search

KSP-CKAN / CKAN

The Comprehensive Kerbal Archive Network
https://forum.kerbalspaceprogram.com/index.php?/topic/197082-*
Other
1.96k stars 349 forks source link

Ssl error:1000007d:SSL routines:OPENSSL_internal:CERTIFICATE_VERIFY_FAILED #3567

Closed judemille closed 2 years ago

judemille commented 2 years ago

Background

Have you made any manual changes to your GameData folder (i.e., not via CKAN)? No

My ca-certificates package is up to date, I have tried syncing the Mono certificate store with the system one. The Let's Encrypt X3 certificate is not present anywhere on this system. Would debug further if able, but I do not feel like figuring out how to use the proper debugger for Mono.

Problem

Describe the bug An invalid certificate error is thrown when downloading Kerbal Attachment System and Kerbal Inventory System.

Steps to reproduce Attempt to install Kerbal Attachment System or Kerbal Inventory System

Expected behavior The mods install.

Screenshots (if applicable) image

CKAN error code (if applicable): Unsure if this is a CKAN error code, appears more to be from OpenSSL but

Error downloading KAS 1.10: Ssl error:1000007d:SSL routines:OPENSSL_internal:CERTIFICATE_VERIFY_FAILED
                 at /build/mono/src/mono/external/boringssl/ssl/handshake_client.c:1132
Error downloading KIS 1.29: Ssl error:1000007d:SSL routines:OPENSSL_internal:CERTIFICATE_VERIFY_FAILED
                 at /build/mono/src/mono/external/boringssl/ssl/handshake_client.c:1132
DasSkelett commented 2 years ago

Try explicitly blocklisting the certificate as explained here

judemille commented 2 years ago

I believe I installed this system after the X3 issues happened. There is no file at /etc/ssl/certs/DST_Root_CA_X3.pem to copy for that fix.

judemille commented 2 years ago

I'm not sure if just waiting fixed it, but I downloaded that certificate from Let's Encrypt and put that in /etc/ca-certificates/trust-source/blocklist/ and followed the rest of the guide. That appears to have worked, and now things download properly. Perhaps add that to the wiki? It seems odd that my system would get hung up over a certificate that's never been in its store. Perhaps Spacedock needs to make a fix on their end.

judemille commented 2 years ago

On second thought, this must be some sort of Mono issue. This install of Arch has never had the DST Root X3 certificate in its store if I'm not mistaken, since it was installed after that certificate was removed. I had no issues visiting the Spacedock site in Firefox either.