ca-certificate update?

Discussion in 'Support Area' started by Silent-Hunter, Oct 5, 2017.

  1. Silent-Hunter

    Silent-Hunter Advanced Member

    Joined:
    May 29, 2010
    Messages:
    2,699
    It seems Links no longer loads SSL content, I checked and our certificates are from 2014. Any chance of an update?
     
    Tags:
    FBnil likes this.
  2. notaz

    notaz Certified Guru

    Joined:
    Aug 23, 2005
    Messages:
    4,904
    Location:
    Lithuania
    No pages at all?
    I might take a look at it at the weekend, feel free to remind me in case I forget.
     
    levi likes this.
  3. Silent-Hunter

    Silent-Hunter Advanced Member

    Joined:
    May 29, 2010
    Messages:
    2,699
    Google loads fine, but Wikia doesn't load most images. It gives SSL errors.
     
  4. FBnil

    FBnil What is laugh? Baby don't hurt me....

    Joined:
    Dec 14, 2012
    Messages:
    2,334
    Location:
    Yurp
    I noticed that 2 months ago too. Tried some of the parameters, but failed and forgot about it (I read alterslash with it)
     
  5. levi

    levi Still fresh, damnit!

    Joined:
    Oct 6, 2008
    Messages:
    9,517
    Location:
    Somewhere off the coast of the EU
    Do these boards work? My phone needs new certs to the degree that I basically can't use it at all for web browsing since https everywhere started up, but getting the certs in the right format and bluetoothing them over is such a faff that I haven't bothered. Hurrah for the Pandora OS being basically just linux, and hurrah for Notaz and anyone else keeping this boat afloat.
     
  6. FBnil

    FBnil What is laugh? Baby don't hurt me....

    Joined:
    Dec 14, 2012
    Messages:
    2,334
    Location:
    Yurp
    Hip hip Huraay! No-taz, NO-TAZ! Rocks!
     
  7. notaz

    notaz Certified Guru

    Joined:
    Aug 23, 2005
    Messages:
    4,904
    Location:
    Lithuania
    I've updated ca-certificates, the update throws some errors about doing something with certificates removed by this very update, but the final result is similar to what I have on the desktop.

    However the mentioned alterslash.org still doesn't work. Seems to be some more involved issue, probably openssl/gnutls is too old to support some newer variation of TLS:
    Code:
    $ sudo opkg install libgnutls-bin
    $ gnutls-cli alterslash.org
    Resolving 'alterslash.org'...
    Connecting to '104.28.3.53:443'...
    *** Fatal error: A TLS fatal alert has been received.
    *** Received alert [40]: Handshake failed
    *** Handshake has failed
    GNUTLS ERROR: A TLS fatal alert has been received.
    $ openssl s_client -connect alterslash.org:443
    CONNECTED(00000003)
    14670:error:14077410:SSL routines:SSL23_GET_SERVER_HELLO:sslv3 alert handshake failure:s23_clnt.c:579:
    
    If anyone has ideas what could be done now let me know, otherwise I think I'll just give up for now.
     
    levi likes this.
  8. Linux-SWAT

    Linux-SWAT Hardcore Member

    Joined:
    Feb 13, 2010
    Messages:
    8,037
    Sslv3 was deprecated. Maybe it's a fallback alert.
     
    levi likes this.
  9. levi

    levi Still fresh, damnit!

    Joined:
    Oct 6, 2008
    Messages:
    9,517
    Location:
    Somewhere off the coast of the EU
    I know the Pandora's running a fairly crusty version of openssh at least; I noticed it never picked up my elliptic curve keys, so I had to generate a monster rsa key for it and add its public key to servers I want it to be able to talk to.
     
  10. Silent-Hunter

    Silent-Hunter Advanced Member

    Joined:
    May 29, 2010
    Messages:
    2,699
    Unfortunately I still get SSL errors.
     
  11. Hitnrun

    Hitnrun Member

    Joined:
    Mar 1, 2008
    Messages:
    427
    Now this is preventing from downloading for github.com at all, git clone from github doesn't work because of this.
    I heard of this sslv3 being deprecated, the ssl library on the pandora may be too old.
    --- Double Post Merged, Mar 4, 2018, Original Post Date: Mar 4, 2018 ---
    Using the git from the codeblocks pnd, github.com works again. Must be some old library on the pandora itself.
     
  12. directive0

    directive0 Very Active Member

    Joined:
    Apr 8, 2015
    Messages:
    708
    Location:
    Toronto, Canada
    I too have been unable to use git when downloaded from opkg. However the git included in the Codeblocks and C++ dev tools seems to work.
     
  13. levi

    levi Still fresh, damnit!

    Joined:
    Oct 6, 2008
    Messages:
    9,517
    Location:
    Somewhere off the coast of the EU
    On my arch box which I have to hand, git depends on the following:
    curl expat>=2.0 perl-error perl>=5.14.0 openssl pcre2 grep shadow

    Of those, if your getting encryption errors it would suggest we need a newer version of openssl and possible curl. Unfortunately, openssl contains rather a lot of libs so porting it to sz just as a hacky trial is left as an exercise for the reader.
     
  14. HelenF

    HelenF Member

    Joined:
    Jun 22, 2013
    Messages:
    364
    Location:
    UK
    A while back I was getting certificate errors with the git in CodeBlocks when trying to clone from GitHub with the "https" URLs it provides, and the solution then was to change from "https" to "git" URL.
     
  15. directive0

    directive0 Very Active Member

    Joined:
    Apr 8, 2015
    Messages:
    708
    Location:
    Toronto, Canada
    Which is great, but for things like push its not really a solution.
     
  16. levi

    levi Still fresh, damnit!

    Joined:
    Oct 6, 2008
    Messages:
    9,517
    Location:
    Somewhere off the coast of the EU
    Really? Surely you can edit your .git/config and replace any https:// addresses with git:// addresses. That should fix git push.
     
  17. directive0

    directive0 Very Active Member

    Joined:
    Apr 8, 2015
    Messages:
    708
    Location:
    Toronto, Canada
    I didn't know that was an option, I'll try and report back.
     

Share This Page

Loading...