https://example.com insecure

[thomas-zahner]

On my machine https://example.com seems to encounter certificate issues. This also happens with curl. This has been the case since about 2 weeks. Because of this about 10-20 tests fail on my machine. This doesn't happen in the GitHub actions. It could be that it is simply an issue on my machine, but I have never messed with any certificates, so my setup should be pretty "standard". (NixOS)

curl & lychee demo

$ curl https://example.com
curl: (60) SSL certificate OpenSSL verify result: certificate rejected (28)
More details here: https://curl.se/docs/sslcerts.html

curl failed to verify the legitimacy of the server and therefore could not
establish a secure connection to it. To learn more about this situation and
how to fix it, please visit the webpage mentioned above.

$ lychee https://example.com
Error: Network error: SSL certificate verification failed. Check certificate validity (error sending request for url (https://example.com/))

Caused by:
    0: error sending request for url (https://example.com/)
    1: client error (Connect)
    2: error:0A000086:SSL routines:tls_post_process_server_certificate:certificate verify failed:ssl/statem/statem_clnt.c:2124: (certificate rejected)
    3: error:0A000086:SSL routines:tls_post_process_server_certificate:certificate verify failed:ssl/statem/statem_clnt.c:2124:

My questions:

• is anybody else observing this? (@katrinafyi @mre)
• has anybody got an idea why this could happen or how to properly debug? (I observe that the website loads without any issues in Firefox)
• would it make sense to make all of our tests independent of the website?

(related: openwisp/openwisp-controller#1226 & libwww-perl/LWP-Protocol-https#90 & certifi/python-certifi#393 & libwww-perl/LWP-Protocol-https#91)

[katrinafyi]

I'm seeing the same issues on my home computer. I assumed it was my Arch packages being out of date 😆 It's good to know it's not just me. Unfortunately, TLS is not something I have good knowledge with.

I know that issuing a certificate needs a domain name, which might make it hard to make our tests independent. It'll always need to connect to some domain, unless we install our own certificates (and that risks jeopardising the test validity)

[thomas-zahner]

Hah, glad to see that I'm not the only one with the issue, also thought about blaming something outdated on my system. So maybe the strategy is just to wait for example.com to resolve their certificate issues? I'm really wondering why the Github runners don't encounter the issue.

Btw, here is the command I currently use to run tests locally 😅

cargo nextest run --all-targets --all-features -- --skip test_caching_single_file --skip test_formatted_file_output --skip test_fragments --skip test_exclude_multiple_urls --skip test_schemes --skip test_skip_binary_input --skip test_require_https --skip test_unsupported_uri_schemes_are_ignored --skip test_url_without_extension_is_html

[nobkd]

Just saw this, and it looked similar to your issue.

This update resolves TLS connection failures that some users experienced after Cloudflare rotated example.com's certificate to a chain terminating at the removed AAA Certificate Services (Comodo) root CA.

• https://bun.com/blog/bun-v1.3.10#updated-root-certificates

Maybe that's related to your problem?

Edit: Btw (at least my) curl gives me this problem as well:

$ curl --head https://example.com
curl: (60) SSL certificate problem: unable to get local issuer certificate
More details here: https://curl.se/docs/sslcerts.html

curl failed to verify the legitimacy of the server and therefore could not
establish a secure connection to it. To learn more about this situation and
how to fix it, please visit the webpage mentioned above.