[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: How to make apt-transport-https accept security.debian.org bad certificate?



Thanks you.

I reported the problem as a bug against pseudopackage "debian-security" <http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=802539>.

I get a different set of IP addresses for security.debian.org; there may be some geographically dependent load balancing:

-----BEGIN PASTED TEXT-----
$ host security.debian.org
security.debian.org has address 128.31.0.63
security.debian.org has address 128.61.240.73
security.debian.org has address 149.20.20.6
security.debian.org has IPv6 address 2610:148:1f10:3::73
security.debian.org has IPv6 address 2001:4f8:8:36::6
security.debian.org mail is handled by 10 muffat.debian.org.
security.debian.org mail is handled by 10 mailly.debian.org.
-----END PASTED TEXT-----

I also tested with wget; of these addresses, only 128.31.0.63 supports HTTPS and has a bad certificate. The output is in Spanish; and it says that:

-----BEGIN PASTED TEXT-----
$ LANG= wget https://security.debian.org/dists/wheezy/updates/main/source/Sources --2015-10-20 16:10:55-- https://security.debian.org/dists/wheezy/updates/main/source/Sources Resolving security.debian.org (security.debian.org)... 128.61.240.73, 149.20.20.6, 128.31.0.63, ... Connecting to security.debian.org (security.debian.org)|128.61.240.73|:443... failed: Connection refused. Connecting to security.debian.org (security.debian.org)|149.20.20.6|:443... failed: Connection refused. Connecting to security.debian.org (security.debian.org)|128.31.0.63|:443... connected.
The certificate's owner does not match hostname `security.debian.org'
-----END PASTED TEXT-----

AFAIK security.debian.org has no official mirrors because the Debian project don't trusts mirrors to offer timely updates. I do not know of an unofficial mirror.

Regards and thanks.

El 20/10/15 a las 15:37, Michael Jones escribió:
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

On 20/10/15 09:06, Michael Jones wrote:
On 20/10/15 09:01, Michael Jones wrote:
no peer certificate available
correction, needed sni, will re-test

mike@mike-laptop3:~$ openssl s_client -showcerts -connect
debian.org:443 -servername security.debian.org  </dev/null
CONNECTED(00000003) depth=2 C = US, ST = New Jersey, L = Jersey
City, O = The USERTRUST Network, CN = USERTrust RSA Certification
Authority verify error:num=20:unable to get local issuer
certificate verify return:0

back home now, had another look, ssl is not available on the server
security.debian.org, so you won't be able to change the protocol to
https. If for whatever reason you wanted ssl, you could either have an
ssl proxy or a mirror that provided ssl.

mike@mike-laptop3:~$ wget
"https://security.debian.org/debian-security/dists/jessie/updates/non-fr
ee/binary-i386/Packages.bz2"
- --2015-10-20 21:35:34--
https://security.debian.org/debian-security/dists/jessie/updates/non-fre
e/binary-i386/Packages.bz2
Resolving security.debian.org (security.debian.org)... 195.20.242.89,
212.211.132.32, 212.211.132.250, ...
Connecting to security.debian.org
(security.debian.org)|195.20.242.89|:443... failed: Connection refused.
Connecting to security.debian.org
(security.debian.org)|212.211.132.32|:443... failed: Connection refused.
Connecting to security.debian.org
(security.debian.org)|212.211.132.250|:443... failed: Connection refused
.
Connecting to security.debian.org
(security.debian.org)|2001:a78:5:1:216:35ff:fe7f:6ceb|:443... failed:
Network is unreachable.
Connecting to security.debian.org
(security.debian.org)|2001:a78:5:0:216:35ff:fe7f:be4f|:443... failed:
Network is unreachable.

mike@mike-laptop3:~$ openssl s_client -showcerts -connect
security.debian.org:443 -servername apache.org  </dev/null
connect: Connection refused
connect:errno=111

mike@mike-laptop3:~$ nmap security.debian.org -Pn -p 443 2>&1 | grep 443
443/tcp closed https

Kind Regards,
Mike
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQEcBAEBCAAGBQJWJqX5AAoJEOYwtpHNe8FmaLkH/3PjtG7fEUmm5iHemoplpgA6
2V0LRxeyT/mJhyB0DKV9snhqOjDNMwDhgUMF/uj6S5TpVasHg+H6fR5vjzSHR4Q/
tcs3zEhPnZTQOrED1KB37P716zDtYScsxqZDwqnSHEi/JAeX3k54OZmPuPACMnvh
L5fLs0KtpMa038zeoncsOMBhnV8yvJDX2Tms08einKnGRahEXwhBZ/myb996sDqu
td1OgrlTZjNYcexee0bEGZAa8BqKAugDhO/FQJrgJpff/5KtbzosHMKyXk86DPxK
fRaDplZLix8SnyFWc7qY+o+Jly61h0WyZ/PeY17qVa9A7yYvVEkLOoXkiyx3UyE=
=gIdP
-----END PGP SIGNATURE-----



Reply to: