From: "Massimo S." Received: from [192.168.100.201] (HELO mail.2rosenthals.com) by 2rosenthals.com (CommuniGate Pro SMTP 5.4.10) with ESMTP id 11190651 for ecs-isp@2rosenthals.com; Tue, 29 Oct 2024 06:18:49 -0400 Received: from [192.168.200.201] (port=56517 helo=mail2.2rosenthals.com) by mail.2rosenthals.com with esmtp (Exim 4.97.1) (envelope-from ) id 1t5jJA-000000007Cm-1ARY for ecs-isp@2rosenthals.com; Tue, 29 Oct 2024 06:18:42 -0400 Received: from mail2.quasarbbs.net ([80.86.52.115]:10082) by mail2.2rosenthals.com with esmtp (Exim 4.97.1) (envelope-from ) id 1t5jJ7-000000006dm-0gLv for ecs-isp@2rosenthals.com; Tue, 29 Oct 2024 06:18:37 -0400 X-SASI-Hits: BODY_SIZE_5000_5999 0.000000, BODY_SIZE_7000_LESS 0.000000, CTE_7BIT 0.000000, HTML_00_01 0.050000, HTML_00_10 0.050000, IN_REP_TO 0.000000, LEGITIMATE_SIGNS 0.000000, MSGID_SAMEAS_FROM_HEX_844412 0.100000, MSG_THREAD 0.000000, NO_CTA_URI_FOUND 0.000000, NO_URI_HTTPS 0.000000, REFERENCES 0.000000, REPLYTO_SAMEAS_FROM 0.000000, SENDER_NO_AUTH 0.000000, SUSP_DH_NEG 0.000000, TO_IN_SUBJECT 0.500000, USER_AGENT 0.000000, __ANY_URI 0.000000, __BODY_NO_MAILTO 0.000000, __BOUNCE_CHALLENGE_SUBJ 0.000000, __BOUNCE_NDR_SUBJ_EXEMPT 0.000000, __COURIER_PHRASE 0.000000, __CT 0.000000, __CTE 0.000000, __CT_TEXT_PLAIN 0.000000, __DQ_NEG_DOMAIN 0.000000, __DQ_NEG_HEUR 0.000000, __DQ_NEG_IP 0.000000, __FORWARDED_MSG 0.000000, __FROM_DOMAIN_NOT_IN_BODY 0.000000, __FROM_NAME_NOT_IN_ADDR 0.000000, __FROM_NAME_NOT_IN_BODY 0.000000, __FUR_HEADER 0.000000, __HAS_FROM 0.000000, __HAS_MSGID 0.000000, __HAS_REFERENCES 0.000000, __HAS_REPLYTO 0.000000, __HEADER_ORDER_FROM 0.000000, __INVOICE_MULTILINGUAL 0.000000, __IN_REP_TO 0.000000, __MAIL_CHAIN 0.000000, __MIME_BOUND_CHARSET 0.000000, __MIME_TEXT_ONLY 0.000000, __MIME_TEXT_P 0.000000, __MIME_TEXT_P1 0.000000, __MIME_VERSION 0.000000, __MOZILLA_USER_AGENT 0.000000, __MSGID_HEX_844412 0.000000, __NO_HTML_TAG_RAW 0.000000, __PHISH_SPEAR_SUBJ_ALERT 0.000000, __REFERENCES 0.000000, __REPLYTO_SAMEAS_FROM_ACC 0.000000, __REPLYTO_SAMEAS_FROM_ADDY 0.000000, __REPLYTO_SAMEAS_FROM_DOMAIN 0.000000, __SANE_MSGID 0.000000, __SCAN_D_NEG 0.000000, __SCAN_D_NEG2 0.000000, __SCAN_D_NEG_HEUR 0.000000, __SCAN_D_NEG_HEUR2 0.000000, __SUBJ_ALPHA_END 0.000000, __SUBJ_ALPHA_NEGATE 0.000000, __SUBJ_REPLY 0.000000, __TO_IN_SUBJECT 0.000000, __TO_MALFORMED_2 0.000000, __TO_NAME 0.000000, __TO_NAME_DIFF_FROM_ACC 0.000000, __TO_REAL_NAMES 0.000000, __URI_MAILTO 0.000000, __URI_NO_WWW 0.000000, __URI_NS 0.000000, __USER_AGENT 0.000000 X-SASI-Probability: 10% X-SASI-RCODE: 200 X-SASI-Version: Antispam-Engine: 5.1.4, AntispamData: 2024.10.29.93616 X-SASI-Hits: BODY_SIZE_5000_5999 0.000000, BODY_SIZE_7000_LESS 0.000000, CTE_7BIT 0.000000, HTML_00_01 0.050000, HTML_00_10 0.050000, IN_REP_TO 0.000000, LEGITIMATE_SIGNS 0.000000, MSGID_SAMEAS_FROM_HEX_844412 0.100000, MSG_THREAD 0.000000, NO_CTA_URI_FOUND 0.000000, NO_URI_HTTPS 0.000000, REFERENCES 0.000000, REPLYTO_SAMEAS_FROM 0.000000, SUSP_DH_NEG 0.000000, TO_IN_SUBJECT 0.500000, USER_AGENT 0.000000, __ANY_URI 0.000000, __AUTH_RES_PASS 0.000000, __BODY_NO_MAILTO 0.000000, __BOUNCE_CHALLENGE_SUBJ 0.000000, __BOUNCE_NDR_SUBJ_EXEMPT 0.000000, __COURIER_PHRASE 0.000000, __CT 0.000000, __CTE 0.000000, __CT_TEXT_PLAIN 0.000000, __DQ_NEG_DOMAIN 0.000000, __DQ_NEG_HEUR 0.000000, __DQ_NEG_IP 0.000000, __FORWARDED_MSG 0.000000, __FROM_DOMAIN_NOT_IN_BODY 0.000000, __FROM_NAME_NOT_IN_ADDR 0.000000, __FROM_NAME_NOT_IN_BODY 0.000000, __FUR_HEADER 0.000000, __HAS_FROM 0.000000, __HAS_MSGID 0.000000, __HAS_REFERENCES 0.000000, __HAS_REPLYTO 0.000000, __HEADER_ORDER_FROM 0.000000, __INVOICE_MULTILINGUAL 0.000000, __IN_REP_TO 0.000000, __MAIL_CHAIN 0.000000, __MIME_BOUND_CHARSET 0.000000, __MIME_TEXT_ONLY 0.000000, __MIME_TEXT_P 0.000000, __MIME_TEXT_P1 0.000000, __MIME_VERSION 0.000000, __MOZILLA_USER_AGENT 0.000000, __MSGID_HEX_844412 0.000000, __NO_HTML_TAG_RAW 0.000000, __PHISH_SPEAR_SUBJ_ALERT 0.000000, __REFERENCES 0.000000, __REPLYTO_SAMEAS_FROM_ACC 0.000000, __REPLYTO_SAMEAS_FROM_ADDY 0.000000, __REPLYTO_SAMEAS_FROM_DOMAIN 0.000000, __SANE_MSGID 0.000000, __SCAN_D_NEG 0.000000, __SCAN_D_NEG2 0.000000, __SCAN_D_NEG_HEUR 0.000000, __SCAN_D_NEG_HEUR2 0.000000, __SUBJ_ALPHA_END 0.000000, __SUBJ_ALPHA_NEGATE 0.000000, __SUBJ_REPLY 0.000000, __TO_IN_SUBJECT 0.000000, __TO_MALFORMED_2 0.000000, __TO_NAME 0.000000, __TO_NAME_DIFF_FROM_ACC 0.000000, __TO_REAL_NAMES 0.000000, __URI_MAILTO 0.000000, __URI_NO_WWW 0.000000, __URI_NS 0.000000, __USER_AGENT 0.000000 X-SASI-Probability: 10% X-SASI-RCODE: 200 X-SASI-Version: Antispam-Engine: 5.1.4, AntispamData: 2024.10.29.93616 Received: from [192.168.10.199] (dtp [192.168.10.199]) by srv2 (Weasel v2.9-0001 ) for ; Tue, 29 Oct 2024 11:18:22 -0000 Reply-To: ml@ecomstation.it Subject: Re: [eCS-ISP] uacme 1.2.4 curl issue To: eCS ISP Mailing List References: Organization: Massimo S. Message-ID: <12154a28-2d9e-6be8-da5a-653e21566534@ecomstation.it> Date: Tue, 29 Oct 2024 11:18:30 +0100 User-Agent: Mozilla/5.0 (OS/2; U; Warp 4.5; it-IT; rv:1.7.13) Gecko/20060424 Thunderbird/1.0.8 Mnenhy/0.7.4.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=iso-8859-15; format=flowed Content-Language: it-IT Content-Transfer-Encoding: 7bit Il 27/10/2024 02:52, Steven Levine ha scritto: > In , on 10/26/24 > at 10:59 AM, "Massimo S." said: > > Hi Massimo, > >> depth=1 C = US, O = Let's Encrypt, CN = R11 >> verify error:num=20:unable to get local issuer certificate >> verify return:1 >> depth=0 CN = acme-v02.api.letsencrypt.org >> verify return:1 >> CONNECTED(00000003) >> --- >> Certificate chain >> 0 s:CN = acme-v02.api.letsencrypt.org >> i:C = US, O = Let's Encrypt, CN = R11 >> 1 s:C = US, O = Let's Encrypt, CN = R11 >> i:C = US, O = Internet Security Research Group, CN = ISRG Root X1 --- >> Server certificate >> subject=CN = acme-v02.api.letsencrypt.org > >> issuer=C = US, O = Let's Encrypt, CN = R11 > >> --- >> No client certificate CA names sent >> Peer signing digest: SHA256 >> Peer signature type: RSA-PSS >> Server Temp Key: X25519, 253 bits >> --- >> SSL handshake has read 3310 bytes and written 412 bytes >> Verification error: unable to get local issuer certificate > > As I suspected you have a local conifiguration problem. Testing here > reports > > snip... > > -----END CERTIFICATE----- > subject=CN = acme-v02.api.letsencrypt.org > issuer=C = US, O = Let's Encrypt, CN = R10 > > --- > No client certificate CA names sent > Peer signing digest: SHA256 > Peer signature type: RSA-PSS > Server Temp Key: X25519, 253 bits > --- > SSL handshake has read 3309 bytes and written 412 bytes > Verification: OK > --- > New, TLSv1.3, Cipher is TLS_AES_256_GCM_SHA384 > Server public key is 2048 bit > Secure Renegotiation IS NOT supported > Compression: NONE > Expansion: NONE > No ALPN negotiated > Early data was not sent > Verify return code: 0 (ok) > > snip... > >> p11-kit-trust package available, but not installed >> should i install it? > > I cannot see any reason not to. > > Steven Hi, p11-kit-trust installed and vm rebooted, but the ssl check give the same result depth=1 C = US, O = Let's Encrypt, CN = R10 verify error:num=20:unable to get local issuer certificate verify return:1 depth=0 CN = acme-v02.api.letsencrypt.org verify return:1 CONNECTED(00000003) --- Certificate chain 0 s:CN = acme-v02.api.letsencrypt.org i:C = US, O = Let's Encrypt, CN = R10 1 s:C = US, O = Let's Encrypt, CN = R10 i:C = US, O = Internet Security Research Group, CN = ISRG Root X1 --- Server certificate -----BEGIN CERTIFICATE----- MIIFqjCCBJKgAwIBAgISBL4p77MSVouOsQZQINLffau6MA0GCSqGSIb3DQEBCwUA MDMxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNyeXB0MQwwCgYDVQQD EwNSMTAwHhcNMjQwOTA0MTYwMzQ2WhcNMjQxMjAzMTYwMzQ1WjAnMSUwIwYDVQQD ExxhY21lLXYwMi5hcGkubGV0c2VuY3J5cHQub3JnMIIBIjANBgkqhkiG9w0BAQEF AAOCAQ8AMIIBCgKCAQEAoVc5mou51gqcaVsHsopoMyKpwqxF7O9ZIXYcni1yl8gk A7/i+RDm3b2EixnhEbcFDMcjiPgsoHbbWzj3g4GRXFJVFDQnr9w+VL0qXvU9A3Sm wOg/s6Vph7y0KymfS25h0scM8S8o+nUhuyoeqK5T9YuZjmSNnRI5nMGWeramPU1p JUVeKp4x6YmP9bpOQs8yGqS8UZ/xlcXF4P21Oz2fI2KjIIg48782U5R7M+XoguIV SEPHeYfwpGFnojFEb3jHYWaSORx9vvn1E01r0LOuHn7Udx5z4XzcRggMtPmuGNCi cw8sLb7nGo+FQzAzYX28zAAf9TJAMH1u51SQ9IAK6QIDAQABo4ICwjCCAr4wDgYD VR0PAQH/BAQDAgWgMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjAMBgNV HRMBAf8EAjAAMB0GA1UdDgQWBBR50/M0MZvkR5623tTs8+Pyq/vT/TAfBgNVHSME GDAWgBS7vMNHpeS8qcbDpHIMEI2iNeHI6DBXBggrBgEFBQcBAQRLMEkwIgYIKwYB BQUHMAGGFmh0dHA6Ly9yMTAuby5sZW5jci5vcmcwIwYIKwYBBQUHMAKGF2h0dHA6 Ly9yMTAuaS5sZW5jci5vcmcvMIHJBgNVHREEgcEwgb6CHmFjbWUtdjAyLTEuYXBp LmxldHNlbmNyeXB0Lm9yZ4IeYWNtZS12MDItMi5hcGkubGV0c2VuY3J5cHQub3Jn gh5hY21lLXYwMi0zLmFwaS5sZXRzZW5jcnlwdC5vcmeCHmFjbWUtdjAyLTQuYXBp LmxldHNlbmNyeXB0Lm9yZ4IeYWNtZS12MDItNS5hcGkubGV0c2VuY3J5cHQub3Jn ghxhY21lLXYwMi5hcGkubGV0c2VuY3J5cHQub3JnMBMGA1UdIAQMMAowCAYGZ4EM AQIBMIIBAwYKKwYBBAHWeQIEAgSB9ASB8QDvAHUASLDja9qmRzQP5WoC+p0w6xxS ActW3SyB2bu/qznYhHMAAAGRvfymUwAABAMARjBEAiAt70lY2Z21hM/S4cmqHEIl 2b6i7CWuPctvTsCrosOBjgIgMi3KJplu84s+zmXYWXUUGdL1+Ucl+PzCcQw0Yttp tooAdgB2/4g/Crb7lVHCYcz1h7o0tKTNuyncaEIKn+ZnTFo6dAAAAZG9/KZ1AAAE AwBHMEUCIQCsBsU/OytLQxJFyjXveQem/Ye/sGKk8/PyR3pTrgMlDAIgWV4/DksD Sq+EDkK4M2hT+Nd2/RdGpR77sgDvthSLpo0wDQYJKoZIhvcNAQELBQADggEBABsr FG1nLmPQdCne3KrGpw+ns7tS8hlCDK11sjIqR/svVvE5uLIuEOmroUXBd99bF5M8 j7CAHt3iYyFVQ7QUeU+sX7W0hk09eq8z7CA2iRpvYPsbbEgnet3Gk5JGgyjF1T1u p9QYLhHh/7Cu7B0ySijD01ctvPyF8cl0/Wj2sl7cSq8hKCLECGzo/VYSFt+kvQCy 5uxcsgIzayh/WQlBrm1xwK/vdvch8DpWcCHnI7yg0cJdpjMyw/Mi1vLzbClJP6HK MjL0OYhfS2fJbGeCwhaKCc56aRWwrxfuxj+5Afo+ZgxvujIr6qipvu0YpRTdITec LjfE+3Tm8m32v7H3HiY= -----END CERTIFICATE----- subject=CN = acme-v02.api.letsencrypt.org issuer=C = US, O = Let's Encrypt, CN = R10 --- No client certificate CA names sent Peer signing digest: SHA256 Peer signature type: RSA-PSS Server Temp Key: X25519, 253 bits --- SSL handshake has read 3308 bytes and written 412 bytes Verification error: unable to get local issuer certificate --- New, TLSv1.3, Cipher is TLS_AES_256_GCM_SHA384 Server public key is 2048 bit Secure Renegotiation IS NOT supported Compression: NONE Expansion: NONE No ALPN negotiated Early data was not sent Verify return code: 20 (unable to get local issuer certificate) --- bad select 22 massimo