Groups > linux.debian.user > #222218 > unrolled thread

Re: armhf: buster: TLS / HTTPS partly broken

Started by	Mark Jonas <toertel@gmail.com>
First post	2020-05-04 09:30 +0200
Last post	2020-05-05 17:50 +0200
Articles	20 on this page of 22 — 7 participants

Back to article view | Back to linux.debian.user

  Re: armhf: buster: TLS / HTTPS partly broken Mark Jonas <toertel@gmail.com> - 2020-05-04 09:30 +0200
    Re: armhf: buster: TLS / HTTPS partly broken Reco <recoverym4n@enotuniq.net> - 2020-05-04 10:00 +0200
      Re: armhf: buster: TLS / HTTPS partly broken <tomas@tuxteam.de> - 2020-05-04 14:00 +0200
        Re: armhf: buster: TLS / HTTPS partly broken Mark Jonas <toertel@gmail.com> - 2020-05-04 14:40 +0200
          Re: armhf: buster: TLS / HTTPS partly broken tomas@tuxteam.de - 2020-05-04 15:20 +0200
            Re: armhf: buster: TLS / HTTPS partly broken Mark Jonas <toertel@gmail.com> - 2020-05-04 20:40 +0200
      Re: armhf: buster: TLS / HTTPS partly broken Mark Jonas <toertel@gmail.com> - 2020-05-04 14:00 +0200
        Re: armhf: buster: TLS / HTTPS partly broken Reco <recoverym4n@enotuniq.net> - 2020-05-04 14:20 +0200
          Re: armhf: buster: TLS / HTTPS partly broken Mark Jonas <toertel@gmail.com> - 2020-05-04 20:50 +0200
            Re: armhf: buster: TLS / HTTPS partly broken Reco <recoverym4n@enotuniq.net> - 2020-05-05 07:00 +0200
              Re: armhf: buster: TLS / HTTPS partly broken Mark Jonas <toertel@gmail.com> - 2020-05-05 08:10 +0200
                Re: armhf: buster: TLS / HTTPS partly broken Reco <recoverym4n@enotuniq.net> - 2020-05-05 08:30 +0200
                  Re: armhf: buster: TLS / HTTPS partly broken Mark Jonas <toertel@gmail.com> - 2020-05-05 08:50 +0200
                    Re: armhf: buster: TLS / HTTPS partly broken Andrei POPESCU <andreimpopescu@gmail.com> - 2020-05-05 09:20 +0200
                    Re: armhf: buster: TLS / HTTPS partly broken Michael Howard <mike@dewberryfields.co.uk> - 2020-05-05 09:20 +0200
                      Re: armhf: buster: TLS / HTTPS partly broken Mark Jonas <toertel@gmail.com> - 2020-05-05 16:10 +0200
                    Re: armhf: buster: TLS / HTTPS partly broken Reco <recoverym4n@enotuniq.net> - 2020-05-05 09:30 +0200
                      Re: armhf: buster: TLS / HTTPS partly broken Mark Jonas <toertel@gmail.com> - 2020-05-05 16:50 +0200
                Re: armhf: buster: TLS / HTTPS partly broken Greg Wooledge <wooledg@eeg.ccf.org> - 2020-05-05 13:40 +0200
                  Re: armhf: buster: TLS / HTTPS partly broken Mark Jonas <toertel@gmail.com> - 2020-05-05 16:40 +0200
                    Re: armhf: buster: TLS / HTTPS partly broken Greg Wooledge <wooledg@eeg.ccf.org> - 2020-05-05 17:10 +0200
                      Re: armhf: buster: TLS / HTTPS partly broken Mark Jonas <toertel@gmail.com> - 2020-05-05 17:50 +0200

Page 1 of 2 [1] 2 Next page →

#222218 — Re: armhf: buster: TLS / HTTPS partly broken

From	Mark Jonas <toertel@gmail.com>
Date	2020-05-04 09:30 +0200
Subject	Re: armhf: buster: TLS / HTTPS partly broken
Message-ID	<A2DI6-fF-7@gated-at.bofh.it>

Hi Reco,

>> >> curl: (60) SSL certificate problem: unable to get local issuer certificate
>> >>
>> >> Does that mean a TLS library does not feature all required protocols on armhf?
>> >
>> > TLS library that curl uses (openssl) is perfectly fine, but it cannot
>> > validate any certificate unless you provide it with root CA
>> > certificates.
>> > So it likely means you haven't installed "ca-certificates" package.
>>
>> This is what it looks like. But actually I installed ca-certificates.
>
> Ok. Can you run tcpdump while you're running curl?
> Specifically,
>
> tcpdump -s0 -pnni any -w /tmp/curl.pcap tcp port 443

I tried to dump from within the running container but failed.

# tcpdump -s0 -pnni any -w /tmp/curl-certificate-problem.pcap tcp port 443
Unsupported setsockopt level=263 optname=8
getsockopt level=263 optname=11 not yet supported
tcpdump: WARNING: can't get TPACKET_V3 header len on packet socket:
Operation not supported
Warning: Kernel filter failed: Bad file descriptor
Unsupported setsockopt level=1 optname=27
tcpdump: can't remove kernel filter: Protocol not available

The container was started as follows on an amd64 host running qemu-arm-static:

$ docker run -it --rm toertel/test-tls-https-broken:arm32v7-buster-latest

I gave it a try with a stripped down command and it did not work either.

# tcpdump -w /tmp/curl-certificate-problem.pcap port 443
Unknown host QEMU_IFLA type: 50
Unknown host QEMU_IFLA type: 51
Unknown host QEMU_IFLA type: 50
Unknown host QEMU_IFLA type: 51
Unsupported ioctl: cmd=0x8946
Unsupported ioctl: cmd=0x8946
Unsupported ioctl: cmd=0x8946
Unsupported ioctl: cmd=0x8946
Unsupported ioctl: cmd=0x8946
Unsupported ioctl: cmd=0x8946
Unsupported setsockopt level=263 optname=8
getsockopt level=263 optname=11 not yet supported
tcpdump: Can't open netlink socket 96:Protocol family not supported

Thanks for your help,
Mark

[toc] | [next] | [standalone]

#222219

From	Reco <recoverym4n@enotuniq.net>
Date	2020-05-04 10:00 +0200
Message-ID	<A2Eb8-pD-13@gated-at.bofh.it>
In reply to	#222218

	Hi.

On Mon, May 04, 2020 at 09:27:14AM +0200, Mark Jonas wrote:
> >> >> curl: (60) SSL certificate problem: unable to get local issuer certificate
> >> >>
> >> >> Does that mean a TLS library does not feature all required protocols on armhf?
> >> >
> >> > TLS library that curl uses (openssl) is perfectly fine, but it cannot
> >> > validate any certificate unless you provide it with root CA
> >> > certificates.
> >> > So it likely means you haven't installed "ca-certificates" package.
> >>
> >> This is what it looks like. But actually I installed ca-certificates.
> >
> > Ok. Can you run tcpdump while you're running curl?
> > Specifically,
> >
> > tcpdump -s0 -pnni any -w /tmp/curl.pcap tcp port 443
> 
> I tried to dump from within the running container but failed.

It's way too complicated. Docker is basically a one big NAT, so please
run tcpdump on a host instead.

But this hiccup gave me an idea - maybe libssl on armhf is perfectly
fine, but it's qemu which fails to emulate certain CPU instruction.

Reco

[toc] | [prev] | [next] | [standalone]

#222225

From	<tomas@tuxteam.de>
Date	2020-05-04 14:00 +0200
Message-ID	<A2HVo-2FT-3@gated-at.bofh.it>
In reply to	#222219

[Multipart message — attachments visible in raw view] — view raw

On Mon, May 04, 2020 at 01:49:34PM +0200, Mark Jonas wrote:
> Hi Reco,
> 
> > > > Ok. Can you run tcpdump while you're running curl?
> > > > Specifically,
> > > >
> > > > tcpdump -s0 -pnni any -w /tmp/curl.pcap tcp port 443
> > >
> > > I tried to dump from within the running container but failed.
> >
> > It's way too complicated. Docker is basically a one big NAT, so please
> > run tcpdump on a host instead.
> 
> I used the identical image to run the container on an amhf host
> (Raspberry Pi 3). So there is now no QEMU in the way.
> 
> > But this hiccup gave me an idea - maybe libssl on armhf is perfectly
> > fine, but it's qemu which fails to emulate certain CPU instruction.
> 
> curl https://www.google.com still fails on the armhf host. So QEMU is
> out of the game.

Someone hinted at ca_certificates. To verify that, you could try with
the option "-k" for curl. Then the server certificate isn't checked.

Of course this may be a bad idea for a permanent "solution", but would
allow you to bisect the problem.

Cheers
-- t

[toc] | [prev] | [next] | [standalone]

#222228

From	Mark Jonas <toertel@gmail.com>
Date	2020-05-04 14:40 +0200
Message-ID	<A2Iy5-39N-1@gated-at.bofh.it>
In reply to	#222225

Hi Thomas,

> > curl https://www.google.com still fails on the armhf host. So QEMU is
> > out of the game.
>
> Someone hinted at ca_certificates. To verify that, you could try with
> the option "-k" for curl. Then the server certificate isn't checked.

Yes, "curl -k https:/www.google.com" succeeds.

I am 100% sure that the ca-certificates package is installed.

# dpkg --get-selections | grep ca-certificates
ca-certificates                    install

> Of course this may be a bad idea for a permanent "solution", but would
> allow you to bisect the problem.

I do not understand how that helps.

In my real use case the Logitech Media Server shows the same problem
as curl. I am just using curl here because it is a Debian supported
package and the problem is way easier to reproduce.

Greetings,
Mark

[toc] | [prev] | [next] | [standalone]

#222229

From	tomas@tuxteam.de
Date	2020-05-04 15:20 +0200
Message-ID	<A2JaR-3FP-3@gated-at.bofh.it>
In reply to	#222228

[Multipart message — attachments visible in raw view] — view raw

On Mon, May 04, 2020 at 02:39:09PM +0200, Mark Jonas wrote:
> Hi Thomas,
> 
> > > curl https://www.google.com still fails on the armhf host. So QEMU is
> > > out of the game.
> >
> > Someone hinted at ca_certificates. To verify that, you could try with
> > the option "-k" for curl. Then the server certificate isn't checked.
> 
> Yes, "curl -k https:/www.google.com" succeeds.

Then it's quite probable that the problem lies with certificate
resolution. Either it doesn't find a trusted root cert to validate
the server against, or the validation fails.

You might try curl's -v option (with and without -k) to see whether
it sheds some light.

Also the proposal brought on this list of looking at strace. Perhaps
limit the trace to file operations, like so:

  strace -f -e trace=%file -o trace.out <your curl command here>

This would let you see where curl is looking for certs files.

Cheers
-- t

[toc] | [prev] | [next] | [standalone]

#222233

From	Mark Jonas <toertel@gmail.com>
Date	2020-05-04 20:40 +0200
Message-ID	<A2Oat-6y4-1@gated-at.bofh.it>
In reply to	#222229

Hi Tomas,

> > Yes, "curl -k https:/www.google.com" succeeds.
>
> Then it's quite probable that the problem lies with certificate
> resolution. Either it doesn't find a trusted root cert to validate
> the server against, or the validation fails.
>
> You might try curl's -v option (with and without -k) to see whether
> it sheds some light.

# curl -v https://www.google.com
* Expire in 0 ms for 6 (transfer 0x109d880)
* Expire in 1 ms for 1 (transfer 0x109d880)
* Expire in 0 ms for 1 (transfer 0x109d880)
* Expire in 2 ms for 1 (transfer 0x109d880)
* Expire in 0 ms for 1 (transfer 0x109d880)
* Expire in 0 ms for 1 (transfer 0x109d880)
* Expire in 2 ms for 1 (transfer 0x109d880)
* Expire in 1 ms for 1 (transfer 0x109d880)
* Expire in 1 ms for 1 (transfer 0x109d880)
* Expire in 4 ms for 1 (transfer 0x109d880)
* Expire in 2 ms for 1 (transfer 0x109d880)
* Expire in 2 ms for 1 (transfer 0x109d880)
* Expire in 4 ms for 1 (transfer 0x109d880)
* Expire in 3 ms for 1 (transfer 0x109d880)
* Expire in 3 ms for 1 (transfer 0x109d880)
* Expire in 4 ms for 1 (transfer 0x109d880)
* Expire in 3 ms for 1 (transfer 0x109d880)
* Expire in 4 ms for 1 (transfer 0x109d880)
* Expire in 4 ms for 1 (transfer 0x109d880)
* Expire in 4 ms for 1 (transfer 0x109d880)
* Expire in 4 ms for 1 (transfer 0x109d880)
* Expire in 5 ms for 1 (transfer 0x109d880)
*   Trying 216.58.207.164...
* TCP_NODELAY set
* Expire in 149991 ms for 3 (transfer 0x109d880)
* Expire in 200 ms for 4 (transfer 0x109d880)
* Connected to www.google.com (216.58.207.164) port 443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* successfully set certificate verify locations:
*   CAfile: none
  CApath: /etc/ssl/certs
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* TLSv1.3 (IN), TLS handshake, Server hello (2):
* TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):
* TLSv1.3 (IN), TLS handshake, Certificate (11):
* TLSv1.3 (OUT), TLS alert, unknown CA (560):
* SSL certificate problem: unable to get local issuer certificate
* Closing connection 0
curl: (60) SSL certificate problem: unable to get local issuer certificate
More details here: https://curl.haxx.se/docs/sslcerts.html

curl failed to verify the legitimacy of the server and therefore could not
establish a secure connection to it. To learn more about this situation and
how to fix it, please visit the web page mentioned above.

# curl -vk https://www.google.com
* Expire in 0 ms for 6 (transfer 0x133a880)
* Expire in 1 ms for 1 (transfer 0x133a880)
[.. skipping 46 more or less identical lines ..]
* Expire in 4 ms for 1 (transfer 0x133a880)
*   Trying 216.58.207.164...
* TCP_NODELAY set
* Expire in 149993 ms for 3 (transfer 0x133a880)
* Expire in 200 ms for 4 (transfer 0x133a880)
* Connected to www.google.com (216.58.207.164) port 443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* successfully set certificate verify locations:
*   CAfile: none
  CApath: /etc/ssl/certs
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* TLSv1.3 (IN), TLS handshake, Server hello (2):
* TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):
* TLSv1.3 (IN), TLS handshake, Certificate (11):
* TLSv1.3 (IN), TLS handshake, CERT verify (15):
* TLSv1.3 (IN), TLS handshake, Finished (20):
* TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):
* TLSv1.3 (OUT), TLS handshake, Finished (20):
* SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384
* ALPN, server accepted to use h2
* Server certificate:
*  subject: C=US; ST=California; L=Mountain View; O=Google LLC;
CN=www.google.com
*  start date: Apr  7 09:49:21 2020 GMT
*  expire date: Jun 30 09:49:21 2020 GMT
*  issuer: C=US; O=Google Trust Services; CN=GTS CA 1O1
*  SSL certificate verify result: unable to get local issuer
certificate (20), continuing anyway.
* Using HTTP2, server supports multi-use
* Connection state changed (HTTP/2 confirmed)
* Copying HTTP/2 data in stream buffer to connection buffer after upgrade: len=0
* Using Stream ID: 1 (easy handle 0x133a880)
> GET / HTTP/2
> Host: www.google.com
> User-Agent: curl/7.64.0
> Accept: */*
>
* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
* old SSL session ID is stale, removing
* Connection state changed (MAX_CONCURRENT_STREAMS == 100)!
< HTTP/2 200
< date: Mon, 04 May 2020 17:57:40 GMT
< expires: -1
< cache-control: private, max-age=0
< content-type: text/html; charset=ISO-8859-1
< p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
< server: gws
< x-xss-protection: 0
< x-frame-options: SAMEORIGIN
< set-cookie: 1P_JAR=2020-05-04-17; expires=Wed, 03-Jun-2020 17:57:40
GMT; path=/; domain=.google.com; Secure
< set-cookie: NID=203=NJeeaDepuErdSOKYdHIR6vtnByU05gHO2DzxoRS3puHM4AsMlNZ5J2aksbNJrJQxfuGuBx_OaG3uyPuuF5tRqJEa4mGmreZ2F9ilyqksUryBh5z7N5y1_QDbDzCvkme1XonAIo_V7rw99ejIfqk8U1nL_tOw5OUSrBZffdLHchA;
expires=Tue, 03-Nov-2020 17:57:40 GMT; path=/; domain=.google.com;
HttpOnly
< alt-svc: h3-Q050=":443"; ma=2592000,h3-Q049=":443";
ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443";
ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000;
v="46,43"
< accept-ranges: none
< vary: Accept-Encoding
<
<!doctype html>
[.. rest of HTML document downloaded ..]

> Also the proposal brought on this list of looking at strace. Perhaps
> limit the trace to file operations, like so:
>
>   strace -f -e trace=%file -o trace.out <your curl command here>
>
> This would let you see where curl is looking for certs files.

/etc/ssl/certs contains ~129 certificate files (links to the real
files) and matches the CApath from the curl -v output from above.

I tried the strace and below you can see the result.

# strace -f -e trace=%file -o trace.out curl https://www.google.com
curl: (60) SSL certificate problem: unable to get local issuer certificate
More details here: https://curl.haxx.se/docs/sslcerts.html

curl failed to verify the legitimacy of the server and therefore could not
establish a secure connection to it. To learn more about this situation and
how to fix it, please visit the web page mentioned above.
# cat trace.out
283   execve("/usr/bin/curl", ["curl", "https://www.google.com"],
0x7ec29e48 /* 7 vars */) = 0
283   access("/etc/ld.so.preload", R_OK) = -1 ENOENT (No such file or directory)
283   openat(AT_FDCWD, "/etc/ld.so.cache", O_RDONLY|O_LARGEFILE|O_CLOEXEC) = 3
283   openat(AT_FDCWD, "/usr/lib/arm-linux-gnueabihf/libcurl.so.4",
O_RDONLY|O_LARGEFILE|O_CLOEXEC) = 3
283   openat(AT_FDCWD, "/lib/arm-linux-gnueabihf/libz.so.1",
O_RDONLY|O_LARGEFILE|O_CLOEXEC) = 3
283   openat(AT_FDCWD, "/lib/arm-linux-gnueabihf/libpthread.so.0",
O_RDONLY|O_LARGEFILE|O_CLOEXEC) = 3
283   openat(AT_FDCWD, "/lib/arm-linux-gnueabihf/libc.so.6",
O_RDONLY|O_LARGEFILE|O_CLOEXEC) = 3
283   openat(AT_FDCWD,
"/usr/lib/arm-linux-gnueabihf/libnghttp2.so.14",
O_RDONLY|O_LARGEFILE|O_CLOEXEC) = 3
283   openat(AT_FDCWD, "/usr/lib/arm-linux-gnueabihf/libidn2.so.0",
O_RDONLY|O_LARGEFILE|O_CLOEXEC) = 3
283   openat(AT_FDCWD, "/usr/lib/arm-linux-gnueabihf/librtmp.so.1",
O_RDONLY|O_LARGEFILE|O_CLOEXEC) = 3
283   openat(AT_FDCWD, "/usr/lib/arm-linux-gnueabihf/libssh2.so.1",
O_RDONLY|O_LARGEFILE|O_CLOEXEC) = 3
283   openat(AT_FDCWD, "/usr/lib/arm-linux-gnueabihf/libpsl.so.5",
O_RDONLY|O_LARGEFILE|O_CLOEXEC) = 3
283   openat(AT_FDCWD, "/usr/lib/arm-linux-gnueabihf/libssl.so.1.1",
O_RDONLY|O_LARGEFILE|O_CLOEXEC) = 3
283   openat(AT_FDCWD,
"/usr/lib/arm-linux-gnueabihf/libcrypto.so.1.1",
O_RDONLY|O_LARGEFILE|O_CLOEXEC) = 3
283   openat(AT_FDCWD,
"/usr/lib/arm-linux-gnueabihf/libgssapi_krb5.so.2",
O_RDONLY|O_LARGEFILE|O_CLOEXEC) = 3
283   openat(AT_FDCWD, "/usr/lib/arm-linux-gnueabihf/libkrb5.so.3",
O_RDONLY|O_LARGEFILE|O_CLOEXEC) = 3
283   openat(AT_FDCWD,
"/usr/lib/arm-linux-gnueabihf/libk5crypto.so.3",
O_RDONLY|O_LARGEFILE|O_CLOEXEC) = 3
283   openat(AT_FDCWD, "/lib/arm-linux-gnueabihf/libcom_err.so.2",
O_RDONLY|O_LARGEFILE|O_CLOEXEC) = 3
283   openat(AT_FDCWD,
"/usr/lib/arm-linux-gnueabihf/libldap_r-2.4.so.2",
O_RDONLY|O_LARGEFILE|O_CLOEXEC) = 3
283   openat(AT_FDCWD,
"/usr/lib/arm-linux-gnueabihf/liblber-2.4.so.2",
O_RDONLY|O_LARGEFILE|O_CLOEXEC) = 3
283   openat(AT_FDCWD,
"/usr/lib/arm-linux-gnueabihf/libunistring.so.2",
O_RDONLY|O_LARGEFILE|O_CLOEXEC) = 3
283   openat(AT_FDCWD, "/usr/lib/arm-linux-gnueabihf/libgnutls.so.30",
O_RDONLY|O_LARGEFILE|O_CLOEXEC) = 3
283   openat(AT_FDCWD, "/usr/lib/arm-linux-gnueabihf/libhogweed.so.4",
O_RDONLY|O_LARGEFILE|O_CLOEXEC) = 3
283   openat(AT_FDCWD, "/usr/lib/arm-linux-gnueabihf/libnettle.so.6",
O_RDONLY|O_LARGEFILE|O_CLOEXEC) = 3
283   openat(AT_FDCWD, "/usr/lib/arm-linux-gnueabihf/libgmp.so.10",
O_RDONLY|O_LARGEFILE|O_CLOEXEC) = 3
283   openat(AT_FDCWD, "/lib/arm-linux-gnueabihf/libgcrypt.so.20",
O_RDONLY|O_LARGEFILE|O_CLOEXEC) = 3
283   openat(AT_FDCWD, "/lib/arm-linux-gnueabihf/libdl.so.2",
O_RDONLY|O_LARGEFILE|O_CLOEXEC) = 3
283   openat(AT_FDCWD,
"/usr/lib/arm-linux-gnueabihf/libkrb5support.so.0",
O_RDONLY|O_LARGEFILE|O_CLOEXEC) = 3
283   openat(AT_FDCWD, "/lib/arm-linux-gnueabihf/libkeyutils.so.1",
O_RDONLY|O_LARGEFILE|O_CLOEXEC) = 3
283   openat(AT_FDCWD, "/lib/arm-linux-gnueabihf/libresolv.so.2",
O_RDONLY|O_LARGEFILE|O_CLOEXEC) = 3
283   openat(AT_FDCWD, "/usr/lib/arm-linux-gnueabihf/libsasl2.so.2",
O_RDONLY|O_LARGEFILE|O_CLOEXEC) = 3
283   openat(AT_FDCWD, "/usr/lib/arm-linux-gnueabihf/libp11-kit.so.0",
O_RDONLY|O_LARGEFILE|O_CLOEXEC) = 3
283   openat(AT_FDCWD, "/usr/lib/arm-linux-gnueabihf/libtasn1.so.6",
O_RDONLY|O_LARGEFILE|O_CLOEXEC) = 3
283   openat(AT_FDCWD, "/lib/arm-linux-gnueabihf/libgpg-error.so.0",
O_RDONLY|O_LARGEFILE|O_CLOEXEC) = 3
283   openat(AT_FDCWD, "/usr/lib/arm-linux-gnueabihf/libffi.so.6",
O_RDONLY|O_LARGEFILE|O_CLOEXEC) = 3
283   openat(AT_FDCWD, "/lib/arm-linux-gnueabihf/libgcc_s.so.1",
O_RDONLY|O_LARGEFILE|O_CLOEXEC) = 3
283   stat64("/etc/gnutls/default-priorities", 0x7ecb9d60) = -1 ENOENT
(No such file or directory)
283   openat(AT_FDCWD, "/usr/lib/ssl/openssl.cnf", O_RDONLY|O_LARGEFILE) = 3
283   access("/etc/gcrypt/fips_enabled", F_OK) = -1 ENOENT (No such
file or directory)
283   openat(AT_FDCWD, "/proc/sys/crypto/fips_enabled", O_RDONLY) = -1
ENOENT (No such file or directory)
283   openat(AT_FDCWD, "/etc/gcrypt/hwf.deny", O_RDONLY) = -1 ENOENT
(No such file or directory)
283   openat(AT_FDCWD, "/proc/self/auxv", O_RDONLY) = 3
283   openat(AT_FDCWD, "/proc/cpuinfo", O_RDONLY) = 3
283   openat(AT_FDCWD, "/root/.curlrc", O_RDONLY|O_LARGEFILE) = -1
ENOENT (No such file or directory)
284   openat(AT_FDCWD, "/etc/nsswitch.conf", O_RDONLY|O_CLOEXEC) = 3
284   stat64("/etc/resolv.conf", {st_mode=S_IFREG|0644, st_size=67, ...}) = 0
284   openat(AT_FDCWD, "/etc/host.conf", O_RDONLY|O_CLOEXEC) = 3
284   openat(AT_FDCWD, "/etc/resolv.conf", O_RDONLY|O_CLOEXEC) = 3
284   openat(AT_FDCWD, "/etc/ld.so.cache", O_RDONLY|O_LARGEFILE|O_CLOEXEC) = 3
284   openat(AT_FDCWD, "/lib/arm-linux-gnueabihf/libnss_files.so.2",
O_RDONLY|O_LARGEFILE|O_CLOEXEC) = 3
284   openat(AT_FDCWD, "/etc/hosts", O_RDONLY|O_CLOEXEC) = 3
284   openat(AT_FDCWD, "/etc/ld.so.cache", O_RDONLY|O_LARGEFILE|O_CLOEXEC) = 3
284   openat(AT_FDCWD, "/lib/arm-linux-gnueabihf/libnss_dns.so.2",
O_RDONLY|O_LARGEFILE|O_CLOEXEC) = 3
284   openat(AT_FDCWD, "/etc/gai.conf", O_RDONLY|O_CLOEXEC) = 3
284   +++ exited with 0 +++
283   openat(AT_FDCWD, "/usr/lib/ssl/openssl.cnf", O_RDONLY|O_LARGEFILE) = 4
283   stat64("/etc/ssl/certs/99bdd351.0", 0x7ecb9180) = -1 ENOENT (No
such file or directory)
283   openat(AT_FDCWD, "/etc/localtime", O_RDONLY|O_CLOEXEC) = 4
283   stat64("/etc/ssl/certs/4a6481c9.0", 0x7ecb9180) = -1 ENOENT (No
such file or directory)
283   stat64("/etc/ssl/certs/4a6481c9.0", 0x7ecb9180) = -1 ENOENT (No
such file or directory)
283   +++ exited with 60 +++

On my PC, where curl works fine, I can also see that every access to
files like /etc/ssl/certs/4a6481c9.0 fails, too. So I guess that is
not the problem.

But on the PC I can see that curl reads
/etc/ssl/certs/ca-certificates.crt which is doesn't on armhf. But the
file exists on armhf, has a reasonable size of ~200 kB, and the
contents look unsuspicious. I also ran update-ca-certificates and the
file is identical afterwards.

Greetings,
Mark

[toc] | [prev] | [next] | [standalone]

#222226

From	Mark Jonas <toertel@gmail.com>
Date	2020-05-04 14:00 +0200
Message-ID	<A2HVo-2FT-5@gated-at.bofh.it>
In reply to	#222219

Hi Reco,

> > > Ok. Can you run tcpdump while you're running curl?
> > > Specifically,
> > >
> > > tcpdump -s0 -pnni any -w /tmp/curl.pcap tcp port 443
> >
> > I tried to dump from within the running container but failed.
>
> It's way too complicated. Docker is basically a one big NAT, so please
> run tcpdump on a host instead.

I used the identical image to run the container on an amhf host
(Raspberry Pi 3). So there is now no QEMU in the way.

> But this hiccup gave me an idea - maybe libssl on armhf is perfectly
> fine, but it's qemu which fails to emulate certain CPU instruction.

curl https://www.google.com still fails on the armhf host. So QEMU is
out of the game.

Packet capturing now also worked. For capturing QEMU was the problem.
I also captured aria2c (succeeds with warning) and wget (silently
succeeds). You can download the capture files from
https://fil.email/pzzgUgVp . The link is good for one week and is from
filemail.com.

Thanks for your help,
Mark

[toc] | [prev] | [next] | [standalone]

#222227

From	Reco <recoverym4n@enotuniq.net>
Date	2020-05-04 14:20 +0200
Message-ID	<A2IeJ-31p-5@gated-at.bofh.it>
In reply to	#222226

	Hi.

On Mon, May 04, 2020 at 01:49:34PM +0200, Mark Jonas wrote:
> Hi Reco,
> 
> > > > Ok. Can you run tcpdump while you're running curl?
> > > > Specifically,
> > > >
> > > > tcpdump -s0 -pnni any -w /tmp/curl.pcap tcp port 443
> > >
> > > I tried to dump from within the running container but failed.
> >
> > It's way too complicated. Docker is basically a one big NAT, so please
> > run tcpdump on a host instead.
> 
> I used the identical image to run the container on an amhf host
> (Raspberry Pi 3). So there is now no QEMU in the way.

Curious. Just tested it with curl at Marvell Armada 385 (runs Debian 10,
armhf), works as supposed to.
I could also test it on Exynos 5422 (also runs Debian 10, armhf), but
it'll be the same.

> > But this hiccup gave me an idea - maybe libssl on armhf is perfectly
> > fine, but it's qemu which fails to emulate certain CPU instruction.
> 
> curl https://www.google.com still fails on the armhf host. So QEMU is
> out of the game.

Ok. Is it possible to run curl via strace from inside the docker?
Something like this would be perfect (-o designates an output file):

strace -o /tmp/curl -e trace=file curl https://www.google.com

Specifically, it should try to open a symlink to
/etc/ssl/certs/GlobalSign_Root_CA_-_R2.pem.
Here it's called /etc/ssl/certs/4a6481c9.0, may be machine-specific.

> Packet capturing now also worked. For capturing QEMU was the problem.
> I also captured aria2c (succeeds with warning) and wget (silently
> succeeds).

For the archives, curl's pcap looks like this:

SYN
SYN,ACK
TLS client hello
TLS server hello, change cipher spec (an upgrade from TLSv1.2 to TLS1.3)
Alert (Level: Fatal, Description: Unknown CA) <- curl sends this
RST
FIN,ACK

wget and aria show what they're supposed to (TLS handshake, Application
Data ping pong).

Reco

[toc] | [prev] | [next] | [standalone]

#222234

From	Mark Jonas <toertel@gmail.com>
Date	2020-05-04 20:50 +0200
Message-ID	<A2Ok9-6Bv-5@gated-at.bofh.it>
In reply to	#222227

Hi Reco,

> > I used the identical image to run the container on an amhf host
> > (Raspberry Pi 3). So there is now no QEMU in the way.
>
> Curious. Just tested it with curl at Marvell Armada 385 (runs Debian 10,
> armhf), works as supposed to.
> I could also test it on Exynos 5422 (also runs Debian 10, armhf), but
> it'll be the same.

Do you want to try the Docker image on one of these? Maybe the problem
is not Debian itself but only the official Debian Docker image?

> > curl https://www.google.com still fails on the armhf host. So QEMU is
> > out of the game.
>
> Ok. Is it possible to run curl via strace from inside the docker?
> Something like this would be perfect (-o designates an output file):
>
> strace -o /tmp/curl -e trace=file curl https://www.google.com

Please have a look at the reply I send to Tomas. There is the complete
strace output.

> Specifically, it should try to open a symlink to
> /etc/ssl/certs/GlobalSign_Root_CA_-_R2.pem.
> Here it's called /etc/ssl/certs/4a6481c9.0, may be machine-specific.

Yes, it tries to open something like that and fails. But on my PC,
where curl works, the trace shows similar failures.

Raspberry Pi Docker host, armhf Docker container snippet:

1613  openat(AT_FDCWD, "/usr/lib/ssl/openssl.cnf", O_RDONLY|O_LARGEFILE) = 4
1613  stat64("/etc/ssl/certs/99bdd351.0", 0x7ec95160) = -1 ENOENT (No
such file or directory)
1613  openat(AT_FDCWD, "/etc/localtime", O_RDONLY|O_CLOEXEC) = 4
1613  stat64("/etc/ssl/certs/4a6481c9.0", 0x7ec95160) = -1 ENOENT (No
such file or directory)
1613  stat64("/etc/ssl/certs/4a6481c9.0", 0x7ec95160) = -1 ENOENT (No
such file or directory)
1613  +++ exited with 60 +++

PC strace snippet:

5524  openat(AT_FDCWD, "/dev/urandom", O_RDONLY) = 4
5524  openat(AT_FDCWD, "/dev/random", O_RDONLY) = 5
5524  openat(AT_FDCWD, "/dev/srandom", O_RDONLY) = -1 ENOENT (No such
file or directory)
5524  openat(AT_FDCWD, "/usr/lib/ssl/openssl.cnf", O_RDONLY) = 6
5524  openat(AT_FDCWD, "/etc/ssl/certs/ca-certificates.crt", O_RDONLY) = 6
5524  stat("/etc/ssl/certs/99bdd351.0", 0x7ffff60b7060) = -1 ENOENT
(No such file or directory)
5524  openat(AT_FDCWD, "/etc/localtime", O_RDONLY|O_CLOEXEC) = 6
5524  +++ exited with 0 +++

Greetings,
Mark

[toc] | [prev] | [next] | [standalone]

#222242

From	Reco <recoverym4n@enotuniq.net>
Date	2020-05-05 07:00 +0200
Message-ID	<A2XQv-3Uu-21@gated-at.bofh.it>
In reply to	#222234

	Hi.

On Mon, May 04, 2020 at 08:41:43PM +0200, Mark Jonas wrote:
> Hi Reco,
> 
> > > I used the identical image to run the container on an amhf host
> > > (Raspberry Pi 3). So there is now no QEMU in the way.
> >
> > Curious. Just tested it with curl at Marvell Armada 385 (runs Debian 10,
> > armhf), works as supposed to.
> > I could also test it on Exynos 5422 (also runs Debian 10, armhf), but
> > it'll be the same.
> 
> Do you want to try the Docker image on one of these?

Maybe it'll come to it.

> Maybe the problem is not Debian itself but only the official Debian
> Docker image?

Most probably, see below.

> 1613  stat64("/etc/ssl/certs/4a6481c9.0", 0x7ec95160) = -1 ENOENT (No
> such file or directory)

Presumably ca-certificates postinst script haven't run, because these
symlinks missing ain't normal.
So, start with "dpkg-reconfigure ca-certificates", and if it does not
fix it - "apt-get install --reinstall ca-certificates".

Reco

[toc] | [prev] | [next] | [standalone]

#222243

From	Mark Jonas <toertel@gmail.com>
Date	2020-05-05 08:10 +0200
Message-ID	<A2YWd-4MT-1@gated-at.bofh.it>
In reply to	#222242

Hi Reco,

> > 1613  stat64("/etc/ssl/certs/4a6481c9.0", 0x7ec95160) = -1 ENOENT (No
> > such file or directory)
>
> Presumably ca-certificates postinst script haven't run, because these
> symlinks missing ain't normal.

Ubuntu 18.04 on my PC gives more or less the same errors but succeeds.
So I have some doubt. I think the symlinks are there.

openat(AT_FDCWD, "/usr/lib/ssl/openssl.cnf", O_RDONLY) = 6
openat(AT_FDCWD, "/etc/ssl/certs/ca-certificates.crt", O_RDONLY) = 6
stat("/etc/ssl/certs/99bdd351.0", 0x7ffc3c886370) = -1 ENOENT (No such
file or directory)

> So, start with "dpkg-reconfigure ca-certificates", and if it does not
> fix it - "apt-get install --reinstall ca-certificates".

This does not work either. But the following works. And this is super confusing.

1. Run "dpkg-reconfigure ca-certificates"
   Trust new certificates from certificate authorities? 1 (yes)
   Certificates to activate: (empty list)
   Updating certificates in /etc/ssl/certs...
   0 added, 128 removed; done.

2. Run "dpkg-reconfigure ca-certificates"
   Trust new certificates from certificate authorities? 1 (yes)
   Certificates to activate: 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17
18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40
41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63
64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86
87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107
108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124
125 126 127 128
   Updating certificates in /etc/ssl/certs...
   128 added, 0 removed; done.

3. "curl https://www.google.com"  now succeeds.

What now? How do I get this fixed in Debian and/ or the official
container image?

Is there a way to automate the above so I can do it as a workaround in
the container creation?

Greetings,
Mark

[toc] | [prev] | [next] | [standalone]

#222244

From	Reco <recoverym4n@enotuniq.net>
Date	2020-05-05 08:30 +0200
Message-ID	<A2Zfz-4T5-1@gated-at.bofh.it>
In reply to	#222243

	Hi.

On Tue, May 05, 2020 at 08:05:04AM +0200, Mark Jonas wrote:
> What now? How do I get this fixed in Debian and/ or the official
> container image?

I was under the impression that you're creating your own docker
container anyway.
Add it to docker build file or whatever it's called.

Reco

[toc] | [prev] | [next] | [standalone]

#222245

From	Mark Jonas <toertel@gmail.com>
Date	2020-05-05 08:50 +0200
Message-ID	<A2ZyV-4Zt-1@gated-at.bofh.it>
In reply to	#222244

Hi Reco,

> > What now? How do I get this fixed in Debian and/ or the official
> > container image?
>
> I was under the impression that you're creating your own docker
> container anyway.
> Add it to docker build file or whatever it's called.

Yes, I have my own Dockerfile and I can add to it whatever I want. But
"dpkg-reconfigure ca-certificates" asks a lot of questions. And that
list from 1 to 128 might eventually change. So I am puzzled how to
automate that without human intervention.

I am also very much interested in getting the attention of the right
person to fix the official Debian Docker base image. Do you have an
idea whom I shall contact?

Greetings,
Mark

[toc] | [prev] | [next] | [standalone]

#222247

From	Andrei POPESCU <andreimpopescu@gmail.com>
Date	2020-05-05 09:20 +0200
Message-ID	<A301X-5ok-5@gated-at.bofh.it>
In reply to	#222245

[Multipart message — attachments visible in raw view] — view raw

On Ma, 05 mai 20, 08:44:43, Mark Jonas wrote:
> 
> I am also very much interested in getting the attention of the right
> person to fix the official Debian Docker base image. Do you have an
> idea whom I shall contact?

You didn't mention where you got your images from, but maybe this is a 
start:
https://hub.docker.com/_/debian/

Kind regards,
Andrei
-- 
http://wiki.debian.org/FAQsFromDebianUser

[toc] | [prev] | [next] | [standalone]

#222248

From	Michael Howard <mike@dewberryfields.co.uk>
Date	2020-05-05 09:20 +0200
Message-ID	<A301Y-5ok-13@gated-at.bofh.it>
In reply to	#222245

[Multipart message — attachments visible in raw view] — view raw

On 05/05/2020 07:44, Mark Jonas wrote:
> Hi Reco,
>
>>> What now? How do I get this fixed in Debian and/ or the official
>>> container image?
>> I was under the impression that you're creating your own docker
>> container anyway.
>> Add it to docker build file or whatever it's called.
> Yes, I have my own Dockerfile and I can add to it whatever I want. But
> "dpkg-reconfigure ca-certificates" asks a lot of questions. And that
> list from 1 to 128 might eventually change. So I am puzzled how to
> automate that without human intervention.
>
>

Does 'update-ca-certificates' not work? Doesn't need interaction. 
Apologies if I missed something, haven't read the whole thread.

-- 
Michael Howard

[toc] | [prev] | [next] | [standalone]

#222254

From	Mark Jonas <toertel@gmail.com>
Date	2020-05-05 16:10 +0200
Message-ID	<A36qK-X3-7@gated-at.bofh.it>
In reply to	#222248

Hi Michael,

yes, I also tried "update-ca-certificates" and it doesn't work.

# curl https://www.google.com
curl: (60) SSL certificate problem: unable to get local issuer certificate
More details here: https://curl.haxx.se/docs/sslcerts.html

curl failed to verify the legitimacy of the server and therefore could not
establish a secure connection to it. To learn more about this situation and
how to fix it, please visit the web page mentioned above.

# update-ca-certificates
Updating certificates in /etc/ssl/certs...
0 added, 0 removed; done.
Running hooks in /etc/ca-certificates/update.d...
done.

# curl https://www.google.com
curl: (60) SSL certificate problem: unable to get local issuer certificate
More details here: https://curl.haxx.se/docs/sslcerts.html

curl failed to verify the legitimacy of the server and therefore could not
establish a secure connection to it. To learn more about this situation and
how to fix it, please visit the web page mentioned above.

I suspect that the certificate database looks good enough for
"update-ca-certificates" to skip over it but it is actually somehow
broken.

# ls -la /etc/ssl/certs/
total 592
drwxr-xr-x 1 root root   4096 May  5 13:57  .
drwxr-xr-x 1 root root   4096 May  1 13:06  ..
lrwxrwxrwx 1 root root     48 May  1 13:06  ACCVRAIZ1.pem ->
/usr/share/ca-certificates/mozilla/ACCVRAIZ1.crt
lrwxrwxrwx 1 root root     55 May  1 13:06  AC_RAIZ_FNMT-RCM.pem ->
/usr/share/ca-certificates/mozilla/AC_RAIZ_FNMT-RCM.crt
lrwxrwxrwx 1 root root     69 May  1 13:06
Actalis_Authentication_Root_CA.pem ->
/usr/share/ca-certificates/mozilla/Actalis_Authentication_Root_CA.crt
lrwxrwxrwx 1 root root     61 May  1 13:06  AddTrust_External_Root.pem
-> /usr/share/ca-certificates/mozilla/AddTrust_External_Root.crt
lrwxrwxrwx 1 root root     61 May  1 13:06  AffirmTrust_Commercial.pem
-> /usr/share/ca-certificates/mozilla/AffirmTrust_Commercial.crt
lrwxrwxrwx 1 root root     61 May  1 13:06  AffirmTrust_Networking.pem
-> /usr/share/ca-certificates/mozilla/AffirmTrust_Networking.crt
lrwxrwxrwx 1 root root     58 May  1 13:06  AffirmTrust_Premium.pem ->
/usr/share/ca-certificates/mozilla/AffirmTrust_Premium.crt
lrwxrwxrwx 1 root root     62 May  1 13:06
AffirmTrust_Premium_ECC.pem ->
/usr/share/ca-certificates/mozilla/AffirmTrust_Premium_ECC.crt
lrwxrwxrwx 1 root root     55 May  1 13:06  Amazon_Root_CA_1.pem ->
/usr/share/ca-certificates/mozilla/Amazon_Root_CA_1.crt
lrwxrwxrwx 1 root root     55 May  1 13:06  Amazon_Root_CA_2.pem ->
/usr/share/ca-certificates/mozilla/Amazon_Root_CA_2.crt
lrwxrwxrwx 1 root root     55 May  1 13:06  Amazon_Root_CA_3.pem ->
/usr/share/ca-certificates/mozilla/Amazon_Root_CA_3.crt
lrwxrwxrwx 1 root root     55 May  1 13:06  Amazon_Root_CA_4.pem ->
/usr/share/ca-certificates/mozilla/Amazon_Root_CA_4.crt
lrwxrwxrwx 1 root root     60 May  1 13:06  Atos_TrustedRoot_2011.pem
-> /usr/share/ca-certificates/mozilla/Atos_TrustedRoot_2011.crt
lrwxrwxrwx 1 root root     96 May  1 13:06
Autoridad_de_Certificacion_Firmaprofesional_CIF_A62634068.pem ->
/usr/share/ca-certificates/mozilla/Autoridad_de_Certificacion_Firmaprofesional_CIF_A62634068.crt
lrwxrwxrwx 1 root root     64 May  1 13:06
Baltimore_CyberTrust_Root.pem ->
/usr/share/ca-certificates/mozilla/Baltimore_CyberTrust_Root.crt
lrwxrwxrwx 1 root root     62 May  1 13:06
Buypass_Class_2_Root_CA.pem ->
/usr/share/ca-certificates/mozilla/Buypass_Class_2_Root_CA.crt
lrwxrwxrwx 1 root root     62 May  1 13:06
Buypass_Class_3_Root_CA.pem ->
/usr/share/ca-certificates/mozilla/Buypass_Class_3_Root_CA.crt
lrwxrwxrwx 1 root root     55 May  1 13:06  CA_Disig_Root_R2.pem ->
/usr/share/ca-certificates/mozilla/CA_Disig_Root_R2.crt
lrwxrwxrwx 1 root root     51 May  1 13:06  CFCA_EV_ROOT.pem ->
/usr/share/ca-certificates/mozilla/CFCA_EV_ROOT.crt
lrwxrwxrwx 1 root root     69 May  1 13:06
COMODO_Certification_Authority.pem ->
/usr/share/ca-certificates/mozilla/COMODO_Certification_Authority.crt
lrwxrwxrwx 1 root root     73 May  1 13:06
COMODO_ECC_Certification_Authority.pem ->
/usr/share/ca-certificates/mozilla/COMODO_ECC_Certification_Authority.crt
lrwxrwxrwx 1 root root     73 May  1 13:06
COMODO_RSA_Certification_Authority.pem ->
/usr/share/ca-certificates/mozilla/COMODO_RSA_Certification_Authority.crt
lrwxrwxrwx 1 root root     47 May  1 13:06  Certigna.pem ->
/usr/share/ca-certificates/mozilla/Certigna.crt
lrwxrwxrwx 1 root root     59 May  1 13:06  Certinomis_-_Root_CA.pem
-> /usr/share/ca-certificates/mozilla/Certinomis_-_Root_CA.crt
lrwxrwxrwx 1 root root     66 May  1 13:06
Certplus_Class_2_Primary_CA.pem ->
/usr/share/ca-certificates/mozilla/Certplus_Class_2_Primary_CA.crt
lrwxrwxrwx 1 root root     64 May  1 13:06
Certum_Trusted_Network_CA.pem ->
/usr/share/ca-certificates/mozilla/Certum_Trusted_Network_CA.crt
lrwxrwxrwx 1 root root     66 May  1 13:06
Certum_Trusted_Network_CA_2.pem ->
/usr/share/ca-certificates/mozilla/Certum_Trusted_Network_CA_2.crt
lrwxrwxrwx 1 root root     71 May  1 13:06
Chambers_of_Commerce_Root_-_2008.pem ->
/usr/share/ca-certificates/mozilla/Chambers_of_Commerce_Root_-_2008.crt
lrwxrwxrwx 1 root root     63 May  1 13:06
Comodo_AAA_Services_root.pem ->
/usr/share/ca-certificates/mozilla/Comodo_AAA_Services_root.crt
lrwxrwxrwx 1 root root     61 May  1 13:06  Cybertrust_Global_Root.pem
-> /usr/share/ca-certificates/mozilla/Cybertrust_Global_Root.crt
lrwxrwxrwx 1 root root     69 May  1 13:06
D-TRUST_Root_Class_3_CA_2_2009.pem ->
/usr/share/ca-certificates/mozilla/D-TRUST_Root_Class_3_CA_2_2009.crt
lrwxrwxrwx 1 root root     72 May  1 13:06
D-TRUST_Root_Class_3_CA_2_EV_2009.pem ->
/usr/share/ca-certificates/mozilla/D-TRUST_Root_Class_3_CA_2_EV_2009.crt
lrwxrwxrwx 1 root root     53 May  1 13:06  DST_Root_CA_X3.pem ->
/usr/share/ca-certificates/mozilla/DST_Root_CA_X3.crt
lrwxrwxrwx 1 root root     65 May  1 13:06
Deutsche_Telekom_Root_CA_2.pem ->
/usr/share/ca-certificates/mozilla/Deutsche_Telekom_Root_CA_2.crt
lrwxrwxrwx 1 root root     66 May  1 13:06
DigiCert_Assured_ID_Root_CA.pem ->
/usr/share/ca-certificates/mozilla/DigiCert_Assured_ID_Root_CA.crt
lrwxrwxrwx 1 root root     66 May  1 13:06
DigiCert_Assured_ID_Root_G2.pem ->
/usr/share/ca-certificates/mozilla/DigiCert_Assured_ID_Root_G2.crt
lrwxrwxrwx 1 root root     66 May  1 13:06
DigiCert_Assured_ID_Root_G3.pem ->
/usr/share/ca-certificates/mozilla/DigiCert_Assured_ID_Root_G3.crt
lrwxrwxrwx 1 root root     62 May  1 13:06
DigiCert_Global_Root_CA.pem ->
/usr/share/ca-certificates/mozilla/DigiCert_Global_Root_CA.crt
lrwxrwxrwx 1 root root     62 May  1 13:06
DigiCert_Global_Root_G2.pem ->
/usr/share/ca-certificates/mozilla/DigiCert_Global_Root_G2.crt
lrwxrwxrwx 1 root root     62 May  1 13:06
DigiCert_Global_Root_G3.pem ->
/usr/share/ca-certificates/mozilla/DigiCert_Global_Root_G3.crt
lrwxrwxrwx 1 root root     73 May  1 13:06
DigiCert_High_Assurance_EV_Root_CA.pem ->
/usr/share/ca-certificates/mozilla/DigiCert_High_Assurance_EV_Root_CA.crt
lrwxrwxrwx 1 root root     63 May  1 13:06
DigiCert_Trusted_Root_G4.pem ->
/usr/share/ca-certificates/mozilla/DigiCert_Trusted_Root_G4.crt
lrwxrwxrwx 1 root root     70 May  1 13:06
E-Tugra_Certification_Authority.pem ->
/usr/share/ca-certificates/mozilla/E-Tugra_Certification_Authority.crt
lrwxrwxrwx 1 root root     45 May  1 13:06  EC-ACC.pem ->
/usr/share/ca-certificates/mozilla/EC-ACC.crt
lrwxrwxrwx 1 root root     70 May  1 13:06
EE_Certification_Centre_Root_CA.pem ->
/usr/share/ca-certificates/mozilla/EE_Certification_Centre_Root_CA.crt
lrwxrwxrwx 1 root root     80 May  1 13:06
Entrust.net_Premium_2048_Secure_Server_CA.pem ->
/usr/share/ca-certificates/mozilla/Entrust.net_Premium_2048_Secure_Server_CA.crt
lrwxrwxrwx 1 root root     75 May  1 13:06
Entrust_Root_Certification_Authority.pem ->
/usr/share/ca-certificates/mozilla/Entrust_Root_Certification_Authority.crt
lrwxrwxrwx 1 root root     81 May  1 13:06
Entrust_Root_Certification_Authority_-_EC1.pem ->
/usr/share/ca-certificates/mozilla/Entrust_Root_Certification_Authority_-_EC1.crt
lrwxrwxrwx 1 root root     80 May  1 13:06
Entrust_Root_Certification_Authority_-_G2.pem ->
/usr/share/ca-certificates/mozilla/Entrust_Root_Certification_Authority_-_G2.crt
lrwxrwxrwx 1 root root     61 May  1 13:06  GDCA_TrustAUTH_R5_ROOT.pem
-> /usr/share/ca-certificates/mozilla/GDCA_TrustAUTH_R5_ROOT.crt
lrwxrwxrwx 1 root root     57 May  1 13:06  GeoTrust_Global_CA.pem ->
/usr/share/ca-certificates/mozilla/GeoTrust_Global_CA.crt
lrwxrwxrwx 1 root root     79 May  1 13:06
GeoTrust_Primary_Certification_Authority.pem ->
/usr/share/ca-certificates/mozilla/GeoTrust_Primary_Certification_Authority.crt
lrwxrwxrwx 1 root root     84 May  1 13:06
GeoTrust_Primary_Certification_Authority_-_G2.pem ->
/usr/share/ca-certificates/mozilla/GeoTrust_Primary_Certification_Authority_-_G2.crt
lrwxrwxrwx 1 root root     84 May  1 13:06
GeoTrust_Primary_Certification_Authority_-_G3.pem ->
/usr/share/ca-certificates/mozilla/GeoTrust_Primary_Certification_Authority_-_G3.crt
lrwxrwxrwx 1 root root     60 May  1 13:06  GeoTrust_Universal_CA.pem
-> /usr/share/ca-certificates/mozilla/GeoTrust_Universal_CA.crt
lrwxrwxrwx 1 root root     62 May  1 13:06
GeoTrust_Universal_CA_2.pem ->
/usr/share/ca-certificates/mozilla/GeoTrust_Universal_CA_2.crt
lrwxrwxrwx 1 root root     66 May  1 13:06
GlobalSign_ECC_Root_CA_-_R4.pem ->
/usr/share/ca-certificates/mozilla/GlobalSign_ECC_Root_CA_-_R4.crt
lrwxrwxrwx 1 root root     66 May  1 13:06
GlobalSign_ECC_Root_CA_-_R5.pem ->
/usr/share/ca-certificates/mozilla/GlobalSign_ECC_Root_CA_-_R5.crt
lrwxrwxrwx 1 root root     57 May  1 13:06  GlobalSign_Root_CA.pem ->
/usr/share/ca-certificates/mozilla/GlobalSign_Root_CA.crt
lrwxrwxrwx 1 root root     62 May  1 13:06
GlobalSign_Root_CA_-_R2.pem ->
/usr/share/ca-certificates/mozilla/GlobalSign_Root_CA_-_R2.crt
lrwxrwxrwx 1 root root     62 May  1 13:06
GlobalSign_Root_CA_-_R3.pem ->
/usr/share/ca-certificates/mozilla/GlobalSign_Root_CA_-_R3.crt
lrwxrwxrwx 1 root root     62 May  1 13:06
GlobalSign_Root_CA_-_R6.pem ->
/usr/share/ca-certificates/mozilla/GlobalSign_Root_CA_-_R6.crt
lrwxrwxrwx 1 root root     69 May  1 13:06
Global_Chambersign_Root_-_2008.pem ->
/usr/share/ca-certificates/mozilla/Global_Chambersign_Root_-_2008.crt
lrwxrwxrwx 1 root root     58 May  1 13:06  Go_Daddy_Class_2_CA.pem ->
/usr/share/ca-certificates/mozilla/Go_Daddy_Class_2_CA.crt
lrwxrwxrwx 1 root root     79 May  1 13:06
Go_Daddy_Root_Certificate_Authority_-_G2.pem ->
/usr/share/ca-certificates/mozilla/Go_Daddy_Root_Certificate_Authority_-_G2.crt
lrwxrwxrwx 1 root root     98 May  1 13:06
Hellenic_Academic_and_Research_Institutions_ECC_RootCA_2015.pem ->
/usr/share/ca-certificates/mozilla/Hellenic_Academic_and_Research_Institutions_ECC_RootCA_2015.crt
lrwxrwxrwx 1 root root     94 May  1 13:06
Hellenic_Academic_and_Research_Institutions_RootCA_2011.pem ->
/usr/share/ca-certificates/mozilla/Hellenic_Academic_and_Research_Institutions_RootCA_2011.crt
lrwxrwxrwx 1 root root     94 May  1 13:06
Hellenic_Academic_and_Research_Institutions_RootCA_2015.pem ->
/usr/share/ca-certificates/mozilla/Hellenic_Academic_and_Research_Institutions_RootCA_2015.crt
lrwxrwxrwx 1 root root     62 May  1 13:06
Hongkong_Post_Root_CA_1.pem ->
/usr/share/ca-certificates/mozilla/Hongkong_Post_Root_CA_1.crt
lrwxrwxrwx 1 root root     51 May  1 13:06  ISRG_Root_X1.pem ->
/usr/share/ca-certificates/mozilla/ISRG_Root_X1.crt
lrwxrwxrwx 1 root root     69 May  1 13:06
IdenTrust_Commercial_Root_CA_1.pem ->
/usr/share/ca-certificates/mozilla/IdenTrust_Commercial_Root_CA_1.crt
lrwxrwxrwx 1 root root     72 May  1 13:06
IdenTrust_Public_Sector_Root_CA_1.pem ->
/usr/share/ca-certificates/mozilla/IdenTrust_Public_Sector_Root_CA_1.crt
lrwxrwxrwx 1 root root     49 May  1 13:06  Izenpe.com.pem ->
/usr/share/ca-certificates/mozilla/Izenpe.com.crt
lrwxrwxrwx 1 root root     61 May  1 13:06  LuxTrust_Global_Root_2.pem
-> /usr/share/ca-certificates/mozilla/LuxTrust_Global_Root_2.crt
lrwxrwxrwx 1 root root     69 May  1 13:06
Microsec_e-Szigno_Root_CA_2009.pem ->
/usr/share/ca-certificates/mozilla/Microsec_e-Szigno_Root_CA_2009.crt
lrwxrwxrwx 1 root root     83 May  1 13:06
'NetLock_Arany_=Class_Gold=_F'$'\305\221''tan'$'\303\272''s'$'\303\255''tv'$'\303\241''ny.pem'
-> '/usr/share/ca-certificates/mozilla/NetLock_Arany_=Class_Gold=_F'$'\305\221''tan'$'\303\272''s'$'\303\255''tv'$'\303\241''ny.crt'
lrwxrwxrwx 1 root root     78 May  1 13:06
Network_Solutions_Certificate_Authority.pem ->
/usr/share/ca-certificates/mozilla/Network_Solutions_Certificate_Authority.crt
lrwxrwxrwx 1 root root     70 May  1 13:06
OISTE_WISeKey_Global_Root_GA_CA.pem ->
/usr/share/ca-certificates/mozilla/OISTE_WISeKey_Global_Root_GA_CA.crt
lrwxrwxrwx 1 root root     70 May  1 13:06
OISTE_WISeKey_Global_Root_GB_CA.pem ->
/usr/share/ca-certificates/mozilla/OISTE_WISeKey_Global_Root_GB_CA.crt
lrwxrwxrwx 1 root root     70 May  1 13:06
OISTE_WISeKey_Global_Root_GC_CA.pem ->
/usr/share/ca-certificates/mozilla/OISTE_WISeKey_Global_Root_GC_CA.crt
lrwxrwxrwx 1 root root     55 May  1 13:06  QuoVadis_Root_CA.pem ->
/usr/share/ca-certificates/mozilla/QuoVadis_Root_CA.crt
lrwxrwxrwx 1 root root     60 May  1 13:06  QuoVadis_Root_CA_1_G3.pem
-> /usr/share/ca-certificates/mozilla/QuoVadis_Root_CA_1_G3.crt
lrwxrwxrwx 1 root root     57 May  1 13:06  QuoVadis_Root_CA_2.pem ->
/usr/share/ca-certificates/mozilla/QuoVadis_Root_CA_2.crt
lrwxrwxrwx 1 root root     60 May  1 13:06  QuoVadis_Root_CA_2_G3.pem
-> /usr/share/ca-certificates/mozilla/QuoVadis_Root_CA_2_G3.crt
lrwxrwxrwx 1 root root     57 May  1 13:06  QuoVadis_Root_CA_3.pem ->
/usr/share/ca-certificates/mozilla/QuoVadis_Root_CA_3.crt
lrwxrwxrwx 1 root root     60 May  1 13:06  QuoVadis_Root_CA_3_G3.pem
-> /usr/share/ca-certificates/mozilla/QuoVadis_Root_CA_3_G3.crt
lrwxrwxrwx 1 root root     82 May  1 13:06
SSL.com_EV_Root_Certification_Authority_ECC.pem ->
/usr/share/ca-certificates/mozilla/SSL.com_EV_Root_Certification_Authority_ECC.crt
lrwxrwxrwx 1 root root     85 May  1 13:06
SSL.com_EV_Root_Certification_Authority_RSA_R2.pem ->
/usr/share/ca-certificates/mozilla/SSL.com_EV_Root_Certification_Authority_RSA_R2.crt
lrwxrwxrwx 1 root root     79 May  1 13:06
SSL.com_Root_Certification_Authority_ECC.pem ->
/usr/share/ca-certificates/mozilla/SSL.com_Root_Certification_Authority_ECC.crt
lrwxrwxrwx 1 root root     79 May  1 13:06
SSL.com_Root_Certification_Authority_RSA.pem ->
/usr/share/ca-certificates/mozilla/SSL.com_Root_Certification_Authority_RSA.crt
lrwxrwxrwx 1 root root     54 May  1 13:06  SZAFIR_ROOT_CA2.pem ->
/usr/share/ca-certificates/mozilla/SZAFIR_ROOT_CA2.crt
lrwxrwxrwx 1 root root     58 May  1 13:06  SecureSign_RootCA11.pem ->
/usr/share/ca-certificates/mozilla/SecureSign_RootCA11.crt
lrwxrwxrwx 1 root root     53 May  1 13:06  SecureTrust_CA.pem ->
/usr/share/ca-certificates/mozilla/SecureTrust_CA.crt
lrwxrwxrwx 1 root root     55 May  1 13:06  Secure_Global_CA.pem ->
/usr/share/ca-certificates/mozilla/Secure_Global_CA.crt
lrwxrwxrwx 1 root root     69 May  1 13:06
Security_Communication_RootCA2.pem ->
/usr/share/ca-certificates/mozilla/Security_Communication_RootCA2.crt
lrwxrwxrwx 1 root root     69 May  1 13:06
Security_Communication_Root_CA.pem ->
/usr/share/ca-certificates/mozilla/Security_Communication_Root_CA.crt
lrwxrwxrwx 1 root root     61 May  1 13:06  Sonera_Class_2_Root_CA.pem
-> /usr/share/ca-certificates/mozilla/Sonera_Class_2_Root_CA.crt
lrwxrwxrwx 1 root root     71 May  1 13:06
Staat_der_Nederlanden_EV_Root_CA.pem ->
/usr/share/ca-certificates/mozilla/Staat_der_Nederlanden_EV_Root_CA.crt
lrwxrwxrwx 1 root root     73 May  1 13:06
Staat_der_Nederlanden_Root_CA_-_G2.pem ->
/usr/share/ca-certificates/mozilla/Staat_der_Nederlanden_Root_CA_-_G2.crt
lrwxrwxrwx 1 root root     73 May  1 13:06
Staat_der_Nederlanden_Root_CA_-_G3.pem ->
/usr/share/ca-certificates/mozilla/Staat_der_Nederlanden_Root_CA_-_G3.crt
lrwxrwxrwx 1 root root     59 May  1 13:06  Starfield_Class_2_CA.pem
-> /usr/share/ca-certificates/mozilla/Starfield_Class_2_CA.crt
lrwxrwxrwx 1 root root     80 May  1 13:06
Starfield_Root_Certificate_Authority_-_G2.pem ->
/usr/share/ca-certificates/mozilla/Starfield_Root_Certificate_Authority_-_G2.crt
lrwxrwxrwx 1 root root     89 May  1 13:06
Starfield_Services_Root_Certificate_Authority_-_G2.pem ->
/usr/share/ca-certificates/mozilla/Starfield_Services_Root_Certificate_Authority_-_G2.crt
lrwxrwxrwx 1 root root     61 May  1 13:06  SwissSign_Gold_CA_-_G2.pem
-> /usr/share/ca-certificates/mozilla/SwissSign_Gold_CA_-_G2.crt
lrwxrwxrwx 1 root root     63 May  1 13:06
SwissSign_Silver_CA_-_G2.pem ->
/usr/share/ca-certificates/mozilla/SwissSign_Silver_CA_-_G2.crt
lrwxrwxrwx 1 root root     67 May  1 13:06
T-TeleSec_GlobalRoot_Class_2.pem ->
/usr/share/ca-certificates/mozilla/T-TeleSec_GlobalRoot_Class_2.crt
lrwxrwxrwx 1 root root     67 May  1 13:06
T-TeleSec_GlobalRoot_Class_3.pem ->
/usr/share/ca-certificates/mozilla/T-TeleSec_GlobalRoot_Class_3.crt
lrwxrwxrwx 1 root root     84 May  1 13:06
TUBITAK_Kamu_SM_SSL_Kok_Sertifikasi_-_Surum_1.pem ->
/usr/share/ca-certificates/mozilla/TUBITAK_Kamu_SM_SSL_Kok_Sertifikasi_-_Surum_1.crt
lrwxrwxrwx 1 root root     58 May  1 13:06  TWCA_Global_Root_CA.pem ->
/usr/share/ca-certificates/mozilla/TWCA_Global_Root_CA.crt
lrwxrwxrwx 1 root root     72 May  1 13:06
TWCA_Root_Certification_Authority.pem ->
/usr/share/ca-certificates/mozilla/TWCA_Root_Certification_Authority.crt
lrwxrwxrwx 1 root root     50 May  1 13:06  Taiwan_GRCA.pem ->
/usr/share/ca-certificates/mozilla/Taiwan_GRCA.crt
lrwxrwxrwx 1 root root     61 May  1 13:06  TeliaSonera_Root_CA_v1.pem
-> /usr/share/ca-certificates/mozilla/TeliaSonera_Root_CA_v1.crt
lrwxrwxrwx 1 root root     53 May  1 13:06  TrustCor_ECA-1.pem ->
/usr/share/ca-certificates/mozilla/TrustCor_ECA-1.crt
lrwxrwxrwx 1 root root     61 May  1 13:06  TrustCor_RootCert_CA-1.pem
-> /usr/share/ca-certificates/mozilla/TrustCor_RootCert_CA-1.crt
lrwxrwxrwx 1 root root     61 May  1 13:06  TrustCor_RootCert_CA-2.pem
-> /usr/share/ca-certificates/mozilla/TrustCor_RootCert_CA-2.crt
lrwxrwxrwx 1 root root     58 May  1 13:06  Trustis_FPS_Root_CA.pem ->
/usr/share/ca-certificates/mozilla/Trustis_FPS_Root_CA.crt
lrwxrwxrwx 1 root root     76 May  1 13:06
USERTrust_ECC_Certification_Authority.pem ->
/usr/share/ca-certificates/mozilla/USERTrust_ECC_Certification_Authority.crt
lrwxrwxrwx 1 root root     76 May  1 13:06
USERTrust_RSA_Certification_Authority.pem ->
/usr/share/ca-certificates/mozilla/USERTrust_RSA_Certification_Authority.crt
lrwxrwxrwx 1 root root     99 May  1 13:06
VeriSign_Class_3_Public_Primary_Certification_Authority_-_G4.pem ->
/usr/share/ca-certificates/mozilla/VeriSign_Class_3_Public_Primary_Certification_Authority_-_G4.crt
lrwxrwxrwx 1 root root     99 May  1 13:06
VeriSign_Class_3_Public_Primary_Certification_Authority_-_G5.pem ->
/usr/share/ca-certificates/mozilla/VeriSign_Class_3_Public_Primary_Certification_Authority_-_G5.crt
lrwxrwxrwx 1 root root     86 May  1 13:06
VeriSign_Universal_Root_Certification_Authority.pem ->
/usr/share/ca-certificates/mozilla/VeriSign_Universal_Root_Certification_Authority.crt
lrwxrwxrwx 1 root root     99 May  1 13:06
Verisign_Class_3_Public_Primary_Certification_Authority_-_G3.pem ->
/usr/share/ca-certificates/mozilla/Verisign_Class_3_Public_Primary_Certification_Authority_-_G3.crt
lrwxrwxrwx 1 root root     59 May  1 13:06  XRamp_Global_CA_Root.pem
-> /usr/share/ca-certificates/mozilla/XRamp_Global_CA_Root.crt
-rw-r--r-- 1 root root 200061 May  5 13:57  ca-certificates.crt
lrwxrwxrwx 1 root root     55 May  1 13:06  certSIGN_ROOT_CA.pem ->
/usr/share/ca-certificates/mozilla/certSIGN_ROOT_CA.crt
lrwxrwxrwx 1 root root     72 May  1 13:06
ePKI_Root_Certification_Authority.pem ->
/usr/share/ca-certificates/mozilla/ePKI_Root_Certification_Authority.crt
lrwxrwxrwx 1 root root     61 May  1 13:06  thawte_Primary_Root_CA.pem
-> /usr/share/ca-certificates/mozilla/thawte_Primary_Root_CA.crt
lrwxrwxrwx 1 root root     66 May  1 13:06
thawte_Primary_Root_CA_-_G2.pem ->
/usr/share/ca-certificates/mozilla/thawte_Primary_Root_CA_-_G2.crt
lrwxrwxrwx 1 root root     66 May  1 13:06
thawte_Primary_Root_CA_-_G3.pem ->
/usr/share/ca-certificates/mozilla/thawte_Primary_Root_CA_-_G3.crt

Greetings,
Mark

On Tue, May 5, 2020 at 9:10 AM Michael Howard <mike@dewberryfields.co.uk> wrote:
>
> On 05/05/2020 07:44, Mark Jonas wrote:
>
> Hi Reco,
>
> What now? How do I get this fixed in Debian and/ or the official
> container image?
>
> I was under the impression that you're creating your own docker
> container anyway.
> Add it to docker build file or whatever it's called.
>
> Yes, I have my own Dockerfile and I can add to it whatever I want. But
> "dpkg-reconfigure ca-certificates" asks a lot of questions. And that
> list from 1 to 128 might eventually change. So I am puzzled how to
> automate that without human intervention.
>
>
>
> Does 'update-ca-certificates' not work? Doesn't need interaction. Apologies if I missed something, haven't read the whole thread.
>
> --
> Michael Howard

[toc] | [prev] | [next] | [standalone]

#222249

From	Reco <recoverym4n@enotuniq.net>
Date	2020-05-05 09:30 +0200
Message-ID	<A30bE-5rA-11@gated-at.bofh.it>
In reply to	#222245

On Tue, May 05, 2020 at 08:44:43AM +0200, Mark Jonas wrote:
> Hi Reco,
> 
> > > What now? How do I get this fixed in Debian and/ or the official
> > > container image?
> >
> > I was under the impression that you're creating your own docker
> > container anyway.
> > Add it to docker build file or whatever it's called.
> 
> Yes, I have my own Dockerfile and I can add to it whatever I want. But
> "dpkg-reconfigure ca-certificates" asks a lot of questions. And that
> list from 1 to 128 might eventually change. So I am puzzled how to
> automate that without human intervention.

dpkg-reconfigure --default-priority ca-certificates

> I am also very much interested in getting the attention of the right
> person to fix the official Debian Docker base image. Do you have an
> idea whom I shall contact?

No idea here.

Reco

[toc] | [prev] | [next] | [standalone]

#222258

From	Mark Jonas <toertel@gmail.com>
Date	2020-05-05 16:50 +0200
Message-ID	<A373s-1a5-5@gated-at.bofh.it>
In reply to	#222249

Hi Reco,

> > Yes, I have my own Dockerfile and I can add to it whatever I want. But
> > "dpkg-reconfigure ca-certificates" asks a lot of questions. And that
> > list from 1 to 128 might eventually change. So I am puzzled how to
> > automate that without human intervention.
>
> dpkg-reconfigure --default-priority ca-certificates

Yes, now it does not ask questions. But the workaround so far is to
run dpkg-reconfigure once to remove all certificates and then once
again to re-add all of them. I do not know what "dpkg-reconfigure
--default-priority ca-certificates" does.

Thanks for your help,
Mark

[toc] | [prev] | [next] | [standalone]

#222252

From	Greg Wooledge <wooledg@eeg.ccf.org>
Date	2020-05-05 13:40 +0200
Message-ID	<A345A-7Rn-13@gated-at.bofh.it>
In reply to	#222243

> > > 1613  stat64("/etc/ssl/certs/4a6481c9.0", 0x7ec95160) = -1 ENOENT (No
> > > such file or directory)
> >
> > Presumably ca-certificates postinst script haven't run, because these
> > symlinks missing ain't normal.
> 
> Ubuntu 18.04 on my PC gives more or less the same errors but succeeds.
> So I have some doubt. I think the symlinks are there.

You... *think* it's there?  Why not actually look?

unicorn:~$ ls -l /etc/ssl/certs/4a6481c9.0
lrwxrwxrwx 1 root root 27 Jul 14  2018 /etc/ssl/certs/4a6481c9.0 -> GlobalSign_Root_CA_-_R2.pem

It takes a few seconds, and then you can remove all doubt.

Be sure you issue the command within the chroot/container.

[toc] | [prev] | [next] | [standalone]

#222256

From	Mark Jonas <toertel@gmail.com>
Date	2020-05-05 16:40 +0200
Message-ID	<A36TN-16y-15@gated-at.bofh.it>
In reply to	#222252

Hi Greg,

> You... *think* it's there?  Why not actually look?
>
> unicorn:~$ ls -l /etc/ssl/certs/4a6481c9.0
> lrwxrwxrwx 1 root root 27 Jul 14  2018 /etc/ssl/certs/4a6481c9.0 -> GlobalSign_Root_CA_-_R2.pem
>
> It takes a few seconds, and then you can remove all doubt.

Correct, the file is not there. But there are a lot of other links in
/etc/ssl/certs. But those links have real names, not just sequences of
numbers.

# ls -l /etc/ssl/certs/4a6481c9.0
ls: cannot access '/etc/ssl/certs/4a6481c9.0': No such file or directory

What is the difference between the numbered links and the ones with
human readable names?

I *think* that the problem is that these numbered links are missing.

How do I get in contact with somebody who can fix the problem in
Debian Buser and/ or the official Debian Buster arm32v7 Docker image?

Regards,
Mark

# ls -l /etc/ssl/certs/
total 580
lrwxrwxrwx 1 root root     48 May  1 13:06  ACCVRAIZ1.pem ->
/usr/share/ca-certificates/mozilla/ACCVRAIZ1.crt
lrwxrwxrwx 1 root root     55 May  1 13:06  AC_RAIZ_FNMT-RCM.pem ->
/usr/share/ca-certificates/mozilla/AC_RAIZ_FNMT-RCM.crt
lrwxrwxrwx 1 root root     69 May  1 13:06
Actalis_Authentication_Root_CA.pem ->
/usr/share/ca-certificates/mozilla/Actalis_Authentication_Root_CA.crt
lrwxrwxrwx 1 root root     61 May  1 13:06  AddTrust_External_Root.pem
-> /usr/share/ca-certificates/mozilla/AddTrust_External_Root.crt
lrwxrwxrwx 1 root root     61 May  1 13:06  AffirmTrust_Commercial.pem
-> /usr/share/ca-certificates/mozilla/AffirmTrust_Commercial.crt
lrwxrwxrwx 1 root root     61 May  1 13:06  AffirmTrust_Networking.pem
-> /usr/share/ca-certificates/mozilla/AffirmTrust_Networking.crt
lrwxrwxrwx 1 root root     58 May  1 13:06  AffirmTrust_Premium.pem ->
/usr/share/ca-certificates/mozilla/AffirmTrust_Premium.crt
lrwxrwxrwx 1 root root     62 May  1 13:06
AffirmTrust_Premium_ECC.pem ->
/usr/share/ca-certificates/mozilla/AffirmTrust_Premium_ECC.crt
lrwxrwxrwx 1 root root     55 May  1 13:06  Amazon_Root_CA_1.pem ->
/usr/share/ca-certificates/mozilla/Amazon_Root_CA_1.crt
lrwxrwxrwx 1 root root     55 May  1 13:06  Amazon_Root_CA_2.pem ->
/usr/share/ca-certificates/mozilla/Amazon_Root_CA_2.crt
lrwxrwxrwx 1 root root     55 May  1 13:06  Amazon_Root_CA_3.pem ->
/usr/share/ca-certificates/mozilla/Amazon_Root_CA_3.crt
lrwxrwxrwx 1 root root     55 May  1 13:06  Amazon_Root_CA_4.pem ->
/usr/share/ca-certificates/mozilla/Amazon_Root_CA_4.crt
lrwxrwxrwx 1 root root     60 May  1 13:06  Atos_TrustedRoot_2011.pem
-> /usr/share/ca-certificates/mozilla/Atos_TrustedRoot_2011.crt
lrwxrwxrwx 1 root root     96 May  1 13:06
Autoridad_de_Certificacion_Firmaprofesional_CIF_A62634068.pem ->
/usr/share/ca-certificates/mozilla/Autoridad_de_Certificacion_Firmaprofesional_CIF_A62634068.crt
lrwxrwxrwx 1 root root     64 May  1 13:06
Baltimore_CyberTrust_Root.pem ->
/usr/share/ca-certificates/mozilla/Baltimore_CyberTrust_Root.crt
lrwxrwxrwx 1 root root     62 May  1 13:06
Buypass_Class_2_Root_CA.pem ->
/usr/share/ca-certificates/mozilla/Buypass_Class_2_Root_CA.crt
lrwxrwxrwx 1 root root     62 May  1 13:06
Buypass_Class_3_Root_CA.pem ->
/usr/share/ca-certificates/mozilla/Buypass_Class_3_Root_CA.crt
lrwxrwxrwx 1 root root     55 May  1 13:06  CA_Disig_Root_R2.pem ->
/usr/share/ca-certificates/mozilla/CA_Disig_Root_R2.crt
lrwxrwxrwx 1 root root     51 May  1 13:06  CFCA_EV_ROOT.pem ->
/usr/share/ca-certificates/mozilla/CFCA_EV_ROOT.crt
lrwxrwxrwx 1 root root     69 May  1 13:06
COMODO_Certification_Authority.pem ->
/usr/share/ca-certificates/mozilla/COMODO_Certification_Authority.crt
lrwxrwxrwx 1 root root     73 May  1 13:06
COMODO_ECC_Certification_Authority.pem ->
/usr/share/ca-certificates/mozilla/COMODO_ECC_Certification_Authority.crt
lrwxrwxrwx 1 root root     73 May  1 13:06
COMODO_RSA_Certification_Authority.pem ->
/usr/share/ca-certificates/mozilla/COMODO_RSA_Certification_Authority.crt
lrwxrwxrwx 1 root root     47 May  1 13:06  Certigna.pem ->
/usr/share/ca-certificates/mozilla/Certigna.crt
lrwxrwxrwx 1 root root     59 May  1 13:06  Certinomis_-_Root_CA.pem
-> /usr/share/ca-certificates/mozilla/Certinomis_-_Root_CA.crt
lrwxrwxrwx 1 root root     66 May  1 13:06
Certplus_Class_2_Primary_CA.pem ->
/usr/share/ca-certificates/mozilla/Certplus_Class_2_Primary_CA.crt
lrwxrwxrwx 1 root root     64 May  1 13:06
Certum_Trusted_Network_CA.pem ->
/usr/share/ca-certificates/mozilla/Certum_Trusted_Network_CA.crt
lrwxrwxrwx 1 root root     66 May  1 13:06
Certum_Trusted_Network_CA_2.pem ->
/usr/share/ca-certificates/mozilla/Certum_Trusted_Network_CA_2.crt
lrwxrwxrwx 1 root root     71 May  1 13:06
Chambers_of_Commerce_Root_-_2008.pem ->
/usr/share/ca-certificates/mozilla/Chambers_of_Commerce_Root_-_2008.crt
lrwxrwxrwx 1 root root     63 May  1 13:06
Comodo_AAA_Services_root.pem ->
/usr/share/ca-certificates/mozilla/Comodo_AAA_Services_root.crt
lrwxrwxrwx 1 root root     61 May  1 13:06  Cybertrust_Global_Root.pem
-> /usr/share/ca-certificates/mozilla/Cybertrust_Global_Root.crt
lrwxrwxrwx 1 root root     69 May  1 13:06
D-TRUST_Root_Class_3_CA_2_2009.pem ->
/usr/share/ca-certificates/mozilla/D-TRUST_Root_Class_3_CA_2_2009.crt
lrwxrwxrwx 1 root root     72 May  1 13:06
D-TRUST_Root_Class_3_CA_2_EV_2009.pem ->
/usr/share/ca-certificates/mozilla/D-TRUST_Root_Class_3_CA_2_EV_2009.crt
lrwxrwxrwx 1 root root     53 May  1 13:06  DST_Root_CA_X3.pem ->
/usr/share/ca-certificates/mozilla/DST_Root_CA_X3.crt
lrwxrwxrwx 1 root root     65 May  1 13:06
Deutsche_Telekom_Root_CA_2.pem ->
/usr/share/ca-certificates/mozilla/Deutsche_Telekom_Root_CA_2.crt
lrwxrwxrwx 1 root root     66 May  1 13:06
DigiCert_Assured_ID_Root_CA.pem ->
/usr/share/ca-certificates/mozilla/DigiCert_Assured_ID_Root_CA.crt
lrwxrwxrwx 1 root root     66 May  1 13:06
DigiCert_Assured_ID_Root_G2.pem ->
/usr/share/ca-certificates/mozilla/DigiCert_Assured_ID_Root_G2.crt
lrwxrwxrwx 1 root root     66 May  1 13:06
DigiCert_Assured_ID_Root_G3.pem ->
/usr/share/ca-certificates/mozilla/DigiCert_Assured_ID_Root_G3.crt
lrwxrwxrwx 1 root root     62 May  1 13:06
DigiCert_Global_Root_CA.pem ->
/usr/share/ca-certificates/mozilla/DigiCert_Global_Root_CA.crt
lrwxrwxrwx 1 root root     62 May  1 13:06
DigiCert_Global_Root_G2.pem ->
/usr/share/ca-certificates/mozilla/DigiCert_Global_Root_G2.crt
lrwxrwxrwx 1 root root     62 May  1 13:06
DigiCert_Global_Root_G3.pem ->
/usr/share/ca-certificates/mozilla/DigiCert_Global_Root_G3.crt
lrwxrwxrwx 1 root root     73 May  1 13:06
DigiCert_High_Assurance_EV_Root_CA.pem ->
/usr/share/ca-certificates/mozilla/DigiCert_High_Assurance_EV_Root_CA.crt
lrwxrwxrwx 1 root root     63 May  1 13:06
DigiCert_Trusted_Root_G4.pem ->
/usr/share/ca-certificates/mozilla/DigiCert_Trusted_Root_G4.crt
lrwxrwxrwx 1 root root     70 May  1 13:06
E-Tugra_Certification_Authority.pem ->
/usr/share/ca-certificates/mozilla/E-Tugra_Certification_Authority.crt
lrwxrwxrwx 1 root root     45 May  1 13:06  EC-ACC.pem ->
/usr/share/ca-certificates/mozilla/EC-ACC.crt
lrwxrwxrwx 1 root root     70 May  1 13:06
EE_Certification_Centre_Root_CA.pem ->
/usr/share/ca-certificates/mozilla/EE_Certification_Centre_Root_CA.crt
lrwxrwxrwx 1 root root     80 May  1 13:06
Entrust.net_Premium_2048_Secure_Server_CA.pem ->
/usr/share/ca-certificates/mozilla/Entrust.net_Premium_2048_Secure_Server_CA.crt
lrwxrwxrwx 1 root root     75 May  1 13:06
Entrust_Root_Certification_Authority.pem ->
/usr/share/ca-certificates/mozilla/Entrust_Root_Certification_Authority.crt
lrwxrwxrwx 1 root root     81 May  1 13:06
Entrust_Root_Certification_Authority_-_EC1.pem ->
/usr/share/ca-certificates/mozilla/Entrust_Root_Certification_Authority_-_EC1.crt
lrwxrwxrwx 1 root root     80 May  1 13:06
Entrust_Root_Certification_Authority_-_G2.pem ->
/usr/share/ca-certificates/mozilla/Entrust_Root_Certification_Authority_-_G2.crt
lrwxrwxrwx 1 root root     61 May  1 13:06  GDCA_TrustAUTH_R5_ROOT.pem
-> /usr/share/ca-certificates/mozilla/GDCA_TrustAUTH_R5_ROOT.crt
lrwxrwxrwx 1 root root     57 May  1 13:06  GeoTrust_Global_CA.pem ->
/usr/share/ca-certificates/mozilla/GeoTrust_Global_CA.crt
lrwxrwxrwx 1 root root     79 May  1 13:06
GeoTrust_Primary_Certification_Authority.pem ->
/usr/share/ca-certificates/mozilla/GeoTrust_Primary_Certification_Authority.crt
lrwxrwxrwx 1 root root     84 May  1 13:06
GeoTrust_Primary_Certification_Authority_-_G2.pem ->
/usr/share/ca-certificates/mozilla/GeoTrust_Primary_Certification_Authority_-_G2.crt
lrwxrwxrwx 1 root root     84 May  1 13:06
GeoTrust_Primary_Certification_Authority_-_G3.pem ->
/usr/share/ca-certificates/mozilla/GeoTrust_Primary_Certification_Authority_-_G3.crt
lrwxrwxrwx 1 root root     60 May  1 13:06  GeoTrust_Universal_CA.pem
-> /usr/share/ca-certificates/mozilla/GeoTrust_Universal_CA.crt
lrwxrwxrwx 1 root root     62 May  1 13:06
GeoTrust_Universal_CA_2.pem ->
/usr/share/ca-certificates/mozilla/GeoTrust_Universal_CA_2.crt
lrwxrwxrwx 1 root root     66 May  1 13:06
GlobalSign_ECC_Root_CA_-_R4.pem ->
/usr/share/ca-certificates/mozilla/GlobalSign_ECC_Root_CA_-_R4.crt
lrwxrwxrwx 1 root root     66 May  1 13:06
GlobalSign_ECC_Root_CA_-_R5.pem ->
/usr/share/ca-certificates/mozilla/GlobalSign_ECC_Root_CA_-_R5.crt
lrwxrwxrwx 1 root root     57 May  1 13:06  GlobalSign_Root_CA.pem ->
/usr/share/ca-certificates/mozilla/GlobalSign_Root_CA.crt
lrwxrwxrwx 1 root root     62 May  1 13:06
GlobalSign_Root_CA_-_R2.pem ->
/usr/share/ca-certificates/mozilla/GlobalSign_Root_CA_-_R2.crt
lrwxrwxrwx 1 root root     62 May  1 13:06
GlobalSign_Root_CA_-_R3.pem ->
/usr/share/ca-certificates/mozilla/GlobalSign_Root_CA_-_R3.crt
lrwxrwxrwx 1 root root     62 May  1 13:06
GlobalSign_Root_CA_-_R6.pem ->
/usr/share/ca-certificates/mozilla/GlobalSign_Root_CA_-_R6.crt
lrwxrwxrwx 1 root root     69 May  1 13:06
Global_Chambersign_Root_-_2008.pem ->
/usr/share/ca-certificates/mozilla/Global_Chambersign_Root_-_2008.crt
lrwxrwxrwx 1 root root     58 May  1 13:06  Go_Daddy_Class_2_CA.pem ->
/usr/share/ca-certificates/mozilla/Go_Daddy_Class_2_CA.crt
lrwxrwxrwx 1 root root     79 May  1 13:06
Go_Daddy_Root_Certificate_Authority_-_G2.pem ->
/usr/share/ca-certificates/mozilla/Go_Daddy_Root_Certificate_Authority_-_G2.crt
lrwxrwxrwx 1 root root     98 May  1 13:06
Hellenic_Academic_and_Research_Institutions_ECC_RootCA_2015.pem ->
/usr/share/ca-certificates/mozilla/Hellenic_Academic_and_Research_Institutions_ECC_RootCA_2015.crt
lrwxrwxrwx 1 root root     94 May  1 13:06
Hellenic_Academic_and_Research_Institutions_RootCA_2011.pem ->
/usr/share/ca-certificates/mozilla/Hellenic_Academic_and_Research_Institutions_RootCA_2011.crt
lrwxrwxrwx 1 root root     94 May  1 13:06
Hellenic_Academic_and_Research_Institutions_RootCA_2015.pem ->
/usr/share/ca-certificates/mozilla/Hellenic_Academic_and_Research_Institutions_RootCA_2015.crt
lrwxrwxrwx 1 root root     62 May  1 13:06
Hongkong_Post_Root_CA_1.pem ->
/usr/share/ca-certificates/mozilla/Hongkong_Post_Root_CA_1.crt
lrwxrwxrwx 1 root root     51 May  1 13:06  ISRG_Root_X1.pem ->
/usr/share/ca-certificates/mozilla/ISRG_Root_X1.crt
lrwxrwxrwx 1 root root     69 May  1 13:06
IdenTrust_Commercial_Root_CA_1.pem ->
/usr/share/ca-certificates/mozilla/IdenTrust_Commercial_Root_CA_1.crt
lrwxrwxrwx 1 root root     72 May  1 13:06
IdenTrust_Public_Sector_Root_CA_1.pem ->
/usr/share/ca-certificates/mozilla/IdenTrust_Public_Sector_Root_CA_1.crt
lrwxrwxrwx 1 root root     49 May  1 13:06  Izenpe.com.pem ->
/usr/share/ca-certificates/mozilla/Izenpe.com.crt
lrwxrwxrwx 1 root root     61 May  1 13:06  LuxTrust_Global_Root_2.pem
-> /usr/share/ca-certificates/mozilla/LuxTrust_Global_Root_2.crt
lrwxrwxrwx 1 root root     69 May  1 13:06
Microsec_e-Szigno_Root_CA_2009.pem ->
/usr/share/ca-certificates/mozilla/Microsec_e-Szigno_Root_CA_2009.crt
lrwxrwxrwx 1 root root     83 May  1 13:06
'NetLock_Arany_=Class_Gold=_F'$'\305\221''tan'$'\303\272''s'$'\303\255''tv'$'\303\241''ny.pem'
-> '/usr/share/ca-certificates/mozilla/NetLock_Arany_=Class_Gold=_F'$'\305\221''tan'$'\303\272''s'$'\303\255''tv'$'\303\241''ny.crt'
lrwxrwxrwx 1 root root     78 May  1 13:06
Network_Solutions_Certificate_Authority.pem ->
/usr/share/ca-certificates/mozilla/Network_Solutions_Certificate_Authority.crt
lrwxrwxrwx 1 root root     70 May  1 13:06
OISTE_WISeKey_Global_Root_GA_CA.pem ->
/usr/share/ca-certificates/mozilla/OISTE_WISeKey_Global_Root_GA_CA.crt
lrwxrwxrwx 1 root root     70 May  1 13:06
OISTE_WISeKey_Global_Root_GB_CA.pem ->
/usr/share/ca-certificates/mozilla/OISTE_WISeKey_Global_Root_GB_CA.crt
lrwxrwxrwx 1 root root     70 May  1 13:06
OISTE_WISeKey_Global_Root_GC_CA.pem ->
/usr/share/ca-certificates/mozilla/OISTE_WISeKey_Global_Root_GC_CA.crt
lrwxrwxrwx 1 root root     55 May  1 13:06  QuoVadis_Root_CA.pem ->
/usr/share/ca-certificates/mozilla/QuoVadis_Root_CA.crt
lrwxrwxrwx 1 root root     60 May  1 13:06  QuoVadis_Root_CA_1_G3.pem
-> /usr/share/ca-certificates/mozilla/QuoVadis_Root_CA_1_G3.crt
lrwxrwxrwx 1 root root     57 May  1 13:06  QuoVadis_Root_CA_2.pem ->
/usr/share/ca-certificates/mozilla/QuoVadis_Root_CA_2.crt
lrwxrwxrwx 1 root root     60 May  1 13:06  QuoVadis_Root_CA_2_G3.pem
-> /usr/share/ca-certificates/mozilla/QuoVadis_Root_CA_2_G3.crt
lrwxrwxrwx 1 root root     57 May  1 13:06  QuoVadis_Root_CA_3.pem ->
/usr/share/ca-certificates/mozilla/QuoVadis_Root_CA_3.crt
lrwxrwxrwx 1 root root     60 May  1 13:06  QuoVadis_Root_CA_3_G3.pem
-> /usr/share/ca-certificates/mozilla/QuoVadis_Root_CA_3_G3.crt
lrwxrwxrwx 1 root root     82 May  1 13:06
SSL.com_EV_Root_Certification_Authority_ECC.pem ->
/usr/share/ca-certificates/mozilla/SSL.com_EV_Root_Certification_Authority_ECC.crt
lrwxrwxrwx 1 root root     85 May  1 13:06
SSL.com_EV_Root_Certification_Authority_RSA_R2.pem ->
/usr/share/ca-certificates/mozilla/SSL.com_EV_Root_Certification_Authority_RSA_R2.crt
lrwxrwxrwx 1 root root     79 May  1 13:06
SSL.com_Root_Certification_Authority_ECC.pem ->
/usr/share/ca-certificates/mozilla/SSL.com_Root_Certification_Authority_ECC.crt
lrwxrwxrwx 1 root root     79 May  1 13:06
SSL.com_Root_Certification_Authority_RSA.pem ->
/usr/share/ca-certificates/mozilla/SSL.com_Root_Certification_Authority_RSA.crt
lrwxrwxrwx 1 root root     54 May  1 13:06  SZAFIR_ROOT_CA2.pem ->
/usr/share/ca-certificates/mozilla/SZAFIR_ROOT_CA2.crt
lrwxrwxrwx 1 root root     58 May  1 13:06  SecureSign_RootCA11.pem ->
/usr/share/ca-certificates/mozilla/SecureSign_RootCA11.crt
lrwxrwxrwx 1 root root     53 May  1 13:06  SecureTrust_CA.pem ->
/usr/share/ca-certificates/mozilla/SecureTrust_CA.crt
lrwxrwxrwx 1 root root     55 May  1 13:06  Secure_Global_CA.pem ->
/usr/share/ca-certificates/mozilla/Secure_Global_CA.crt
lrwxrwxrwx 1 root root     69 May  1 13:06
Security_Communication_RootCA2.pem ->
/usr/share/ca-certificates/mozilla/Security_Communication_RootCA2.crt
lrwxrwxrwx 1 root root     69 May  1 13:06
Security_Communication_Root_CA.pem ->
/usr/share/ca-certificates/mozilla/Security_Communication_Root_CA.crt
lrwxrwxrwx 1 root root     61 May  1 13:06  Sonera_Class_2_Root_CA.pem
-> /usr/share/ca-certificates/mozilla/Sonera_Class_2_Root_CA.crt
lrwxrwxrwx 1 root root     71 May  1 13:06
Staat_der_Nederlanden_EV_Root_CA.pem ->
/usr/share/ca-certificates/mozilla/Staat_der_Nederlanden_EV_Root_CA.crt
lrwxrwxrwx 1 root root     73 May  1 13:06
Staat_der_Nederlanden_Root_CA_-_G2.pem ->
/usr/share/ca-certificates/mozilla/Staat_der_Nederlanden_Root_CA_-_G2.crt
lrwxrwxrwx 1 root root     73 May  1 13:06
Staat_der_Nederlanden_Root_CA_-_G3.pem ->
/usr/share/ca-certificates/mozilla/Staat_der_Nederlanden_Root_CA_-_G3.crt
lrwxrwxrwx 1 root root     59 May  1 13:06  Starfield_Class_2_CA.pem
-> /usr/share/ca-certificates/mozilla/Starfield_Class_2_CA.crt
lrwxrwxrwx 1 root root     80 May  1 13:06
Starfield_Root_Certificate_Authority_-_G2.pem ->
/usr/share/ca-certificates/mozilla/Starfield_Root_Certificate_Authority_-_G2.crt
lrwxrwxrwx 1 root root     89 May  1 13:06
Starfield_Services_Root_Certificate_Authority_-_G2.pem ->
/usr/share/ca-certificates/mozilla/Starfield_Services_Root_Certificate_Authority_-_G2.crt
lrwxrwxrwx 1 root root     61 May  1 13:06  SwissSign_Gold_CA_-_G2.pem
-> /usr/share/ca-certificates/mozilla/SwissSign_Gold_CA_-_G2.crt
lrwxrwxrwx 1 root root     63 May  1 13:06
SwissSign_Silver_CA_-_G2.pem ->
/usr/share/ca-certificates/mozilla/SwissSign_Silver_CA_-_G2.crt
lrwxrwxrwx 1 root root     67 May  1 13:06
T-TeleSec_GlobalRoot_Class_2.pem ->
/usr/share/ca-certificates/mozilla/T-TeleSec_GlobalRoot_Class_2.crt
lrwxrwxrwx 1 root root     67 May  1 13:06
T-TeleSec_GlobalRoot_Class_3.pem ->
/usr/share/ca-certificates/mozilla/T-TeleSec_GlobalRoot_Class_3.crt
lrwxrwxrwx 1 root root     84 May  1 13:06
TUBITAK_Kamu_SM_SSL_Kok_Sertifikasi_-_Surum_1.pem ->
/usr/share/ca-certificates/mozilla/TUBITAK_Kamu_SM_SSL_Kok_Sertifikasi_-_Surum_1.crt
lrwxrwxrwx 1 root root     58 May  1 13:06  TWCA_Global_Root_CA.pem ->
/usr/share/ca-certificates/mozilla/TWCA_Global_Root_CA.crt
lrwxrwxrwx 1 root root     72 May  1 13:06
TWCA_Root_Certification_Authority.pem ->
/usr/share/ca-certificates/mozilla/TWCA_Root_Certification_Authority.crt
lrwxrwxrwx 1 root root     50 May  1 13:06  Taiwan_GRCA.pem ->
/usr/share/ca-certificates/mozilla/Taiwan_GRCA.crt
lrwxrwxrwx 1 root root     61 May  1 13:06  TeliaSonera_Root_CA_v1.pem
-> /usr/share/ca-certificates/mozilla/TeliaSonera_Root_CA_v1.crt
lrwxrwxrwx 1 root root     53 May  1 13:06  TrustCor_ECA-1.pem ->
/usr/share/ca-certificates/mozilla/TrustCor_ECA-1.crt
lrwxrwxrwx 1 root root     61 May  1 13:06  TrustCor_RootCert_CA-1.pem
-> /usr/share/ca-certificates/mozilla/TrustCor_RootCert_CA-1.crt
lrwxrwxrwx 1 root root     61 May  1 13:06  TrustCor_RootCert_CA-2.pem
-> /usr/share/ca-certificates/mozilla/TrustCor_RootCert_CA-2.crt
lrwxrwxrwx 1 root root     58 May  1 13:06  Trustis_FPS_Root_CA.pem ->
/usr/share/ca-certificates/mozilla/Trustis_FPS_Root_CA.crt
lrwxrwxrwx 1 root root     76 May  1 13:06
USERTrust_ECC_Certification_Authority.pem ->
/usr/share/ca-certificates/mozilla/USERTrust_ECC_Certification_Authority.crt
lrwxrwxrwx 1 root root     76 May  1 13:06
USERTrust_RSA_Certification_Authority.pem ->
/usr/share/ca-certificates/mozilla/USERTrust_RSA_Certification_Authority.crt
lrwxrwxrwx 1 root root     99 May  1 13:06
VeriSign_Class_3_Public_Primary_Certification_Authority_-_G4.pem ->
/usr/share/ca-certificates/mozilla/VeriSign_Class_3_Public_Primary_Certification_Authority_-_G4.crt
lrwxrwxrwx 1 root root     99 May  1 13:06
VeriSign_Class_3_Public_Primary_Certification_Authority_-_G5.pem ->
/usr/share/ca-certificates/mozilla/VeriSign_Class_3_Public_Primary_Certification_Authority_-_G5.crt
lrwxrwxrwx 1 root root     86 May  1 13:06
VeriSign_Universal_Root_Certification_Authority.pem ->
/usr/share/ca-certificates/mozilla/VeriSign_Universal_Root_Certification_Authority.crt
lrwxrwxrwx 1 root root     99 May  1 13:06
Verisign_Class_3_Public_Primary_Certification_Authority_-_G3.pem ->
/usr/share/ca-certificates/mozilla/Verisign_Class_3_Public_Primary_Certification_Authority_-_G3.crt
lrwxrwxrwx 1 root root     59 May  1 13:06  XRamp_Global_CA_Root.pem
-> /usr/share/ca-certificates/mozilla/XRamp_Global_CA_Root.crt
-rw-r--r-- 1 root root 200061 May  1 13:06  ca-certificates.crt
lrwxrwxrwx 1 root root     55 May  1 13:06  certSIGN_ROOT_CA.pem ->
/usr/share/ca-certificates/mozilla/certSIGN_ROOT_CA.crt
lrwxrwxrwx 1 root root     72 May  1 13:06
ePKI_Root_Certification_Authority.pem ->
/usr/share/ca-certificates/mozilla/ePKI_Root_Certification_Authority.crt
lrwxrwxrwx 1 root root     61 May  1 13:06  thawte_Primary_Root_CA.pem
-> /usr/share/ca-certificates/mozilla/thawte_Primary_Root_CA.crt
lrwxrwxrwx 1 root root     66 May  1 13:06
thawte_Primary_Root_CA_-_G2.pem ->
/usr/share/ca-certificates/mozilla/thawte_Primary_Root_CA_-_G2.crt
lrwxrwxrwx 1 root root     66 May  1 13:06
thawte_Primary_Root_CA_-_G3.pem ->
/usr/share/ca-certificates/mozilla/thawte_Primary_Root_CA_-_G3.crt

[toc] | [prev] | [next] | [standalone]

Page 1 of 2 [1] 2 Next page →

csiph-web

Re: armhf: buster: TLS / HTTPS partly broken

Contents

#222218 — Re: armhf: buster: TLS / HTTPS partly broken

#222219

#222225

#222228

#222229

#222233

#222226

#222227

#222234

#222242

#222243

#222244

#222245

#222247

#222248

#222254

#222249

#222258

#222252

#222256