Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #159493 > unrolled thread

How to make apt-transport-https accept security.debian.org bad certificate?

Back to article view | Back to linux.debian.user

Contents

  How to make apt-transport-https accept security.debian.org bad certificate? Mario Castelán Castro  <marioxcc.MT@yandex.com> - 2015-10-20 01:20 +0200
    Re: How to make apt-transport-https accept security.debian.org bad  certificate? Mario Castelán Castro  <marioxcc.MT@yandex.com> - 2015-10-20 02:10 +0200
      Re: How to make apt-transport-https accept security.debian.org bad  certificate? Michael Jones <mj@mikejonesey.co.uk> - 2015-10-20 10:10 +0200
        Re: How to make apt-transport-https accept security.debian.org bad  certificate? Michael Jones <mj@mikejonesey.co.uk> - 2015-10-20 10:10 +0200
          Re: How to make apt-transport-https accept security.debian.org bad  certificate? Michael Jones <mj@mikejonesey.co.uk> - 2015-10-20 22:40 +0200
            Re: How to make apt-transport-https accept security.debian.org bad  certificate? Mario Castelán Castro  <marioxcc.MT@yandex.com> - 2015-10-20 23:40 +0200
              Re: How to make apt-transport-https accept security.debian.org bad  certificate? Mario Castelán Castro  <marioxcc.MT@yandex.com> - 2015-10-21 01:10 +0200

#159493 — How to make apt-transport-https accept security.debian.org bad certificate?

Hello.

I intend to use a secure connection (that means at the *transport* 
level) for downloading packages and lists from the Debian repository. I 
installed apt-transport-https. There seems to be no list of mirrors that 
accept HTTPS; nonetheless, I found that some listed mirrors accept HTTPS 
(for example mirrors.kernel.org). I configured one of them in my 
"sources.list".

When I run "apt-get update", I get the following error:

-----BEGIN PASTED TEXT----
Err https://security.debian.org wheezy/updates/main Sources
   SSL: certificate subject name (debian.org) does not match target host 
name 'security.debian.org'
Err https://security.debian.org wheezy/updates/main amd64 Packages
   SSL: certificate subject name (debian.org) does not match target host 
name 'security.debian.org'
Fetched 7637 kB in 33s (231 kB/s)
W: Failed to fetch 
https://security.debian.org/dists/wheezy/updates/main/source/Sources 
SSL: certificate subject name (debian.org) does not match target host 
name 'security.debian.org'

W: Failed to fetch 
https://security.debian.org/dists/wheezy/updates/main/binary-amd64/Packages 
  SSL: certificate subject name (debian.org) does not match target host 
name 'security.debian.org'

E: Some index files failed to download. They have been ignored, or old 
ones used instead.
-----END PASTED TEXT----

There is a problem: security.debian.org has a bad certificate and there 
are no official mirrors. The certificate is only valid for 
"www.debian.org" and "debian.org", not "security.debian.org". You can 
check this with your browser by going to https://security.debian.org/.

My question is: How can I make "apt-get" accept the certificate anyway, 
but only _this_ certificate or other certificates that are otherwise 
valid but have the same subdomain mismatch error (it should reject a 
bogus certificate from an attacker)?. In addition, where is the correct 
place to report this error?.

The relevant lines in "/etc/apt/sources.list" are:

-----BEGIN PASTED TEXT----
deb https://security.debian.org/ wheezy/updates main
deb-src https://security.debian.org/ wheezy/updates main
-----END PASTED TEXT----

I know that the packages are signed. I am not looking for suggestions to 
not to use HTTPS. I can use unencrypted connections, of course, but  I 
am looking to have an added layer of security.

Regards and thanks in advance.

[toc] | [next] | [standalone]

#159495 — Re: How to make apt-transport-https accept security.debian.org bad certificate?

El 19/10/15 a las 18:37, Michael Jones escribió:
 > perhaps there is also a flag for apt to ignore ssl errors, but
 > wouldn't that defeat the purpose of ssl?

Indeed. That is why I asked for an option to accept the bad certificate 
only (instead of ignoring all TLS errors).

El 19/10/15 a las 18:37, Michael Jones escribió:
 > for untrusted certs (i don't think this is the issue here), you can
 > always import these into either the OS, or the application (eg java
 > uses jsecerts under lib security).

Right. That don't seems to be the problem. The error message complains 
that the certificate is invalid for that domain. You can check this with 
your browser.

El 19/10/15 a las 18:37, Michael Jones escribió:
 > try /etc/hosts if you don't mind mapping the domain (you may not want
 > to do this as you won't be able to visit the domain you are re-mapping).

Are you sure that "/etc/hosts" can be used for that?. As far as I know 
"/etc/hosts" is used to locally assign the IP addresses to domain names, 
for domain name resolution, instead of, or overriding the usual DNS 
resolution procedure.

I do not understand how I could use /etc/hosts to work around this 
problem. Suppose I make "security.debian.org" resolve to one of the IP 
addresses of "debian.org". Apt will still "think" that is is connecting 
to "security.debian.org", so there will still be a certificate mismatch, 
plus as an added problem. it is contacting the wrong server now.

Regards.

El 19/10/15 a las 18:37, Michael Jones escribió:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA256
>
> On 20/10/15 00:15, Mario Castelán Castro wrote:
>> My question is: How can I make "apt-get" accept the certificate
>> anyway, but only _this_ certificate or other certificates that are
>> otherwise valid but have the same subdomain mismatch error (it
>> should reject a bogus certificate from an attacker)?. In addition,
>> where is the correct place to report this error?.
>
> as far as i'm aware most applications that connect using ssl won't
> accept an invalid cert on the basis of incorrect domain (even if it's
> a trusted cert). (like i think the issue is here).
>
> what you could try is an /etc/hosts entry to use the same domain as
> the cert (if the server will accept that domain).
>
> for untrusted certs (i don't think this is the issue here), you can
> always import these into either the OS, or the application (eg java
> uses jsecerts under lib security).
>
> perhaps there is also a flag for apt to ignore ssl errors, but
> wouldn't that defeat the purpose of ssl?
>
> try /etc/hosts if you don't mind mapping the domain (you may not want
> to do this as you won't be able to visit the domain you are re-mapping).
>
> Kind Regards,
> Mike
>
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v2
>
> iQEcBAEBCAAGBQJWJX6xAAoJEOYwtpHNe8FmjV0H/iO25LwLCOZUIYbQU8tWf96E
> +fxBft9w6wrlOQOqHDseZ5wZeE2PrXIS80FbnTZQKfEftEx05d87+M+blfVo6DTi
> NH19lzNKtG3YTSE2WoSBMo5NzIOgTP/EGry4EM2Ab92ORkTu/P6GQ+qJePA2BUcm
> br6Q6IN8bCvIu10I296Uxby+7+FmO0ovL7IEzJiUNRpId7crAcoHkaICfGEk5GlP
> doqdBmx1J8kMFW7zwRIbeH9c8luZA7b+KJAkwF7ev3DO39BvxNa6xb0rqT62FbXh
> TzGA6vJQ2C1AyNu0cK2YuzUCevAOceeYOcV9B5gg7L+0zzN5btOLhgWaxLez6Uo=
> =z67Q
> -----END PGP SIGNATURE-----
>

[toc] | [prev] | [next] | [standalone]

#159509 — Re: How to make apt-transport-https accept security.debian.org bad certificate?

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

On 20/10/15 00:55, Mario Castelán Castro wrote:
> Are you sure that "/etc/hosts" can be used for that?. As far as I
> know "/etc/hosts" is used to locally assign the IP addresses to
> domain names, for domain name resolution, instead of, or overriding
> the usual DNS resolution procedure.
> 
> I do not understand how I could use /etc/hosts to work around this 
> problem. Suppose I make "security.debian.org" resolve to one of the
> IP addresses of "debian.org". Apt will still "think" that is is
> connecting to "security.debian.org", so there will still be a
> certificate mismatch, plus as an added problem. it is contacting
> the wrong server now.

under a normal situation yes this would work, as you could also update
your apt sources.list to use the "correct" domain name. (by correct
domain, i mean the one in the ssl cert).

however i've had a quick look;

http://security.debian.org/debian-security/dists/jessie/updates/non-free
/binary-i386/Packages.bz2

this is a request from an update, using the same in a web browser but
https does not issue an invalid cert, in actual fact we get a
connection reset.

"The connection to security.debian.org was interrupted while the page
was loading."

testing with openssl;

mike@mike-laptop3:~/git/ssl/src$ openssl s_client -showcerts -connect
security.debian.org:443 </dev/null
CONNECTED(00000003)
140013054264976:error:140790E5:SSL routines:SSL23_WRITE:ssl handshake
failure:s23_lib.c:184:
- ---
no peer certificate available
- ---
No client certificate CA names sent
- ---
SSL handshake has read 0 bytes and written 295 bytes
- ---
New, (NONE), Cipher is (NONE)
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
- ---

even with overriding DNS

212.211.132.250	debian.org


this will not work, as the server proving security.debian.org does not
have a valid ssl setup.

So in this case there is not much you can do.


Kind Regards,
Mike
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQEcBAEBCAAGBQJWJfTQAAoJEOYwtpHNe8FmOJQIALx2lilhkD18Goh1lDstsnJg
Adkffed9QbiEGsT8Xt9nbQZX4lKMHIGn8RY3nIvwiJhFzYamFg2HSBc0Bfn4VP/X
fGbgjLyyZ+OLR838KZQ83sSfW9g99fjyf+HnZytjiVDWd0vYWcRFh0GRfwHG8LSM
/SGxeBPdWzQmmqgOo7zuEwBfH/XAYIaE7l5qnhJxe1lRVEfRMgxIwAEYx1lCHOds
JF2UNHurcTQ5wzos+BjO5e29ZnUdf5pyxT2d6LF3TP+M9g5IHGycCjsdhcgZ0+Uf
zMw1Upn1gDfYIFy4qr9k/1hR3rGwwfQ1z9qmk2EnnOE0xoXhe5GRgY5Q4aEGg3w=
=CDOa
-----END PGP SIGNATURE-----

[toc] | [prev] | [next] | [standalone]

#159510 — Re: How to make apt-transport-https accept security.debian.org bad certificate?

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

On 20/10/15 09:01, Michael Jones wrote:
> no peer certificate available

correction, needed sni, will re-test

mike@mike-laptop3:~$ openssl s_client -showcerts -connect
debian.org:443 -servername security.debian.org  </dev/null
CONNECTED(00000003)
depth=2 C = US, ST = New Jersey, L = Jersey City, O = The USERTRUST
Network, CN = USERTrust RSA Certification Authority
verify error:num=20:unable to get local issuer certificate
verify return:0
- ---
Certificate chain
 0 s:/OU=Domain Control Validated/OU=Gandi Standard SSL/CN=debian.org
   i:/C=FR/ST=Paris/L=Paris/O=Gandi/CN=Gandi Standard SSL CA 2
- -----BEGIN CERTIFICATE-----
MIIFbTCCBFWgAwIBAgIQHmVBWGXak08KTLn814tlTjANBgkqhkiG9w0BAQsFADBf
MQswCQYDVQQGEwJGUjEOMAwGA1UECBMFUGFyaXMxDjAMBgNVBAcTBVBhcmlzMQ4w
DAYDVQQKEwVHYW5kaTEgMB4GA1UEAxMXR2FuZGkgU3RhbmRhcmQgU1NMIENBIDIw
HhcNMTQxMjE3MDAwMDAwWhcNMTUxMjMxMjM1OTU5WjBVMSEwHwYDVQQLExhEb21h
aW4gQ29udHJvbCBWYWxpZGF0ZWQxGzAZBgNVBAsTEkdhbmRpIFN0YW5kYXJkIFNT
TDETMBEGA1UEAxMKZGViaWFuLm9yZzCCAaIwDQYJKoZIhvcNAQEBBQADggGPADCC
AYoCggGBAOZk5beZFKGdBy/pGg7aKG4TjYPCh+KQG70fEkzKHLY9CA3FgW+N4gF2
dH0tBG5Bv/XFjkDPyO1GsMj/VotTslDPWwcPWk60ic/Vnt7bocm3SP8bgmnvl2ST
q5ygVwNLx+EAyttbh95Df+u4Ro9ShyMQF2/wLrxcPuZ9giTHHcDUNba7O3Rs3vWN
B6hnNTfzo4ZWPL8EzvkJKARKnagIsXeBelGRkCR+LytrEbXPxsejV5UBACVNNVrI
CYpnxT0P270GZXh6Rf/LsKwV0NS3oF5FCdpxOU5so+cb91UbYieRMTACP9GctVOG
wN0dBShyx8y+0gkXdiuFNRjzCdtnnlUHITVq8pYw0oqPauR4asT+Tp0DxhZJpeQs
IhVUwE4jgv42loh+AVDLvU/iUBvF/JMyYiVAeD+rZpfo11GWhyP6tiD8Cupri3XH
WgxnSzLhp3Sv/x2mf36uIwJmbIzwf1UDMEPohc2f0ACepUocfx9SBi4FvAzTUWoL
+1qmpF3HMQIDAQABo4IBrTCCAakwHwYDVR0jBBgwFoAUs5Cn2MmvTs1hPJ98rV1/
Qf1pMOowHQYDVR0OBBYEFP7hAP+qT6A2VIRyXUIM9Odvvp/VMA4GA1UdDwEB/wQE
AwIFoDAMBgNVHRMBAf8EAjAAMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcD
AjBLBgNVHSAERDBCMDYGCysGAQQBsjEBAgIaMCcwJQYIKwYBBQUHAgEWGWh0dHBz
Oi8vY3BzLnVzZXJ0cnVzdC5jb20wCAYGZ4EMAQIBMEEGA1UdHwQ6MDgwNqA0oDKG
MGh0dHA6Ly9jcmwudXNlcnRydXN0LmNvbS9HYW5kaVN0YW5kYXJkU1NMQ0EyLmNy
bDBzBggrBgEFBQcBAQRnMGUwPAYIKwYBBQUHMAKGMGh0dHA6Ly9jcnQudXNlcnRy
dXN0LmNvbS9HYW5kaVN0YW5kYXJkU1NMQ0EyLmNydDAlBggrBgEFBQcwAYYZaHR0
cDovL29jc3AudXNlcnRydXN0LmNvbTAlBgNVHREEHjAcggpkZWJpYW4ub3Jngg53
d3cuZGViaWFuLm9yZzANBgkqhkiG9w0BAQsFAAOCAQEAj0rkHMJhG0W0AdE6KMLm
UGKgHSY2BUlItsOBGfCVjkQVJCN0BrJdOFJkLs31Ej37NHUuOhCmGtFR238s+64m
CxHedhQ/B5UFvWLpPxLi9QI/W36Avlev9eZRrH8amMMsh7Xz8thLkKMbzCqxHseS
AHAY6xOhNgM5jZJNwzsKHEbFu3vMlg8HcqA6QAB+E3zDVoX+AYk5eM6AyS01LHcH
NmSfassOCzJNfYeSxhWQm+CBz2rcrqZcGMf8YPJuwVZRtC6uJzUeOJkG6Ugb/pTc
o95o4CwlJihQESpoVoLWQP2Kx/zAy4yAghRCoZsKouzULC7Tkzk1mWajg7C2GDpw
vw==
- -----END CERTIFICATE-----
 1 s:/C=FR/ST=Paris/L=Paris/O=Gandi/CN=Gandi Standard SSL CA 2
   i:/C=US/ST=New Jersey/L=Jersey City/O=The USERTRUST
Network/CN=USERTrust RSA Certification Authority
- -----BEGIN CERTIFICATE-----
MIIF6TCCA9GgAwIBAgIQBeTcO5Q4qzuFl8umoZhQ4zANBgkqhkiG9w0BAQwFADCB
iDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCk5ldyBKZXJzZXkxFDASBgNVBAcTC0pl
cnNleSBDaXR5MR4wHAYDVQQKExVUaGUgVVNFUlRSVVNUIE5ldHdvcmsxLjAsBgNV
BAMTJVVTRVJUcnVzdCBSU0EgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwHhcNMTQw
OTEyMDAwMDAwWhcNMjQwOTExMjM1OTU5WjBfMQswCQYDVQQGEwJGUjEOMAwGA1UE
CBMFUGFyaXMxDjAMBgNVBAcTBVBhcmlzMQ4wDAYDVQQKEwVHYW5kaTEgMB4GA1UE
AxMXR2FuZGkgU3RhbmRhcmQgU1NMIENBIDIwggEiMA0GCSqGSIb3DQEBAQUAA4IB
DwAwggEKAoIBAQCUBC2meZV0/9UAPPWu2JSxKXzAjwsLibmCg5duNyj1ohrP0pIL
m6jTh5RzhBCf3DXLwi2SrCG5yzv8QMHBgyHwv/j2nPqcghDA0I5O5Q1MsJFckLSk
QFEW2uSEEi0FXKEfFxkkUap66uEHG4aNAXLy59SDIzme4OFMH2sio7QQZrDtgpbX
bmq08j+1QvzdirWrui0dOnWbMdw+naxb00ENbLAb9Tr1eeohovj0M1JLJC0epJmx
bUi8uBL+cnB89/sCdfSN3tbawKAyGlLfOGsuRTg/PwSWAP2h9KK71RfWJ3wbWFmV
XooS/ZyrgT5SKEhRhWvzkbKGPym1bgNi7tYFAgMBAAGjggF1MIIBcTAfBgNVHSME
GDAWgBRTeb9aqitKz1SA4dibwJ3ysgNmyzAdBgNVHQ4EFgQUs5Cn2MmvTs1hPJ98
rV1/Qf1pMOowDgYDVR0PAQH/BAQDAgGGMBIGA1UdEwEB/wQIMAYBAf8CAQAwHQYD
VR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMCIGA1UdIAQbMBkwDQYLKwYBBAGy
MQECAhowCAYGZ4EMAQIBMFAGA1UdHwRJMEcwRaBDoEGGP2h0dHA6Ly9jcmwudXNl
cnRydXN0LmNvbS9VU0VSVHJ1c3RSU0FDZXJ0aWZpY2F0aW9uQXV0aG9yaXR5LmNy
bDB2BggrBgEFBQcBAQRqMGgwPwYIKwYBBQUHMAKGM2h0dHA6Ly9jcnQudXNlcnRy
dXN0LmNvbS9VU0VSVHJ1c3RSU0FBZGRUcnVzdENBLmNydDAlBggrBgEFBQcwAYYZ
aHR0cDovL29jc3AudXNlcnRydXN0LmNvbTANBgkqhkiG9w0BAQwFAAOCAgEAWGf9
crJq13xhlhl+2UNG0SZ9yFP6ZrBrLafTqlb3OojQO3LJUP33WbKqaPWMcwO7lWUX
zi8c3ZgTopHJ7qFAbjyY1lzzsiI8Le4bpOHeICQW8owRc5E69vrOJAKHypPstLbI
FhfFcvwnQPYT/pOmnVHvPCvYd1ebjGU6NSU2t7WKY28HJ5OxYI2A25bUeo8tqxyI
yW5+1mUfr13KFj8oRtygNeX56eXVlogMT8a3d2dIhCe2H7Bo26y/d7CQuKLJHDJd
ArolQ4FCR7vY4Y8MDEZf7kYzawMUgtN+zY+vkNaOJH1AQrRqahfGlZfh8jjNp+20
J0CT33KpuMZmYzc4ZCIwojvxuch7yPspOqsactIGEk72gtQjbz7Dk+XYtsDe3CMW
1hMwt6CaDixVBgBwAc/qOR2A24j3pSC4W/0xJmmPLQphgzpHphNULB7j7UTKvGof
KA5R2d4On3XNDgOVyvnFqSot/kGkoUeuDcL5OWYzSlvhhChZbH2UF3bkRYKtcCD9
0m9jqNf6oDP6N8v3smWe2lBvP+Sn845dWDKXcCMu5/3EFZucJ48y7RetWIExKREa
m9T8bJUox04FB6b9HbwZ4ui3uRGKLXASUoWNjDNKD/yZkuBjcNqllEdjB+dYxzFf
BT02Vf6Dsuimrdfp5gJ0iHRc2jTbkNJtUQoj1iM=
- -----END CERTIFICATE-----
 2 s:/C=US/ST=New Jersey/L=Jersey City/O=The USERTRUST
Network/CN=USERTrust RSA Certification Authority
   i:/C=SE/O=AddTrust AB/OU=AddTrust External TTP Network/CN=AddTrust
External CA Root
- -----BEGIN CERTIFICATE-----
MIIFdzCCBF+gAwIBAgIQE+oocFv07O0MNmMJgGFDNjANBgkqhkiG9w0BAQwFADBv
MQswCQYDVQQGEwJTRTEUMBIGA1UEChMLQWRkVHJ1c3QgQUIxJjAkBgNVBAsTHUFk
ZFRydXN0IEV4dGVybmFsIFRUUCBOZXR3b3JrMSIwIAYDVQQDExlBZGRUcnVzdCBF
eHRlcm5hbCBDQSBSb290MB4XDTAwMDUzMDEwNDgzOFoXDTIwMDUzMDEwNDgzOFow
gYgxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpOZXcgSmVyc2V5MRQwEgYDVQQHEwtK
ZXJzZXkgQ2l0eTEeMBwGA1UEChMVVGhlIFVTRVJUUlVTVCBOZXR3b3JrMS4wLAYD
VQQDEyVVU0VSVHJ1c3QgUlNBIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MIICIjAN
BgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAgBJlFzYOw9sIs9CsVw127c0n00yt
UINh4qogTQktZAnczomfzD2p7PbPwdzx07HWezcoEStH2jnGvDoZtF+mvX2do2NC
tnbyqTsrkfjib9DsFiCQCT7i6HTJGLSR1GJk23+jBvGIGGqQIjy8/hPwhxR79uQf
jtTkUcYRZ0YIUcuGFFQ/vDP+fmyc/xadGL1RjjWmp2bIcmfbIWax1Jt4A8BQOujM
8Ny8nkz+rwWWNR9XWrf/zvk9tyy29lTdyOcSOk2uTIq3XJq0tyA9yn8iNK5+O2hm
AUTnAU5GU5szYPeUvlM3kHND8zLDU+/bqv50TmnHa4xgk97Exwzf4TKuzJM7UXiV
Z4vuPVb+DNBpDxsP8yUmazNt925H+nND5X4OpWaxKXwyhGNVicQNwZNUMBkTrNN9
N6frXTpsNVzbQdcS2qlJC9/YgIoJk2KOtWbPJYjNhLixP6Q5D9kCnusSTJV882sF
qV4Wg8y4Z+LoE53MW4LTTLPtW//e5XOsIzstAL81VXQJSdhJWBp/kjbmUZIO8yZ9
HE0XvMnsQybQv0FfQKlERPSZ51eHnlAfV1SoPv10Yy+xUGUJ5lhCLkMaTLTwJUdZ
+gQek9QmRkpQgbLevni3/GcV4clXhB4PY9bpYrrWX1Uu6lzGKAgEJTm4Diup8kyX
HAc/DVL17e8vgg8CAwEAAaOB9DCB8TAfBgNVHSMEGDAWgBStvZh6NLQm9/rEJlTv
A73gJMtUGjAdBgNVHQ4EFgQUU3m/WqorSs9UgOHYm8Cd8rIDZsswDgYDVR0PAQH/
BAQDAgGGMA8GA1UdEwEB/wQFMAMBAf8wEQYDVR0gBAowCDAGBgRVHSAAMEQGA1Ud
HwQ9MDswOaA3oDWGM2h0dHA6Ly9jcmwudXNlcnRydXN0LmNvbS9BZGRUcnVzdEV4
dGVybmFsQ0FSb290LmNybDA1BggrBgEFBQcBAQQpMCcwJQYIKwYBBQUHMAGGGWh0
dHA6Ly9vY3NwLnVzZXJ0cnVzdC5jb20wDQYJKoZIhvcNAQEMBQADggEBAJNl9jeD
lQ9ew4IcH9Z35zyKwKoJ8OkLJvHgwmp1ocd5yblSYMgpEg7wrQPWCcR23+WmgZWn
RtqCV6mVksW2jwMibDN3wXsyF24HzloUQToFJBv2FAY7qCUkDrvMKnXduXBBP3zQ
YzYhBx9G/2CkkeFnvN4ffhkUyWNnkepnB2u0j4vAbkN9w6GAbLIevFOFfdyQoaS8
Le9Gclc1Bb+7RrtubTeZtv8jkpHGbkD4jylW6l/VXxRTrPBPYer3IsynVgviuDQf
Jtl7GQVoP7o81DgGotPmjw7jtHFtQELFhLRAlSv0ZaBIefYdgWOWnU914Ph85I6p
0fKtirOMxyHNwu8=
- -----END CERTIFICATE-----
- ---
Server certificate
subject=/OU=Domain Control Validated/OU=Gandi Standard SSL/CN=debian.org
issuer=/C=FR/ST=Paris/L=Paris/O=Gandi/CN=Gandi Standard SSL CA 2
- ---
No client certificate CA names sent
- ---
SSL handshake has read 5154 bytes and written 449 bytes
- ---
New, TLSv1/SSLv3, Cipher is ECDHE-RSA-AES256-GCM-SHA384
Server public key is 3072 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
SSL-Session:
    Protocol  : TLSv1.2
    Cipher    : ECDHE-RSA-AES256-GCM-SHA384
    Session-ID:
0FDEEF23BB374AD9FFD745089144BC133C756C58422B3DD7DE9940D00CF86145
    Session-ID-ctx:
    Master-Key:
860821762543A792192056F4321B2E7DB29E1015BB56375CA198395CFEFFC89FC54F365E
2D2E29149C947649D66F9C99
    Key-Arg   : None
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    TLS session ticket lifetime hint: 300 (seconds)
    TLS session ticket:
    0000 - 18 72 e6 3f c2 c8 2a ab-f9 ad a7 a6 b1 67 4d de
.r.?..*......gM.
    0010 - f7 c4 6d 2a f9 75 43 13-45 72 0e b0 3d 2f 1b ae
..m*.uC.Er..=/..
    0020 - 3e d8 a1 e2 3b cd f4 1d-99 84 66 96 78 e1 16 99
> ...;.....f.x...
    0030 - ad e8 e2 c2 c4 63 88 e2-6f cb f7 8c dd 82 37 22
.....c..o.....7"
    0040 - 1f 25 3f 00 a6 4b 01 95-b1 7f 5d c1 69 7d 93 77
.%?..K....].i}.w
    0050 - 93 81 1e d2 ba 19 6b b4-44 f8 9b 78 22 97 03 94
......k.D..x"...
    0060 - 9d ee bd 6e ed 12 af 67-ce 0a 4f 99 88 b2 cc 89
...n...g..O.....
    0070 - af 39 34 44 a7 3d 5e 08-40 8a b2 be 68 64 f3 c2
.94D.=^.@...hd..
    0080 - ce d9 67 9b b4 d0 b0 b9-89 1b 51 17 e7 5f e2 6a
..g.......Q.._.j
    0090 - 29 74 87 47 36 d3 6f 2a-75 31 fd af c2 39 39 25
)t.G6.o*u1...99%
    00a0 - 9d 71 bd aa 50 23 72 3b-49 cb 0e 41 49 93 94 c4
.q..P#r;I..AI...
    00b0 - 51 50 73 f2 dc ba 8d 2b-2d 0f a5 78 d6 d7 94 66
QPs....+-..x...f
    00c0 - e9 85 3e b0 74 d1 11 c9-0e 32 18 3c c7 9e 15 f9
..>.t....2.<....

    Start Time: 1445328262
    Timeout   : 300 (sec)
    Verify return code: 20 (unable to get local issuer certificate)
- ---
DONE

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQEcBAEBCAAGBQJWJfXsAAoJEOYwtpHNe8FmRHQH/0tJfd69pevGVp4OaR3k0eXS
bJl+e+8oGhQsUJ4H3Tl1cIWDe7xIYRzaussR9eVUZ33VO2qLcbCtUqk3ZKwJj+Y7
Cq+jMBApd5HxoAkkCwhpam0LIbWbm9Hl8n8vj7uP3iC2+hQg38rkJ0vx64ompdfo
qrd6rB0eFexS7qp7PZvC+ub+Gbu5sN3Yn1TlT467aNBZ806w7ssxsk+cRHiseai4
jNbJAtqHSzrJb3F8M+qo+2uwX1qwyQlKRq8Njb9B3qbFjIJZ+v7mBQm1g2WA16n1
e1c8y8GdmKLrQBEDdSWplRb5mn8uJpdFZ6GBkf7MS16DP8LfYAWdhZxvJsZTuNM=
=yCsr
-----END PGP SIGNATURE-----

[toc] | [prev] | [next] | [standalone]

#159550 — Re: How to make apt-transport-https accept security.debian.org bad certificate?

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

On 20/10/15 09:06, Michael Jones wrote:
> On 20/10/15 09:01, Michael Jones wrote:
>>> no peer certificate available
> correction, needed sni, will re-test
> 
> mike@mike-laptop3:~$ openssl s_client -showcerts -connect 
> debian.org:443 -servername security.debian.org  </dev/null 
> CONNECTED(00000003) depth=2 C = US, ST = New Jersey, L = Jersey
> City, O = The USERTRUST Network, CN = USERTrust RSA Certification
> Authority verify error:num=20:unable to get local issuer
> certificate verify return:0

back home now, had another look, ssl is not available on the server
security.debian.org, so you won't be able to change the protocol to
https. If for whatever reason you wanted ssl, you could either have an
ssl proxy or a mirror that provided ssl.

mike@mike-laptop3:~$ wget
"https://security.debian.org/debian-security/dists/jessie/updates/non-fr
ee/binary-i386/Packages.bz2"
- --2015-10-20 21:35:34--
https://security.debian.org/debian-security/dists/jessie/updates/non-fre
e/binary-i386/Packages.bz2
Resolving security.debian.org (security.debian.org)... 195.20.242.89,
212.211.132.32, 212.211.132.250, ...
Connecting to security.debian.org
(security.debian.org)|195.20.242.89|:443... failed: Connection refused.
Connecting to security.debian.org
(security.debian.org)|212.211.132.32|:443... failed: Connection refused.
Connecting to security.debian.org
(security.debian.org)|212.211.132.250|:443... failed: Connection refused
.
Connecting to security.debian.org
(security.debian.org)|2001:a78:5:1:216:35ff:fe7f:6ceb|:443... failed:
Network is unreachable.
Connecting to security.debian.org
(security.debian.org)|2001:a78:5:0:216:35ff:fe7f:be4f|:443... failed:
Network is unreachable.

mike@mike-laptop3:~$ openssl s_client -showcerts -connect
security.debian.org:443 -servername apache.org  </dev/null
connect: Connection refused
connect:errno=111

mike@mike-laptop3:~$ nmap security.debian.org -Pn -p 443 2>&1 | grep 443
443/tcp closed https

Kind Regards,
Mike
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQEcBAEBCAAGBQJWJqX5AAoJEOYwtpHNe8FmaLkH/3PjtG7fEUmm5iHemoplpgA6
2V0LRxeyT/mJhyB0DKV9snhqOjDNMwDhgUMF/uj6S5TpVasHg+H6fR5vjzSHR4Q/
tcs3zEhPnZTQOrED1KB37P716zDtYScsxqZDwqnSHEi/JAeX3k54OZmPuPACMnvh
L5fLs0KtpMa038zeoncsOMBhnV8yvJDX2Tms08einKnGRahEXwhBZ/myb996sDqu
td1OgrlTZjNYcexee0bEGZAa8BqKAugDhO/FQJrgJpff/5KtbzosHMKyXk86DPxK
fRaDplZLix8SnyFWc7qY+o+Jly61h0WyZ/PeY17qVa9A7yYvVEkLOoXkiyx3UyE=
=gIdP
-----END PGP SIGNATURE-----

[toc] | [prev] | [next] | [standalone]

#159551 — Re: How to make apt-transport-https accept security.debian.org bad certificate?

Thanks you.

I reported the problem as a bug against pseudopackage "debian-security" 
<http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=802539>.

I get a different set of IP addresses for security.debian.org; there may 
be some geographically dependent load balancing:

-----BEGIN PASTED TEXT-----
$ host security.debian.org
security.debian.org has address 128.31.0.63
security.debian.org has address 128.61.240.73
security.debian.org has address 149.20.20.6
security.debian.org has IPv6 address 2610:148:1f10:3::73
security.debian.org has IPv6 address 2001:4f8:8:36::6
security.debian.org mail is handled by 10 muffat.debian.org.
security.debian.org mail is handled by 10 mailly.debian.org.
-----END PASTED TEXT-----

I also tested with wget; of these addresses, only 128.31.0.63 supports 
HTTPS and has a bad certificate. The output is in Spanish; and it says that:

-----BEGIN PASTED TEXT-----
$ LANG= wget 
https://security.debian.org/dists/wheezy/updates/main/source/Sources
--2015-10-20 16:10:55-- 
https://security.debian.org/dists/wheezy/updates/main/source/Sources
Resolving security.debian.org (security.debian.org)... 128.61.240.73, 
149.20.20.6, 128.31.0.63, ...
Connecting to security.debian.org 
(security.debian.org)|128.61.240.73|:443... failed: Connection refused.
Connecting to security.debian.org 
(security.debian.org)|149.20.20.6|:443... failed: Connection refused.
Connecting to security.debian.org 
(security.debian.org)|128.31.0.63|:443... connected.
The certificate's owner does not match hostname `security.debian.org'
-----END PASTED TEXT-----

AFAIK security.debian.org has no official mirrors because the Debian 
project don't trusts mirrors to offer timely updates. I do not know of 
an unofficial mirror.

Regards and thanks.

El 20/10/15 a las 15:37, Michael Jones escribió:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA256
>
> On 20/10/15 09:06, Michael Jones wrote:
>> On 20/10/15 09:01, Michael Jones wrote:
>>>> no peer certificate available
>> correction, needed sni, will re-test
>>
>> mike@mike-laptop3:~$ openssl s_client -showcerts -connect
>> debian.org:443 -servername security.debian.org  </dev/null
>> CONNECTED(00000003) depth=2 C = US, ST = New Jersey, L = Jersey
>> City, O = The USERTRUST Network, CN = USERTrust RSA Certification
>> Authority verify error:num=20:unable to get local issuer
>> certificate verify return:0
>
> back home now, had another look, ssl is not available on the server
> security.debian.org, so you won't be able to change the protocol to
> https. If for whatever reason you wanted ssl, you could either have an
> ssl proxy or a mirror that provided ssl.
>
> mike@mike-laptop3:~$ wget
> "https://security.debian.org/debian-security/dists/jessie/updates/non-fr
> ee/binary-i386/Packages.bz2"
> - --2015-10-20 21:35:34--
> https://security.debian.org/debian-security/dists/jessie/updates/non-fre
> e/binary-i386/Packages.bz2
> Resolving security.debian.org (security.debian.org)... 195.20.242.89,
> 212.211.132.32, 212.211.132.250, ...
> Connecting to security.debian.org
> (security.debian.org)|195.20.242.89|:443... failed: Connection refused.
> Connecting to security.debian.org
> (security.debian.org)|212.211.132.32|:443... failed: Connection refused.
> Connecting to security.debian.org
> (security.debian.org)|212.211.132.250|:443... failed: Connection refused
> .
> Connecting to security.debian.org
> (security.debian.org)|2001:a78:5:1:216:35ff:fe7f:6ceb|:443... failed:
> Network is unreachable.
> Connecting to security.debian.org
> (security.debian.org)|2001:a78:5:0:216:35ff:fe7f:be4f|:443... failed:
> Network is unreachable.
>
> mike@mike-laptop3:~$ openssl s_client -showcerts -connect
> security.debian.org:443 -servername apache.org  </dev/null
> connect: Connection refused
> connect:errno=111
>
> mike@mike-laptop3:~$ nmap security.debian.org -Pn -p 443 2>&1 | grep 443
> 443/tcp closed https
>
> Kind Regards,
> Mike
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v2
>
> iQEcBAEBCAAGBQJWJqX5AAoJEOYwtpHNe8FmaLkH/3PjtG7fEUmm5iHemoplpgA6
> 2V0LRxeyT/mJhyB0DKV9snhqOjDNMwDhgUMF/uj6S5TpVasHg+H6fR5vjzSHR4Q/
> tcs3zEhPnZTQOrED1KB37P716zDtYScsxqZDwqnSHEi/JAeX3k54OZmPuPACMnvh
> L5fLs0KtpMa038zeoncsOMBhnV8yvJDX2Tms08einKnGRahEXwhBZ/myb996sDqu
> td1OgrlTZjNYcexee0bEGZAa8BqKAugDhO/FQJrgJpff/5KtbzosHMKyXk86DPxK
> fRaDplZLix8SnyFWc7qY+o+Jly61h0WyZ/PeY17qVa9A7yYvVEkLOoXkiyx3UyE=
> =gIdP
> -----END PGP SIGNATURE-----
>

[toc] | [prev] | [next] | [standalone]

#159553 — Re: How to make apt-transport-https accept security.debian.org bad certificate?

> I also tested with wget; of these addresses, only 128.31.0.63 supports
> HTTPS and has a bad certificate. The output is in Spanish; and it says
> that:

Remove "The output is in Spanish" when reading the message. I first 
pasted the output of wget when using it with the default language, then 
I replaced it with the output generated by using it with "LANG= wget 
[...]", but I forgot to remove that sentence.

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.user

csiph-web