=GB; ST=Greater Manchester; L=Salford; O=Sectigo Limited; CN=Sectigo RSA Domain Validation Secure Server CA
*  SSL certificate verify ok.
* Using HTTP2, server supports multi-use
* Connection state changed (HTTP/2 confirmed)
* Copying HTTP/2 data in stream buffer to connection buffer after upgrade: len=0
* Using Stream ID: 1 (easy handle 0x557fb18899d0)
} [5 bytes data]
> GET / HTTP/2
> Host: www.unixy.net
> user-agent: curl/7.77.0
> accept: */*
> 
{ [5 bytes data]
* Connection state changed (MAX_CONCURRENT_STREAMS == 128)!
} [5 bytes data]
< HTTP/2 200 
< server: nginx
< date: Sun, 25 Jul 2021 09:35:25 GMT
< content-type: text/html
< content-length: 53044
< vary: Accept-Encoding
< cache-control: max-age = 432000
< x-cacheable: YES
< accept-ranges: bytes
< x-varnish: 1953434878 1953432141
< via: 1.1 varnish
< age: 0
< x-cache: HIT
< x-cache-hits: 4
< x-cache: HIT from Backend
< 
{ [16152 bytes data]
<!DOCTYPE html>
<html lang="en">
<head>
...
...

What's the relevance of libnsspem.so? I can't find any library of that name, even the working system.

fredbear5150 · Post by **fredbear5150** » Sun Jul 25, 2021 10:06 am

I didn't realise that this was ultimately a problem just with curl, not layman or git.

It turned out to be the CURL_SSL setting that was the problem - "nss" on the failing 32-bit machines, "openssl" on the working 64 bit machines.

I re-emerged curl with CURL_SSL="openssl" and that fixed it.