search

istio / istio.io

Source for the istio.io site
https://istio.io/
Apache License 2.0
762 stars 1.53k forks source link

gcsweb.istio.io certificate has expired #2932

Closed hpohl closed 5 years ago

hpohl commented 5 years ago 
$ curl -vvv https://gcsweb.istio.io/gcs/istio-prerelease/prerelease/1.1.0-snapshot.3/charts/index.yaml
*   Trying 35.185.199.142...
* TCP_NODELAY set
* Connected to gcsweb.istio.io (35.185.199.142) port 443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* successfully set certificate verify locations:
*   CAfile: /etc/ssl/certs/ca-certificates.crt
  CApath: none
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* TLSv1.3 (IN), TLS handshake, Server hello (2):
* TLSv1.2 (IN), TLS handshake, Certificate (11):
* TLSv1.2 (OUT), TLS alert, certificate expired (557):
* SSL certificate problem: certificate has expired
* Closing connection 0
curl: (60) SSL certificate problem: certificate has expired
More details here: https://curl.haxx.se/docs/sslcerts.html

curl failed to verify the legitimacy of the server and therefore could not
establish a secure connection to it. To learn more about this situation and
how to fix it, please visit the web page mentioned above.

Please renew :)

hpohl commented 5 years ago

For those having the same issue, you can use https://storage.googleapis.com/istio-prerelease/prerelease/1.1.0-snapshot.3/charts as well.

hpohl commented 5 years ago

Fixed, thank you :)

brianmlima commented 5 years ago

Looks like this is happening again. curl -vvv https://gcsweb.istio.io/gcs/istio-release/releases/1.2.2/charts/index.yaml

curl performs SSL certificate verification by default, using a "bundle" of Certificate Authority (CA) public keys (CA certs). If the default bundle file isn't adequate, you can specify an alternate file using the --cacert option. If this HTTPS server uses a certificate signed by a CA represented in the bundle, the certificate verification probably failed due to a problem with the certificate (it might be expired, or the name might not match the domain name in the URL). If you'd like to turn off curl's verification of the certificate, use the -k (or --insecure) option. HTTPS-proxy has similar options --proxy-cacert and --proxy-insecure.