Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.debian.user > #222206 > unrolled thread
| Started by | Mark Jonas <toertel@gmail.com> |
|---|---|
| First post | 2020-05-03 19:40 +0200 |
| Last post | 2020-05-03 20:00 +0200 |
| Articles | 2 — 2 participants |
Back to article view | Back to linux.debian.user
Re: armhf: buster: TLS / HTTPS partly broken Mark Jonas <toertel@gmail.com> - 2020-05-03 19:40 +0200
Re: armhf: buster: TLS / HTTPS partly broken Reco <recoverym4n@enotuniq.net> - 2020-05-03 20:00 +0200
| From | Mark Jonas <toertel@gmail.com> |
|---|---|
| Date | 2020-05-03 19:40 +0200 |
| Subject | Re: armhf: buster: TLS / HTTPS partly broken |
| Message-ID | <A2qKR-Nj-1@gated-at.bofh.it> |
Hi Reco,
>> curl: (60) SSL certificate problem: unable to get local issuer certificate
>>
>> Does that mean a TLS library does not feature all required protocols on armhf?
>
> TLS library that curl uses (openssl) is perfectly fine, but it cannot
> validate any certificate unless you provide it with root CA
> certificates.
> So it likely means you haven't installed "ca-certificates" package.
This is what it looks like. But actually I installed ca-certificates.
This is an excerpt of the relevant part of the the Dockerfile [1]
where the packages are installed:
RUN apt-get update && \
apt-get -y --no-install-recommends install \
curl \
ca-certificates \
tzdata \
&& \
apt-get clean && \
rm -rf /var/lib/apt/lists/*
I also think that wget would not work or at least give a warning in
case there were no certificates at all.
Last but not least, the identical Dockerfile produces images for amd64
and arm64 where curl and aria2 work without hiccups. And it works
flawlessly on Stretch using the same Dockerfile.
Greetings,
Mark
[1]: https://gitlab.com/toertel/docker-image-tls-https-broken/-/blob/master/Dockerfile.j2
[toc] | [next] | [standalone]
| From | Reco <recoverym4n@enotuniq.net> |
|---|---|
| Date | 2020-05-03 20:00 +0200 |
| Message-ID | <A2r4e-U3-9@gated-at.bofh.it> |
| In reply to | #222206 |
On Sun, May 03, 2020 at 07:20:13PM +0200, Mark Jonas wrote: > Hi Reco, > > >> curl: (60) SSL certificate problem: unable to get local issuer certificate > >> > >> Does that mean a TLS library does not feature all required protocols on armhf? > > > > TLS library that curl uses (openssl) is perfectly fine, but it cannot > > validate any certificate unless you provide it with root CA > > certificates. > > So it likely means you haven't installed "ca-certificates" package. > > This is what it looks like. But actually I installed ca-certificates. Ok. Can you run tcpdump while you're running curl? Specifically, tcpdump -s0 -pnni any -w /tmp/curl.pcap tcp port 443 Reco
[toc] | [prev] | [standalone]
Back to top | Article view | linux.debian.user
csiph-web