Certificate issue on pyra-handheld.com


Alec

Member
Joined
Mar 5, 2009
Messages
440
Starting Wednesday, there's been an issue with the site's certificate. With a browser everything is fine, but with something like curl or wget it fails:
Code:
$ curl https://pyra-handheld.com/boards/forums/pyra-news.250/index.rss
curl: (60) SSL certificate problem: unable to get local issuer certificate
More details here: https://curl.haxx.se/docs/sslcerts.html

curl failed to verify the legitimacy of the server and therefore could not
establish a secure connection to it. To learn more about this situation and
how to fix it, please visit the web page mentioned above.

I think it might be similar to this issue from a few years ago where it's mixing up Let's Encrypt and non-Let's Encrypt certificates in the chain:
Code:
$ openssl s_client -connect pyra-handheld.com:443
...
Certificate chain
0 s:CN = pyra-handheld.com
   i:C = US, O = Let's Encrypt, CN = Let's Encrypt Authority X3
1 s:C = US, O = DigiCert Inc, OU = www.digicert.com, CN = Thawte TLS RSA CA G1
   i:C = US, O = DigiCert Inc, OU = www.digicert.com, CN = DigiCert Global Root G2
 

levi

Still fresh, damnit!
Joined
Oct 6, 2008
Messages
13,489
Location
Somewhere off the coast of the EU
Yes, I get the same using curl. Traditionally, letsencrypt all relied on a non-letsencrypt cert as it's root, because to begin with they didn't own their own root cert so needed to rely on someone else's. But reportedly that needn't be the case for a few years now, and with todays certs only lasting a few months before they need to be renewed, I'm surprised that the letsencrypt cert this site is using is dependent on Thawte's root cert.
 

ingoreis

Advanced Member
Staff member
Joined
Jan 18, 2010
Messages
8,140
Age
39
Location
49.491276,8.423518
I have often Certificate Problems in many Sites...and i figured Out that my System Clock and Date was wrong.

After correcting the System Time...most of then Work again :)
 

EvilDragon

Administrator
Staff member
Joined
Mar 4, 2003
Messages
29,641
Age
43
Location
Ingolstadt
Yes, I get the same using curl. Traditionally, letsencrypt all relied on a non-letsencrypt cert as it's root, because to begin with they didn't own their own root cert so needed to rely on someone else's. But reportedly that needn't be the case for a few years now, and with todays certs only lasting a few months before they need to be renewed, I'm surprised that the letsencrypt cert this site is using is dependent on Thawte's root cert.

Ahh, again?
I'll recheck that... where the heck is it getting that old Thawte certificate from?
 

levi

Still fresh, damnit!
Joined
Oct 6, 2008
Messages
13,489
Location
Somewhere off the coast of the EU
Working now. I did receive a cacerts update to my linux box yesterday, dunno if that's what fixed it, but its now working for me.

The openssl command run today tells me it's backed by DST Root CA X3, not Thawte any more.
 

Phlyra

Electric
Joined
Jul 25, 2019
Messages
473
Anyone else have trouble connecting to pyra-handheld.com and dragonbox.de earlier today?
I tried on my phone (with Wi-Fi both on and off) and on a laptop but kept getting the message that my browser couldn’t open page as the website’s server wasn’t responding :( Other websites loaded without a problem though...
 

pyrat

Very Active Member
Joined
May 20, 2016
Messages
400
Anyone else have trouble connecting to pyra-handheld.com and dragonbox.de earlier today?
I tried on my phone (with Wi-Fi both on and off) and on a laptop but kept getting the message that my browser couldn’t open page as the website’s server wasn’t responding :( Other websites loaded without a problem though...
I couldn't connect some hours ago (6-8, I don't remember). I was busy and didn't look for causes, so it could be on my side, but I could browse other sites.
 

JDTAY

Half Pepperoni, All Cheese
Joined
Sep 15, 2015
Messages
1,333
Age
33
Location
North Carolina, USA
Anyone else have trouble connecting to pyra-handheld.com and dragonbox.de earlier today?
I tried on my phone (with Wi-Fi both on and off) and on a laptop but kept getting the message that my browser couldn’t open page as the website’s server wasn’t responding :( Other websites loaded without a problem though...
We were discussing this on Discord too.

According to the dragon himself:
"Huh. Apache2 hung."
"Hasn't done that for months."
 

Null

Witty remark.
Joined
Jun 16, 2007
Messages
10,690
Although my internet has been spotty today, so perhaps it was me.

The site was down for me too. So I was reduced to getting my daily dose of human interaction by shouting at the TV.
 
Top