Experimental Physics and
Industrial Control System

Thomas Birke
Institute "Accelerator Physics" / Department "Accelerator Operation and Technology" / BE-IA-AOT
Accelerator Control Systems Group / ACS

Fon +49 30 8062-14934
Mobile +49 172 6738140
Fax +49 30 8062-14980

On 28. Nov 2022, at 19:03, Michael Davidsaver via Tech-talk <tech-talk at aps.anl.gov> wrote:

On 11/28/22 09:12, Andrew Johnson via Tech-talk wrote:

On 11/28/22 3:14 AM, Jörn Dreyer via Tech-talk wrote:

I encountered a problem while downloading the sequenzer from its repo either
using darcs or git. Both fail with an SSL error telling that the certificate is
invalid.

I've been having similar access problems since last week, different versions of git give me either

fatal: unable to access 'https://www-csr.bessy.de/control/SoftDist/sequencer/repo/branch-2-2.git/': SSL certificate problem: unable to get local issuer certificate

or

fatal: unable to access 'https://www-csr.bessy.de/control/SoftDist/sequencer/repo/branch-2-2.git/': Peer's Certificate issuer is not recognized.

The currently advertised certificate was issued on 31 October.

I think www-csr.bessy.de may still be serving up an old version
of an intermediate certificate ("GEANT OV RSA CA 4").

For some reason firefox is quite happy, and shows a certificate
chain with "GEANT OV RSA CA 4" issued by "USERTrust RSA Certification Authority".

However, running "openssl s_client -connect www-csr.bessy.de:443"
shows a different root..

...

Certificate chain
0 s:C = DE, ST = Berlin, O = Helmholtz-Zentrum Berlin f\C3\BCr Materialien und Energie GmbH, CN = www-csr.bessy.de
  i:C = NL, O = GEANT Vereniging, CN = GEANT OV RSA CA 4
1 s:C = DE, O = Verein zur Foerderung eines Deutschen Forschungsnetzes e. V., OU = DFN-PKI, CN = DFN-Verein Global Issuing CA
  i:C = DE, O = Verein zur Foerderung eines Deutschen Forschungsnetzes e. V., OU = DFN-PKI, CN = DFN-Verein Certification Authority 2
2 s:C = DE, O = Verein zur Foerderung eines Deutschen Forschungsnetzes e. V., OU = DFN-PKI, CN = DFN-Verein Certification Authority 2
  i:C = DE, O = T-Systems Enterprise Services GmbH, OU = T-Systems Trust Center, CN = T-TeleSec GlobalRoot Class 2
3 s:C = DE, O = T-Systems Enterprise Services GmbH, OU = T-Systems Trust Center, CN = T-TeleSec GlobalRoot Class 2
  i:C = DE, O = T-Systems Enterprise Services GmbH, OU = T-Systems Trust Center, CN = T-TeleSec GlobalRoot Class 2

...