I'm diagnosing a TLS certificate verification problem in Ubuntu Xenial that resulted from the recent Let's Encrypt root certificate expiration. The problem happens in cURL which uses GnuTLS under the hood -- so I've used
gnutls-cli to diagnose it (when using
openssl, a different problem happens even before certificate verification -- so it's of no use).
Despite the fact that I've updated the DST Root CA X3 certificate (with
apt install ca-certificates) and confirmed that by comparing the contents of
/usr/share/ca-certificates/mozilla/ (by file names, sizes and MD5 sums) on the problem machine and on another one where there's no error, the problem persists. Diffing the contents of
/etc/ssl/certs/ca-certificates.crt (which is the file that GnuTLS directly uses, allegedly autogenerated from the former directory by
/usr/sbin/update-ca-certificates) does show differences, but the DST Root CA X3 certificate is not among them.
Now I'm stuck at the point where I can reproduce the problem with
gnutls-cli -- but it doesn't show which root certificate it uses, only the server-provided certificate chain which is all okay:
$ gnutls-cli download.clis.cloud.ibm.com --print-cert </dev/null 2>&1 Processed 129 CA certificate(s). Resolving 'download.clis.cloud.ibm.com'... Connecting to '220.127.116.11:443'... - Certificate type: X.509 - Got a certificate list of 3 certificates. - Certificate info: - subject `CN=cert-00045-cdnedge-bluemix.akamaized.net', issuer `C=US,O=Let's Encrypt,CN=R3', RSA key 2048 bits, signed using RSA-SHA256, activated `2021-10-19 02:05:23 UTC', expires `2022-01-17 02:05:22 UTC', SHA-1 fingerprint `8a13f222870579984cf6a0c6cf8ebfe6f122eb0b' Public Key ID: 8bb871d529bc8edcd0158b6a16787990e7334bc9 Public key's random art: <...> -----BEGIN CERTIFICATE----- <...> -----END CERTIFICATE----- - Certificate info: - subject `C=US,O=Let's Encrypt,CN=R3', issuer `C=US,O=Internet Security Research Group,CN=ISRG Root X1', RSA key 2048 bits, signed using RSA-SHA256, activated `2020-09-04 00:00:00 UTC', expires `2025-09-15 16:00:00 UTC', SHA-1 fingerprint `a053375bfe84e8b748782c7cee15827a6af5a405' -----BEGIN CERTIFICATE----- <...> AYYwHQYDVR*** Fatal error: Error in the certificate. *** Handshake has failed GnuTLS error: Error in the certificate. <...> -----END CERTIFICATE----- - Certificate info: - subject `C=US,O=Internet Security Research Group,CN=ISRG Root X1', issuer `O=Digital Signature Trust Co.,CN=DST Root CA X3', RSA key 4096 bits, signed using RSA-SHA256, activated `2021-01-20 19:14:03 UTC', expires `2024-09-30 18:14:03 UTC', SHA-1 fingerprint `933c6ddee95c9c41a40f9f50493d82be03ad87bf' -----BEGIN CERTIFICATE----- <...> -----END CERTIFICATE----- - Status: The certificate is NOT trusted. The certificate chain uses expired certificate. *** PKI verification of server certificate failed...
So I cannot see which local certificate keeps causing the problem. Is there a way to retrieve this information?