Re: armhf: buster: TLS / HTTPS partly broken

From	tomas@tuxteam.de
Newsgroups	linux.debian.user
Subject	Re: armhf: buster: TLS / HTTPS partly broken
Date	2020-05-04 15:20 +0200
Message-ID	<A2JaR-3FP-3@gated-at.bofh.it> (permalink)
References	(1 earlier) <A2DI6-fF-7@gated-at.bofh.it> <A2Eb8-pD-13@gated-at.bofh.it> <A2HVo-2FT-5@gated-at.bofh.it> <A2HVo-2FT-3@gated-at.bofh.it> <A2Iy5-39N-1@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

[Multipart message — attachments visible in raw view] - view raw

On Mon, May 04, 2020 at 02:39:09PM +0200, Mark Jonas wrote:
> Hi Thomas,
> 
> > > curl https://www.google.com still fails on the armhf host. So QEMU is
> > > out of the game.
> >
> > Someone hinted at ca_certificates. To verify that, you could try with
> > the option "-k" for curl. Then the server certificate isn't checked.
> 
> Yes, "curl -k https:/www.google.com" succeeds.

Then it's quite probable that the problem lies with certificate
resolution. Either it doesn't find a trusted root cert to validate
the server against, or the validation fails.

You might try curl's -v option (with and without -k) to see whether
it sheds some light.

Also the proposal brought on this list of looking at strace. Perhaps
limit the trace to file operations, like so:

  strace -f -e trace=%file -o trace.out <your curl command here>

This would let you see where curl is looking for certs files.

Cheers
-- t

Thread

Re: armhf: buster: TLS / HTTPS partly broken Mark Jonas <toertel@gmail.com> - 2020-05-04 09:30 +0200
  Re: armhf: buster: TLS / HTTPS partly broken Reco <recoverym4n@enotuniq.net> - 2020-05-04 10:00 +0200
    Re: armhf: buster: TLS / HTTPS partly broken <tomas@tuxteam.de> - 2020-05-04 14:00 +0200
      Re: armhf: buster: TLS / HTTPS partly broken Mark Jonas <toertel@gmail.com> - 2020-05-04 14:40 +0200
        Re: armhf: buster: TLS / HTTPS partly broken tomas@tuxteam.de - 2020-05-04 15:20 +0200
          Re: armhf: buster: TLS / HTTPS partly broken Mark Jonas <toertel@gmail.com> - 2020-05-04 20:40 +0200
    Re: armhf: buster: TLS / HTTPS partly broken Mark Jonas <toertel@gmail.com> - 2020-05-04 14:00 +0200
      Re: armhf: buster: TLS / HTTPS partly broken Reco <recoverym4n@enotuniq.net> - 2020-05-04 14:20 +0200
        Re: armhf: buster: TLS / HTTPS partly broken Mark Jonas <toertel@gmail.com> - 2020-05-04 20:50 +0200
          Re: armhf: buster: TLS / HTTPS partly broken Reco <recoverym4n@enotuniq.net> - 2020-05-05 07:00 +0200
            Re: armhf: buster: TLS / HTTPS partly broken Mark Jonas <toertel@gmail.com> - 2020-05-05 08:10 +0200
              Re: armhf: buster: TLS / HTTPS partly broken Reco <recoverym4n@enotuniq.net> - 2020-05-05 08:30 +0200
                Re: armhf: buster: TLS / HTTPS partly broken Mark Jonas <toertel@gmail.com> - 2020-05-05 08:50 +0200
                Re: armhf: buster: TLS / HTTPS partly broken Andrei POPESCU <andreimpopescu@gmail.com> - 2020-05-05 09:20 +0200
                Re: armhf: buster: TLS / HTTPS partly broken Michael Howard <mike@dewberryfields.co.uk> - 2020-05-05 09:20 +0200
                Re: armhf: buster: TLS / HTTPS partly broken Mark Jonas <toertel@gmail.com> - 2020-05-05 16:10 +0200
                Re: armhf: buster: TLS / HTTPS partly broken Reco <recoverym4n@enotuniq.net> - 2020-05-05 09:30 +0200
                Re: armhf: buster: TLS / HTTPS partly broken Mark Jonas <toertel@gmail.com> - 2020-05-05 16:50 +0200
              Re: armhf: buster: TLS / HTTPS partly broken Greg Wooledge <wooledg@eeg.ccf.org> - 2020-05-05 13:40 +0200
                Re: armhf: buster: TLS / HTTPS partly broken Mark Jonas <toertel@gmail.com> - 2020-05-05 16:40 +0200
                Re: armhf: buster: TLS / HTTPS partly broken Greg Wooledge <wooledg@eeg.ccf.org> - 2020-05-05 17:10 +0200
                Re: armhf: buster: TLS / HTTPS partly broken Mark Jonas <toertel@gmail.com> - 2020-05-05 17:50 +0200

csiph-web