Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #159495

Re: How to make apt-transport-https accept security.debian.org bad certificate?

Show all headers | View raw

El 19/10/15 a las 18:37, Michael Jones escribió:
 > perhaps there is also a flag for apt to ignore ssl errors, but
 > wouldn't that defeat the purpose of ssl?

Indeed. That is why I asked for an option to accept the bad certificate 
only (instead of ignoring all TLS errors).

El 19/10/15 a las 18:37, Michael Jones escribió:
 > for untrusted certs (i don't think this is the issue here), you can
 > always import these into either the OS, or the application (eg java
 > uses jsecerts under lib security).

Right. That don't seems to be the problem. The error message complains 
that the certificate is invalid for that domain. You can check this with 
your browser.

El 19/10/15 a las 18:37, Michael Jones escribió:
 > try /etc/hosts if you don't mind mapping the domain (you may not want
 > to do this as you won't be able to visit the domain you are re-mapping).

Are you sure that "/etc/hosts" can be used for that?. As far as I know 
"/etc/hosts" is used to locally assign the IP addresses to domain names, 
for domain name resolution, instead of, or overriding the usual DNS 
resolution procedure.

I do not understand how I could use /etc/hosts to work around this 
problem. Suppose I make "security.debian.org" resolve to one of the IP 
addresses of "debian.org". Apt will still "think" that is is connecting 
to "security.debian.org", so there will still be a certificate mismatch, 
plus as an added problem. it is contacting the wrong server now.

Regards.

El 19/10/15 a las 18:37, Michael Jones escribió:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA256
>
> On 20/10/15 00:15, Mario Castelán Castro wrote:
>> My question is: How can I make "apt-get" accept the certificate
>> anyway, but only _this_ certificate or other certificates that are
>> otherwise valid but have the same subdomain mismatch error (it
>> should reject a bogus certificate from an attacker)?. In addition,
>> where is the correct place to report this error?.
>
> as far as i'm aware most applications that connect using ssl won't
> accept an invalid cert on the basis of incorrect domain (even if it's
> a trusted cert). (like i think the issue is here).
>
> what you could try is an /etc/hosts entry to use the same domain as
> the cert (if the server will accept that domain).
>
> for untrusted certs (i don't think this is the issue here), you can
> always import these into either the OS, or the application (eg java
> uses jsecerts under lib security).
>
> perhaps there is also a flag for apt to ignore ssl errors, but
> wouldn't that defeat the purpose of ssl?
>
> try /etc/hosts if you don't mind mapping the domain (you may not want
> to do this as you won't be able to visit the domain you are re-mapping).
>
> Kind Regards,
> Mike
>
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v2
>
> iQEcBAEBCAAGBQJWJX6xAAoJEOYwtpHNe8FmjV0H/iO25LwLCOZUIYbQU8tWf96E
> +fxBft9w6wrlOQOqHDseZ5wZeE2PrXIS80FbnTZQKfEftEx05d87+M+blfVo6DTi
> NH19lzNKtG3YTSE2WoSBMo5NzIOgTP/EGry4EM2Ab92ORkTu/P6GQ+qJePA2BUcm
> br6Q6IN8bCvIu10I296Uxby+7+FmO0ovL7IEzJiUNRpId7crAcoHkaICfGEk5GlP
> doqdBmx1J8kMFW7zwRIbeH9c8luZA7b+KJAkwF7ev3DO39BvxNa6xb0rqT62FbXh
> TzGA6vJQ2C1AyNu0cK2YuzUCevAOceeYOcV9B5gg7L+0zzN5btOLhgWaxLez6Uo=
> =z67Q
> -----END PGP SIGNATURE-----
>

Back to linux.debian.user | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

How to make apt-transport-https accept security.debian.org bad certificate? Mario Castelán Castro  <marioxcc.MT@yandex.com> - 2015-10-20 01:20 +0200
  Re: How to make apt-transport-https accept security.debian.org bad  certificate? Mario Castelán Castro  <marioxcc.MT@yandex.com> - 2015-10-20 02:10 +0200
    Re: How to make apt-transport-https accept security.debian.org bad  certificate? Michael Jones <mj@mikejonesey.co.uk> - 2015-10-20 10:10 +0200
      Re: How to make apt-transport-https accept security.debian.org bad  certificate? Michael Jones <mj@mikejonesey.co.uk> - 2015-10-20 10:10 +0200
        Re: How to make apt-transport-https accept security.debian.org bad  certificate? Michael Jones <mj@mikejonesey.co.uk> - 2015-10-20 22:40 +0200
          Re: How to make apt-transport-https accept security.debian.org bad  certificate? Mario Castelán Castro  <marioxcc.MT@yandex.com> - 2015-10-20 23:40 +0200
            Re: How to make apt-transport-https accept security.debian.org bad  certificate? Mario Castelán Castro  <marioxcc.MT@yandex.com> - 2015-10-21 01:10 +0200

csiph-web