Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > ger.ct > #289836 > unrolled thread
| Started by | Hermann Riemann <nospan.gerct08@hermann-riemann.de> |
|---|---|
| First post | 2016-12-24 10:49 +0100 |
| Last post | 2017-01-05 14:57 +0000 |
| Articles | 5 — 4 participants |
Back to article view | Back to ger.ct
trust? Hermann Riemann <nospan.gerct08@hermann-riemann.de> - 2016-12-24 10:49 +0100
Re: trust? Goetz Schultz <ng-delete-mailer@goetz.co.uk> - 2016-12-24 13:03 +0000
Re: trust? Hermann Riemann <nospam.gerct08@hermann-riemann.de> - 2017-01-04 14:22 +0100
Re: trust? Goetz Schultz <ng-delete-mailer@goetz.co.uk> - 2017-01-04 21:49 +0000
Re: trust? "Juergen P. Meier" <nospam-1984@jors.net> - 2017-01-05 14:57 +0000
| From | Hermann Riemann <nospan.gerct08@hermann-riemann.de> |
|---|---|
| Date | 2016-12-24 10:49 +0100 |
| Subject | trust? |
| Message-ID | <ec6ul6Fmi49U1@mid.individual.net> |
Das update bei SuSE (gestern über 5200 Pakete) kommt mir komisch vor.
Heute funktioniert update über GUI nicht.
Dafür habe ich bei zypper up u.a.folgendes angezeigt bekommen:
already trust 163, your new list has 164
Certificate added: C=IL, O=StartCom Ltd., OU=Secure Digital Certificate
Signing, CN=StartCom Certification Authority
Certificate added: C=CH, O=WISeKey, OU=OISTE Foundation Endorsed,
CN=OISTE WISeKey Global Root GB CA
Certificate added: C=DE, O=Deutsche Telekom AG, OU=T-TeleSec Trust
Center, CN=Deutsche Telekom Root CA 2
Certificate added: C=PL, O=Unizeto Technologies S.A., OU=Certum
Certification Authority, CN=Certum Trusted Network CA
Certificate added: C=PL, O=Krajowa Izba Rozliczeniowa S.A., CN=SZAFIR
ROOT CA2
Certificate added: C=US, O="VeriSign, Inc.", OU=VeriSign Trust Network,
OU="(c) 2008 VeriSign, Inc. - For authorized use only", CN=VeriSign
Universal Root Certification Authority
Certificate added: C=HU, L=Budapest, O=Microsec Ltd., OU=e-Szigno CA,
CN=Microsec e-Szigno Root CA
Certificate added: C=RO, O=certSIGN, OU=certSIGN ROOT CA
Certificate added: C=JP, O=SECOM Trust.net, OU=Security Communication
RootCA1
Certificate added: CN=EBG Elektronik Sertifika Hizmet Sağlayıcısı, O=EBG
Bilişim Teknolojileri ve Hizmetleri A.Ş., C=TR
Certificate added: C=TW, O=Government Root Certification Authority
Certificate added: CN=Atos TrustedRoot 2011, O=Atos, C=DE
Certificate added: C=JP, O="SECOM Trust Systems CO.,LTD.", OU=Security
Communication RootCA2
Certificate added: C=US, S=Arizona, L=Scottsdale, O="Starfield
Technologies, Inc.", CN=Starfield Root Certificate Authority - G2
Certificate added: C=SE, O=AddTrust AB, OU=AddTrust TTP Network,
CN=AddTrust Class 1 CA Root
Certificate added: C=CH, O=WISeKey, OU=Copyright (c) 2005, OU=OISTE
Foundation Endorsed, CN=OISTE WISeKey Global Root GA CA
Certificate added: C=NL, O=Staat der Nederlanden, CN=Staat der
Nederlanden Root CA - G2
Certificate added: C=BM, O=QuoVadis Limited, CN=QuoVadis Root CA 3 G3
Certificate added: OU=GlobalSign Root CA - R2, O=GlobalSign, CN=GlobalSign
Certificate added: C=TR, L=Gebze - Kocaeli, O=Türkiye Bilimsel ve
Teknolojik Araştırma Kurumu - TÜBİTAK, OU=Ulusal Elektronik ve
Kriptoloji Araştırma Enstitüsü - UEKAE, OU=Kamu Sertifikasyon Merkezi,
CN=TÜBİTAK UEKAE Kök Sertifika Hizmet Sağlayıcısı - Sürüm 3
Certificate added: C=IL, O=StartCom Ltd., CN=StartCom Certification
Authority G2
Certificate added: C=NO, O=Buypass AS-983163327, CN=Buypass Class 2 CA 1
Certificate added: C=FR, O=Certinomis, OU=0002 433998903, CN=Certinomis
- Autorité Racine
Certificate added: C=BM, O=QuoVadis Limited, CN=QuoVadis Root CA 1 G3
Certificate added: OU=GlobalSign ECC Root CA - R4, O=GlobalSign,
CN=GlobalSign
Certificate added: O=Digital Signature Trust Co., CN=DST Root CA X3
Certificate added: C=US, O=DigiCert Inc, OU=www.digicert.com,
CN=DigiCert High Assurance EV Root CA
Certificate added: C=JP, O="Japan Certification Services, Inc.",
CN=SecureSign RootCA11
Certificate added: C=HK, O=Hongkong Post, CN=Hongkong Post Root CA 1
Certificate added: C=BM, O=QuoVadis Limited, CN=QuoVadis Root CA 2
Certificate added: C=PL, O=Unizeto Sp. z o.o., CN=Certum CA
Certificate added: C=US, O=Entrust.net, OU=www.entrust.net/CPS incorp.
by ref. (limits liab.), OU=(c) 1999 Entrust.net Limited, CN=Entrust.net
Secure Server Certification Authority
Certificate added: C=JP, O="SECOM Trust Systems CO.,LTD.", OU=Security
Communication EV RootCA1
Certificate added: C=GB, S=Greater Manchester, L=Salford, O=COMODO CA
Limited, CN=COMODO Certification Authority
Certificate added: CN=TÜRKTRUST Elektronik Sertifika Hizmet Sağlayıcısı,
C=TR, L=Ankara, O=TÜRKTRUST Bilgi İletişim ve Bilişim Güvenliği
Hizmetleri A.Ş. (c) Aralık 2007
Certificate added: C=GB, S=Greater Manchester, L=Salford, O=COMODO CA
Limited, CN=COMODO RSA Certification Authority
Certificate added: C=US, O="VeriSign, Inc.", OU=VeriSign Trust Network,
OU="(c) 1999 VeriSign, Inc. - For authorized use only", CN=VeriSign
Class 1 Public Primary Certification Authority - G3
Certificate added: C=ch, O=Swisscom, OU=Digital Certificate Services,
CN=Swisscom Root EV CA 2
Certificate added: C=US, O=AffirmTrust, CN=AffirmTrust Commercial
Certificate added: C=US, OU=www.xrampsecurity.com, O=XRamp Security
Services Inc, CN=XRamp Global Certification Authority
Certificate added: C=US, O=IdenTrust, CN=IdenTrust Commercial Root CA 1
Certificate added: C=US, O="VeriSign, Inc.", OU=VeriSign Trust Network,
OU="(c) 2007 VeriSign, Inc. - For authorized use only", CN=VeriSign
Class 3 Public Primary Certification Authority - G4
Certificate added: C=US, O=IdenTrust, CN=IdenTrust Public Sector Root CA 1
Certificate added: C=CN, O=China Financial Certification Authority,
CN=CFCA EV ROOT
Certificate added: C=US, O="Starfield Technologies, Inc.", OU=Starfield
Class 2 Certification Authority
Certificate added: C=SK, L=Bratislava, O=Disig a.s., CN=CA Disig Root R1
Certificate added: C=US, O=GTE Corporation, OU="GTE CyberTrust
Solutions, Inc.", CN=GTE CyberTrust Global Root
Certificate added: C=TW, O="Chunghwa Telecom Co., Ltd.", OU=ePKI Root
Certification Authority
Certificate added: C=GB, S=Greater Manchester, L=Salford, O=COMODO CA
Limited, CN=COMODO ECC Certification Authority
Certificate added: C=CN, O=China Internet Network Information Center,
CN=China Internet Network Information Center EV Certificates Root
Certificate added: C=CN, O=WoSign CA Limited, CN=CA WoSign ECC Root
Certificate added: C=US, O=AffirmTrust, CN=AffirmTrust Premium ECC
Certificate added: E=contacto@procert.net.ve, L=Chacao, S=Miranda,
OU=Proveedor de Certificados PROCERT, O=Sistema Nacional de
Certificacion Electronica, C=VE, CN=PSCProcert
Certificate added: C=DE, O=D-Trust GmbH, CN=D-TRUST Root Class 3 CA 2 EV
2009
Certificate added: C=BE, O=GlobalSign nv-sa, OU=Root CA, CN=GlobalSign
Root CA
Certificate added: C=US, O=DigiCert Inc, OU=www.digicert.com,
CN=DigiCert Global Root CA
Certificate added: C=PL, O=Unizeto Technologies S.A., OU=Certum
Certification Authority, CN=Certum Trusted Network CA 2
Certificate added: C=EU, O=AC Camerfirma SA CIF A82743287,
OU=http://www.chambersign.org, CN=Global Chambersign Root
Certificate added: C=ch, O=Swisscom, OU=Digital Certificate Services,
CN=Swisscom Root CA 2
Certificate added: CN=ACEDICOM Root, OU=PKI, O=EDICOM, C=ES
Certificate added: C=US, O=Wells Fargo WellsSecure, OU=Wells Fargo Bank
NA, CN=WellsSecure Public Root Certificate Authority
Certificate added: C=US, O="Entrust, Inc.", OU=See
www.entrust.net/legal-terms, OU="(c) 2012 Entrust, Inc. - for authorized
use only", CN=Entrust Root Certification Authority - EC1
62 new root certific
Hermann
der überlegt, ob er neu installieren sollte.
--
www.Hermann-Riemann.de
[toc] | [next] | [standalone]
| From | Goetz Schultz <ng-delete-mailer@goetz.co.uk> |
|---|---|
| Date | 2016-12-24 13:03 +0000 |
| Message-ID | <o3lrmf$1gkb$1@gioia.aioe.org> |
| In reply to | #289836 |
Yo, On 24/12/16 09:49, Hermann Riemann wrote: > Das update bei SuSE (gestern über 5200 Pakete) kommt mir komisch vor. > Heute funktioniert update über GUI nicht. > > Dafür habe ich bei zypper up u.a.folgendes angezeigt bekommen: > > already trust 163, your new list has 164 > Certificate added: C=IL, O=StartCom Ltd., OU=Secure Digital Certificate [...] > www.entrust.net/legal-terms, OU="(c) 2012 Entrust, Inc. - for authorized > use only", CN=Entrust Root Certification Authority - EC1 > 62 new root certific > > Hermann > der überlegt, ob er neu installieren sollte. > Check mal ob das Cert von SuSE überhaupt noch validiert wird. Ich vermute mal das entweder deren Cert abgelaufen ist oder Dir eine intermediate CA fehlt. Das sollte sich mit "openssl s_client" schnell prüfen lassen. Hatte gestern Abend ein ähnliches Problem mit fetchmail (6.3 -> 6.4). Lag am Ende an den intermediate certs. HTH G.
[toc] | [prev] | [next] | [standalone]
| From | Hermann Riemann <nospam.gerct08@hermann-riemann.de> |
|---|---|
| Date | 2017-01-04 14:22 +0100 |
| Message-ID | <ed4b8dFof8iU1@mid.individual.net> |
| In reply to | #289878 |
Am 24.12.2016 um 14:03 schrieb Goetz Schultz:
> Check mal ob das Cert von SuSE überhaupt noch validiert wird. Ich
> vermute mal das entweder deren Cert abgelaufen ist oder Dir eine
> intermediate CA fehlt. Das sollte sich mit "openssl s_client" schnell
> prüfen lassen.
# openssl s_client
socket: Bad file descriptor
connect:errno=9
Hermann
der wenige Stunden nach Vertrauensaufforderung
aus der Türkei neu installiert hat.
--
http://www.hermann-riemann.de
[toc] | [prev] | [next] | [standalone]
| From | Goetz Schultz <ng-delete-mailer@goetz.co.uk> |
|---|---|
| Date | 2017-01-04 21:49 +0000 |
| Message-ID | <o4jqku$1j5h$1@gioia.aioe.org> |
| In reply to | #291699 |
Yo,
On 04/01/17 13:22, Hermann Riemann wrote:
> Am 24.12.2016 um 14:03 schrieb Goetz Schultz:
>> Check mal ob das Cert von SuSE überhaupt noch validiert wird. Ich
>> vermute mal das entweder deren Cert abgelaufen ist oder Dir eine
>> intermediate CA fehlt. Das sollte sich mit "openssl s_client" schnell
>> prüfen lassen.
>
> # openssl s_client
> socket: Bad file descriptor
> connect:errno=9
Ok, braucht schon was mehr:
openssl s_client -connect $DESTINATION:$PORT
wo $DESTINATION das SuSE Portal ist und $PORT der Einstiegsport (443?)
Als Beispiel sieht fuer STARTO IMAP so aus:
bash-4.4# openssl s_client -CAfile /etc/ssl/certs/ca-root-nss.crt
-connect imap.strato.de:993
CONNECTED(00000003)
depth=2 C = DE, O = Deutsche Telekom AG, OU = T-TeleSec Trust Center, CN
= Deutsche Telekom Root CA 2
verify return:1
depth=1 C = DE, O = T-Systems International GmbH, OU = T-Systems Trust
Center, ST = Nordrhein Westfalen, postalCode = 57250, L = Netphen,
street = Untere Industriestr. 20, CN = TeleSec ServerPass DE-2
verify return:1
depth=0 C = DE, O = Strato AG, OU = Rechenzentrum, ST = Berlin, L =
Berlin, CN = imap.strato.de
verify return:1
---
Certificate chain
0 s:/C=DE/O=Strato
AG/OU=Rechenzentrum/ST=Berlin/L=Berlin/CN=imap.strato.de
i:/C=DE/O=T-Systems International GmbH/OU=T-Systems Trust
Center/ST=Nordrhein Westfalen/postalCode=57250/L=Netphen/street=Untere
Industriestr. 20/CN=TeleSec ServerPass DE-2
1 s:/C=DE/O=T-Systems International GmbH/OU=T-Systems Trust
Center/ST=Nordrhein Westfalen/postalCode=57250/L=Netphen/street=Untere
Industriestr. 20/CN=TeleSec ServerPass DE-2
i:/C=DE/O=Deutsche Telekom AG/OU=T-TeleSec Trust Center/CN=Deutsche
Telekom Root CA 2
---
[..certs..]
>
> Hermann
> der wenige Stunden nach Vertrauensaufforderung
> aus der Türkei neu installiert hat.
>
[toc] | [prev] | [next] | [standalone]
| From | "Juergen P. Meier" <nospam-1984@jors.net> |
|---|---|
| Date | 2017-01-05 14:57 +0000 |
| Message-ID | <37729.28498.1483628221@news.jors.net> |
| In reply to | #291699 |
Hermann Riemann <nospam.gerct08@hermann-riemann.de>: > Am 24.12.2016 um 14:03 schrieb Goetz Schultz: >> Check mal ob das Cert von SuSE überhaupt noch validiert wird. Ich >> vermute mal das entweder deren Cert abgelaufen ist oder Dir eine >> intermediate CA fehlt. Das sollte sich mit "openssl s_client" schnell >> prüfen lassen. > > # openssl s_client > socket: Bad file descriptor > connect:errno=9 RTFM openssl s_client -showcerts -connect foo.bar:443 </dev/zero | less > Hermann > der wenige Stunden nach Vertrauensaufforderung > aus der Türkei neu installiert hat. Die militaerische Turktrust CA ist ja auch ueberall vorinstalliert. So wie viele andere staatliche, behoerdliche und militaerische CAs.
[toc] | [prev] | [standalone]
Back to top | Article view | ger.ct
csiph-web