I'm diagnosing a TLS certificate verification problem in Ubuntu Xenial that resulted from the recent Let's Encrypt root certificate expiration. The problem happens in cURL which uses GnuTLS under the hood -- so I've used gnutls-cli to diagnose it (when using openssl, a different problem happens even before certificate verification -- so it's of no use).

Despite the fact that I've updated the DST Root CA X3 certificate (with apt install ca-certificates) and confirmed that by comparing the contents of /usr/share/ca-certificates/mozilla/ (by file names, sizes and MD5 sums) on the problem machine and on another one where there's no error, the problem persists. Diffing the contents of /etc/ssl/certs/ca-certificates.crt (which is the file that GnuTLS directly uses, allegedly autogenerated from the former directory by /usr/sbin/update-ca-certificates) does show differences, but the DST Root CA X3 certificate is not among them.

Now I'm stuck at the point where I can reproduce the problem with gnutls-cli -- but it doesn't show which root certificate it uses, only the server-provided certificate chain which is all okay:

$ gnutls-cli download.clis.cloud.ibm.com --print-cert </dev/null 2>&1
Processed 129 CA certificate(s).
Resolving 'download.clis.cloud.ibm.com'...
Connecting to ''...
- Certificate type: X.509
- Got a certificate list of 3 certificates.
- Certificate[0] info:
 - subject `CN=cert-00045-cdnedge-bluemix.akamaized.net', issuer `C=US,O=Let's Encrypt,CN=R3', RSA key 2048 bits, signed using RSA-SHA256, activated `2021-10-19 02:05:23 UTC', expires `2022-01-17 02:05:22 UTC', SHA-1 fingerprint `8a13f222870579984cf6a0c6cf8ebfe6f122eb0b'
    Public Key ID:
    Public key's random art:
- Certificate[1] info:
 - subject `C=US,O=Let's Encrypt,CN=R3', issuer `C=US,O=Internet Security Research Group,CN=ISRG Root X1', RSA key 2048 bits, signed using RSA-SHA256, activated `2020-09-04 00:00:00 UTC', expires `2025-09-15 16:00:00 UTC', SHA-1 fingerprint `a053375bfe84e8b748782c7cee15827a6af5a405'
AYYwHQYDVR*** Fatal error: Error in the certificate.
*** Handshake has failed
GnuTLS error: Error in the certificate.
- Certificate[2] info:
 - subject `C=US,O=Internet Security Research Group,CN=ISRG Root X1', issuer `O=Digital Signature Trust Co.,CN=DST Root CA X3', RSA key 4096 bits, signed using RSA-SHA256, activated `2021-01-20 19:14:03 UTC', expires `2024-09-30 18:14:03 UTC', SHA-1 fingerprint `933c6ddee95c9c41a40f9f50493d82be03ad87bf'
- Status: The certificate is NOT trusted. The certificate chain uses expired certificate. 
*** PKI verification of server certificate failed...

So I cannot see which local certificate keeps causing the problem. Is there a way to retrieve this information?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.