Certificate issue on pyra-handheld.com


Alec

Member
Joined
Mar 5, 2009
Messages
439
Starting Wednesday, there's been an issue with the site's certificate. With a browser everything is fine, but with something like curl or wget it fails:
Code:
$ curl https://pyra-handheld.com/boards/forums/pyra-news.250/index.rss
curl: (60) SSL certificate problem: unable to get local issuer certificate
More details here: https://curl.haxx.se/docs/sslcerts.html

curl failed to verify the legitimacy of the server and therefore could not
establish a secure connection to it. To learn more about this situation and
how to fix it, please visit the web page mentioned above.
I think it might be similar to this issue from a few years ago where it's mixing up Let's Encrypt and non-Let's Encrypt certificates in the chain:
Code:
$ openssl s_client -connect pyra-handheld.com:443
...
Certificate chain
0 s:CN = pyra-handheld.com
   i:C = US, O = Let's Encrypt, CN = Let's Encrypt Authority X3
1 s:C = US, O = DigiCert Inc, OU = www.digicert.com, CN = Thawte TLS RSA CA G1
   i:C = US, O = DigiCert Inc, OU = www.digicert.com, CN = DigiCert Global Root G2
 

levi

Still fresh, damnit!
Joined
Oct 6, 2008
Messages
13,157
Location
Somewhere off the coast of the EU
Yes, I get the same using curl. Traditionally, letsencrypt all relied on a non-letsencrypt cert as it's root, because to begin with they didn't own their own root cert so needed to rely on someone else's. But reportedly that needn't be the case for a few years now, and with todays certs only lasting a few months before they need to be renewed, I'm surprised that the letsencrypt cert this site is using is dependent on Thawte's root cert.
 

ingoreis

Advanced Member
Staff member
Joined
Jan 18, 2010
Messages
8,129
Age
39
Location
49.491276,8.423518
I have often Certificate Problems in many Sites...and i figured Out that my System Clock and Date was wrong.

After correcting the System Time...most of then Work again :)
 

EvilDragon

Administrator
Staff member
Joined
Mar 4, 2003
Messages
29,596
Age
43
Location
Ingolstadt
Yes, I get the same using curl. Traditionally, letsencrypt all relied on a non-letsencrypt cert as it's root, because to begin with they didn't own their own root cert so needed to rely on someone else's. But reportedly that needn't be the case for a few years now, and with todays certs only lasting a few months before they need to be renewed, I'm surprised that the letsencrypt cert this site is using is dependent on Thawte's root cert.
Ahh, again?
I'll recheck that... where the heck is it getting that old Thawte certificate from?
 

levi

Still fresh, damnit!
Joined
Oct 6, 2008
Messages
13,157
Location
Somewhere off the coast of the EU
Working now. I did receive a cacerts update to my linux box yesterday, dunno if that's what fixed it, but its now working for me.

The openssl command run today tells me it's backed by DST Root CA X3, not Thawte any more.
 
Top