SAIA feeds are down due to unknown issuer certificate #122

New Issue

lucidiot · 2023-01-02T14:48:14Z

lucidiot commented

2023-01-02 14:48:14 +00:00

The 12 custom feeds of SAIA are failing due to a good old curl: (60) SSL certificate problem: unable to get local issuer certificate.

λ ~/ openssl s_client -connect havkom.se:443 </dev/null
CONNECTED(00000003)
depth=0 C = SE, L = Stockholm, O = Statens haverikommission, CN = havkom.se
verify error:num=20:unable to get local issuer certificate
verify return:1
depth=0 C = SE, L = Stockholm, O = Statens haverikommission, CN = havkom.se
verify error:num=21:unable to verify the first certificate
verify return:1
---
Certificate chain
 0 s:C = SE, L = Stockholm, O = Statens haverikommission, CN = havkom.se
   i:C = US, O = DigiCert Inc, CN = DigiCert TLS RSA SHA256 2020 CA1
---

The exact same error occurs with www.havkom.se. For some reason, on another website also signed by DigiCert TLS RSA SHA256 2020 CA1, the verification does work:

λ ~/ openssl s_client -connect duckduckgo.com:443 </dev/null
CONNECTED(00000003)
depth=2 C = US, O = DigiCert Inc, OU = www.digicert.com, CN = DigiCert Global Root CA
verify return:1
depth=1 C = US, O = DigiCert Inc, CN = DigiCert TLS RSA SHA256 2020 CA1
verify return:1
depth=0 C = US, ST = Pennsylvania, L = Paoli, O = "Duck Duck Go, Inc.", CN = *.duckduckgo.com
verify return:1
---
Certificate chain
 0 s:C = US, ST = Pennsylvania, L = Paoli, O = "Duck Duck Go, Inc.", CN = *.duckduckgo.com
   i:C = US, O = DigiCert Inc, CN = DigiCert TLS RSA SHA256 2020 CA1
 1 s:C = US, O = DigiCert Inc, CN = DigiCert TLS RSA SHA256 2020 CA1
   i:C = US, O = DigiCert Inc, OU = www.digicert.com, CN = DigiCert Global Root CA
---

Both havkom.se and DuckDuckGo work inside a web browser as well.

The 12 custom feeds of SAIA are failing due to a good old `curl: (60) SSL certificate problem: unable to get local issuer certificate`. ``` λ ~/ openssl s_client -connect havkom.se:443 </dev/null CONNECTED(00000003) depth=0 C = SE, L = Stockholm, O = Statens haverikommission, CN = havkom.se verify error:num=20:unable to get local issuer certificate verify return:1 depth=0 C = SE, L = Stockholm, O = Statens haverikommission, CN = havkom.se verify error:num=21:unable to verify the first certificate verify return:1 --- Certificate chain 0 s:C = SE, L = Stockholm, O = Statens haverikommission, CN = havkom.se i:C = US, O = DigiCert Inc, CN = DigiCert TLS RSA SHA256 2020 CA1 --- ``` The exact same error occurs with `www.havkom.se`. For some reason, on another website also signed by `DigiCert TLS RSA SHA256 2020 CA1`, the verification does work: ``` λ ~/ openssl s_client -connect duckduckgo.com:443 </dev/null CONNECTED(00000003) depth=2 C = US, O = DigiCert Inc, OU = www.digicert.com, CN = DigiCert Global Root CA verify return:1 depth=1 C = US, O = DigiCert Inc, CN = DigiCert TLS RSA SHA256 2020 CA1 verify return:1 depth=0 C = US, ST = Pennsylvania, L = Paoli, O = "Duck Duck Go, Inc.", CN = *.duckduckgo.com verify return:1 --- Certificate chain 0 s:C = US, ST = Pennsylvania, L = Paoli, O = "Duck Duck Go, Inc.", CN = *.duckduckgo.com i:C = US, O = DigiCert Inc, CN = DigiCert TLS RSA SHA256 2020 CA1 1 s:C = US, O = DigiCert Inc, CN = DigiCert TLS RSA SHA256 2020 CA1 i:C = US, O = DigiCert Inc, OU = www.digicert.com, CN = DigiCert Global Root CA --- ``` Both havkom.se and DuckDuckGo work inside a web browser as well.

lucidiot added the

bug

feed

labels 2023-01-02 14:48:14 +00:00

lucidiot self-assigned this 2023-01-02 14:48:14 +00:00

lucidiot referenced this issue from a commit

2023-01-03 11:11:31 +00:00

Disable SSL verification on SAIA, closes #122

lucidiot closed this issue

2023-01-03 11:11:31 +00:00

Sign in to join this conversation.