Hi guys !
Little question about a problem with SSL, etc...
I'm not even sure it's Solus related, maybe it's the website. I'm not sure where to ask, so...
Question :
I used to have some scripts (bash and python) to work with a website (https://www.casimages.com). I have no problem going to the website with Chrome or Firefox.
But lately, my scripts don't work on Solus anymore. I tried in Ubuntu 20 VM, and it works.
I don't know if the problem comes from the website (deprecated certificate ?) or from Solus repo ?
Chrome tells me the certificate is valid (expires in 2021) :
Here is some details :
Solus
~ eopkg info ca-certs
Paquets installés :
Nom : ca-certs, version : 20200513, release : 39
Résumé : Certificate Authority Files
~ curl https://www.casimages.com
curl: (60) SSL certificate problem: certificate has expired
More details here: https://curl.haxx.se/docs/sslcerts.html
curl failed to verify the legitimacy of the server and therefore could not
establish a secure connection to it. To learn more about this situation and
how to fix it, please visit the web page mentioned above.
~ curl -vvI https://www.casimages.com
* Trying 176.31.122.186:443...
* Connected to www.casimages.com (176.31.122.186) port 443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* Cipher selection: ALL:!EXPORT:!EXPORT40:!EXPORT56:!aNULL:!LOW:!RC4:@STRENGTH
* successfully set certificate verify locations:
* CAfile: none
CApath: /etc/ssl/certs
* TLSv1.2 (OUT), TLS header, Certificate Status (22):
* TLSv1.2 (OUT), TLS handshake, Client hello (1):
* TLSv1.2 (IN), TLS handshake, Server hello (2):
* TLSv1.2 (IN), TLS handshake, Certificate (11):
* TLSv1.2 (OUT), TLS alert, certificate expired (557):
* SSL certificate problem: certificate has expired
* Closing connection 0
curl: (60) SSL certificate problem: certificate has expired
More details here: https://curl.haxx.se/docs/sslcerts.html
curl failed to verify the legitimacy of the server and therefore could not
establish a secure connection to it. To learn more about this situation and
how to fix it, please visit the web page mentioned above.
with python :
~ python3 -m pip list | grep certifi
certifi 2019.9.11
~ python3
Python 3.7.7 (default, May 15 2020, 23:04:36)
[GCC 9.3.0] on linux
Type "help", "copyright", "credits" or "license" for more information.
>>> import requests
>>> r = requests.get("https://www.casimages.com")
Traceback (most recent call last):
File "/home/serge/.local/lib/python3.7/site-packages/urllib3/contrib/pyopenssl.py", line 488, in wrap_socket
cnx.do_handshake()
File "/usr/lib/python3.7/site-packages/OpenSSL/SSL.py", line 1915, in do_handshake
self._raise_ssl_error(self._ssl, result)
File "/usr/lib/python3.7/site-packages/OpenSSL/SSL.py", line 1647, in _raise_ssl_error
_raise_current_error()
File "/usr/lib/python3.7/site-packages/OpenSSL/_util.py", line 54, in exception_from_error_queue
raise exception_type(errors)
OpenSSL.SSL.Error: [('SSL routines', 'ssl3_get_server_certificate', 'certificate verify failed')]
During handling of the above exception, another exception occurred:
...
Ubuntu
ca-certificates version :
apt show ca-certificates
Package: ca-certificates
Version: 20190110ubuntu1.1
curl https://www.casimages.com
-> works
~ curl -vvI https://www.casimages.com
* Trying 176.31.122.186:443...
* TCP_NODELAY set
* Connected to www.casimages.com (176.31.122.186) port 443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* successfully set certificate verify locations:
* CAfile: /etc/ssl/certs/ca-certificates.crt
CApath: /etc/ssl/certs
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* TLSv1.3 (IN), TLS handshake, Server hello (2):
* TLSv1.2 (IN), TLS handshake, Certificate (11):
* TLSv1.2 (IN), TLS handshake, Server key exchange (12):
* TLSv1.2 (IN), TLS handshake, Server finished (14):
* TLSv1.2 (OUT), TLS handshake, Client key exchange (16):
* TLSv1.2 (OUT), TLS change cipher, Change cipher spec (1):
* TLSv1.2 (OUT), TLS handshake, Finished (20):
* TLSv1.2 (IN), TLS handshake, Finished (20):
* SSL connection using TLSv1.2 / DHE-RSA-AES256-GCM-SHA384
* ALPN, server did not agree to a protocol
* Server certificate:
* subject: OU=Domain Control Validated; OU=COMODO SSL Wildcard; CN=*.casimages.com
* start date: Feb 12 00:00:00 2019 GMT
* expire date: Apr 12 23:59:59 2021 GMT
* subjectAltName: host "www.casimages.com" matched cert's "*.casimages.com"
* issuer: C=GB; ST=Greater Manchester; L=Salford; O=Sectigo Limited; CN=Sectigo RSA Domain Validation Secure Server CA
* SSL certificate verify ok.
> HEAD / HTTP/1.1
> Host: www.casimages.com
> User-Agent: curl/7.68.0
> Accept: */*
>
* Mark bundle as not supporting multiuse
< HTTP/1.1 200 OK
HTTP/1.1 200 OK
< Date: Mon, 22 Jun 2020 09:58:01 GMT
Date: Mon, 22 Jun 2020 09:58:01 GMT
< Server: Apache
Server: Apache
< X-Powered-By: PHP/5.3.3
X-Powered-By: PHP/5.3.3
< Expires: Thu, 19 Nov 1981 08:52:00 GMT
Expires: Thu, 19 Nov 1981 08:52:00 GMT
< Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
< Pragma: no-cache
Pragma: no-cache
< Set-Cookie: PHPSESSID=ejfsa08cll4cverj258t7s0jb2; path=/
Set-Cookie: PHPSESSID=ejfsa08cll4cverj258t7s0jb2; path=/
< Strict-Transport-Security: max-age=31556926
Strict-Transport-Security: max-age=31556926
< Vary: Accept-Encoding
Vary: Accept-Encoding
< Content-Type: text/html; charset=iso-8859-1
Content-Type: text/html; charset=iso-8859-1
<
* Connection #0 to host www.casimages.com left intact
~ python3 -m pip list | grep certifi
certifi 2019.11.28
~ python3
Python 3.8.2 (default, Apr 27 2020, 15:53:34)
[GCC 9.3.0] on linux
Type "help", "copyright", "credits" or "license" for more information.
>>> import requests
>>> r = requests.get("https://www.casimages.com")
>>> print(r.status_code)
200
Conclusion
So, again, not sure if it's Solus fault, or if I bother you for nothing, because it's the website fault, and his certificate is not good. I don't know.
Thanks !
