2

I was attempting to set up a Cisco VPN and had run into some issues, in the process of trying to correct those issues I made some changes to my certificates directory and ran several commands pertaining to setting up / modifying ssl certificates on my machine, it was a few months ago so I can't remember exactly what I ran but I know a few things I did were that I built openssl from source and installed it that way, I softlinked a few folders and moved some certificates from one folder to another. I can still access sites with https but there are just a few things that don't work with ssl anymore some examples are: wget now returns the following regardless of the url:

--2022-08-25 22:46:09--  https://ubuntuforums.org/Resolving ubuntuforums.org (ubuntuforums.org)... 185.125.188.16, 185.125.188.17
Connecting to ubuntuforums.org (ubuntuforums.org)|185.125.188.16|:443... connected.
ERROR: cannot verify ubuntuforums.org's certificate, issued by ‘CN=R3,O=Let's Encrypt,C=US’:
  Unable to locally verify the issuer's authority.
To connect to ubuntuforums.org insecurely, use `--no-check-certificate'.

When I use gyazo, it now returns an error:

Traceback (most recent call last):    5: from /usr/bin/gyazo:116:in `<main>'
    4: from /usr/lib/ruby/2.7.0/net/http.rb:932:in `start'
    3: from /usr/lib/ruby/2.7.0/net/http.rb:943:in `do_start'
    2: from /usr/lib/ruby/2.7.0/net/http.rb:1009:in `connect'
    1: from /usr/lib/ruby/2.7.0/net/protocol.rb:44:in `ssl_socket_connect'
/usr/lib/ruby/2.7.0/net/protocol.rb:44:in `connect_nonblock': SSL_connect returned=1 errno=0 state=error: certificate verify failed (unable to get local issuer certificate) (OpenSSL::SSL::SSLError)

And a project I'm working on that has separate servers for the UI and API now has stopped communicating between the two, citing an openssl error "UntrustedRoot" I tried:

  • Reinstalling ca-certificates sudo apt-get install --reinstall ca-certificates

I tried sudo dpkg --purge --force-depends ca-certificates followed by sudo apt-get -f install and then sudo update-ca-certificates I tried changing the default version of my openssl I'd like to figure out a way to revert this all back to default without having to reinstall my operating system as I have a lot of configuration on here that I'd have to enter again.

2 Answers 2

1

This is the reason why packet managers exist and you shouldn't disturb their operation by installing software some other way.

Since there is no way for us to know what you did, we cannot tell you how to undo it.

Your best bet to revert your changes is your shell's history. Use it to look up the commands you issued when installing the self-built OpenSSL, and then find out how to do the opposite.

The best option to get a solid system back is reinstall, and then refraining from installing software manually.

0

The default (repository) trusted certs are in /etc/ssl/certs/. If you compile openssl from source, then it looks for them in /usr/local/ssl/certs/, but the directory is empty.

The solution:

sudo rmdir /usr/local/ssl/certs
sudo ln -s /etc/ssl/certs /usr/local/ssl/certs

Poof! The problem goes away!

1
  • I am glad that this worked for you but it seems to be a solution to the specific problem of trusted certs not being found. When you hit problems with the libraries for the new version not being compatible with the applications linked to libssl.so then you'll have to dig deeper. Next step would be to recompile applications that link to the library, taking them out of package manager support. Now you are manually keeping up with updates to the library and one or more applications. Or is apache's mod_ssl library compatible with your new libssl.so? Now you're recompiling new libraries. :(
    – doneal24
    Nov 10, 2022 at 17:49

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .