Hi everyone, hoping someone can give me a hand with a Ubuntu 18.04 server getting to web resources using Let's encrypt certificates. This is the problem I am facing: owcld18:/Installs$ sudo wget https://download.owncloud.org/community/owncloud-complete-20210721.tar.bz2 --2021-11-14 10:05:50-- htt…

[image] actyler1001: echo | openssl s_client -connect acme-v02.api.letsencrypt.org:443 | head Can you run that again and show the output? I think there was a mistake when you pasted the results to here. Thanks.

[image] actyler1001: echo | openssl s_client -connect acme-v02.api.letsencrypt.org:443 | head Sure, here you go. owcld18:~$ echo | openssl s_client -connect acme-v02.api.letsencrypt.org:443 | head depth=1 C = US, O = Let's Encrypt, CN = R3 verify error:num=2:unable to get issuer certificate …

Same (BAD) output. hmm... It shows: [image] actyler1001: unable to get issuer certificate issuer= O = Digital Signature Trust Co., CN = DST Root CA X3 But then (correctly) doesn't show that cert in the chain: [image] actyler1001: --- Certificate chain 0 s:CN = acme-v01.api.letsencryp…

[image] rg305: But then (correctly) doesn't show that cert in the chain: ... It's like your system has engraved the cross-signed version of "ISRG Root X1" and only uses that one. @rg305 Yeah, I am confused by that too which is why I had to see it twice :slight_smile: @actyler1001 can you t…

Thanks Both you you. Yes, I've rebooted. Here is the output requested... Scratching my head here.... owcld18:~$ uptime 18:48:56 up 2 min, 1 user, load average: 0.15, 0.18, 0.08 owcld18:~$ echo | openssl s_client -connect google.com:443 | head depth=2 C = US, O = Google Trust Services LLC, CN…

Argh! I was kind of hoping that would fail too :slight_smile: Ok, what about this command. It is a more "pure" chain to ISRG Root X1. We need the -servername for this domain echo | openssl s_client -connect valid-isrgrootx1.letsencrypt.org:443 -servername valid-isrgrootx1.letsencrypt.org | head…

[image] MikeMcQ: echo | openssl s_client -connect valid-isrgrootx1.letsencrypt.org:443 -servername valid-isrgrootx1.letsencrypt.org | head Here we go.. owcld18:~$ echo | openssl s_client -connect valid-isrgrootx1.letsencrypt.org:443 -servername valid-isrgrootx1.letsencrypt.org | head depth=1…

@actyler1001 Thanks for all that. Very strange. You will have to wait for Rudy or other openssl or PKI experts to contribute. I am sure someone will be able to sort it. But, I am out of ideas. Good luck.

Please show the output of: find / -name *ISRG* And compare the files: /etc/ssl/certs/ISRG_Root_X1.pem /usr/share/ca-certificates/mozilla/ISRG_Root_X1.crt [which should both exist and be identical]

Okay, so here is the output of that command.. owcld18:~$ sudo find / -name *ISRG* /snap/core/11993/etc/ssl/certs/ISRG_Root_X1.pem /snap/core/11993/usr/share/ca-certificates/mozilla/ISRG_Root_X1.crt /snap/core/11798/etc/ssl/certs/ISRG_Root_X1.pem /snap/core/11798/usr/share/ca-certificates/mozilla/IS…

Ubuntu 18.04 and wget error cannot verify certificate

Help

Topic		Replies	Views
Can't verify certificates issued by letsencrypt Help	61	25074	November 2, 2021
Unable to verify certificate Help	22	13555	October 7, 2021
ERROR: cannot verify x's certificate, issued by ‘CN=R3,O=Let's Encrypt,C=US’: Help	13	10253	August 23, 2023
SSL working for newest Chrome but not curl or wget Help	4	5188	May 15, 2019
Issue - Unable to verify certificate chain - CentOS7 Help	33	4759	July 7, 2022

Ubuntu 18.04 and wget error cannot verify certificate

Related topics