Re: Problem downloading from sequenzer repo

[Michael Davidsaver via Tech-talk <tech-talk at aps.anl.gov>]

On 11/28/22 09:12, Andrew Johnson via Tech-talk wrote:
> On 11/28/22 3:14 AM, Jörn Dreyer via Tech-talk wrote:
> > I encountered a problem while downloading the sequenzer from its repo either
> > using darcs or git. Both fail with an SSL error telling that the certificate is
> > invalid.
> I've been having similar access problems since last week, different versions of git give me either
> > fatal: unable to access 'https://www-csr.bessy.de/control/SoftDist/sequencer/repo/branch-2-2.git/': SSL certificate problem: unable to get local issuer certificate
> or
> > fatal: unable to access 'https://www-csr.bessy.de/control/SoftDist/sequencer/repo/branch-2-2.git/': Peer's Certificate issuer is not recognized.

The currently advertised certificate was issued on 31 October.

I think www-csr.bessy.de may still be serving up an old version
of an intermediate certificate ("GEANT OV RSA CA 4").

For some reason firefox is quite happy, and shows a certificate
chain with "GEANT OV RSA CA 4" issued by "USERTrust RSA Certification Authority".

However, running "openssl s_client -connect www-csr.bessy.de:443"
shows a different root..

...
> Certificate chain
>  0 s:C = DE, ST = Berlin, O = Helmholtz-Zentrum Berlin f\C3\BCr Materialien und Energie GmbH, CN = www-csr.bessy.de
>    i:C = NL, O = GEANT Vereniging, CN = GEANT OV RSA CA 4
>  1 s:C = DE, O = Verein zur Foerderung eines Deutschen Forschungsnetzes e. V., OU = DFN-PKI, CN = DFN-Verein Global Issuing CA
>    i:C = DE, O = Verein zur Foerderung eines Deutschen Forschungsnetzes e. V., OU = DFN-PKI, CN = DFN-Verein Certification Authority 2
>  2 s:C = DE, O = Verein zur Foerderung eines Deutschen Forschungsnetzes e. V., OU = DFN-PKI, CN = DFN-Verein Certification Authority 2
>    i:C = DE, O = T-Systems Enterprise Services GmbH, OU = T-Systems Trust Center, CN = T-TeleSec GlobalRoot Class 2
>  3 s:C = DE, O = T-Systems Enterprise Services GmbH, OU = T-Systems Trust Center, CN = T-TeleSec GlobalRoot Class 2
>    i:C = DE, O = T-Systems Enterprise Services GmbH, OU = T-Systems Trust Center, CN = T-TeleSec GlobalRoot Class 2
...