Closed petr-fischer closed 1 year ago
I experience the same!
"CAfile: none" indicates that curl is not using /usr/local/share/certs/ca-root-nss.crt for certificate validation and cert material in /etc is too old to verify. I'm guessing that your curl port was not compiled with the CA_BUNDLE=on option?
I'm also guessing /etc/ssl/certs/ is not populated in your setup, you can do that with "certctl rehash"
Works for me. Thanks!
portupugrade security/ca_root_nss
-- or --
pkg upgrade security/ca_root_nss
Well, or whatever. Root certificates need to be renewed. Current version - 3.88.1
certctl rehash
is the solution! Thanks to all!
But IMHO the FreeBSD ca_cert package postinstall section or something should be responsible for rehashing certificates. Is it appropriate to do something about it (freebsd forums, freebsd bugzilla)? Or is it ok?
But IMHO the FreeBSD ca_cert package postinstall section or something should be responsible for rehashing certificates. Is it appropriate to do something about it (freebsd forums, freebsd bugzilla)? Or is it ok?
No it shouldn't. Software in the ports either uses the ca_root_nss certificate bundle (/usr/local/share/certs/ca-root-nss.crt) directly or it relies on the trustststore of openssl (/etc/ssl/certs) being managed by the admin. For example the curl port has the CA_BUNDLE option for exactly this purpose, deactivate it and rely on the truststore, activate it and rely on ca_root_nss.
certctl is triggered by freebsd-update, so in case of updates to the CA certificates that are provided by FreeBSD itself it is taken care to have an up to date truststore.
So the question, while having nothing to do with dehydrated, is more.. why wasn't your /etc/ssl/certs updated by the tools in place and why isn't your curl port using the ca_root_nss without you knowing.
Just to chime in for others trying to find a solution for
ERROR: Problem connecting to server (get for https://acme-v02.api.letsencrypt.org/directory; curl returned with 60)
If your host has the wrong time, it will do this also. So check with date to see if your time has drifted or changed completely. In my case, my host had reset its time to "Sat Dec 21 00:26:16 CET 2013" when the correct time is "Fri Jan 19 12:07:07 CET 2024".
In the last months,
dehydrated -c
on my FreeBSD failed to renew some domain certs.Is there some problem with root certificates? (But I have them installed, see below).
Should the FreeBSD port maintainer do something? https://www.freshports.org/security/dehydrated/
Thanks!
Details:
dehydrated -c
curl -v https://acme-v02.api.letsencrypt.org/directory
dehydrated -v
uname -a
pkg info | grep -i cert