SSL error with github

H

hannsmattes

Hi,

I don't know, if this is related to freebsd, but probably someone is able to help.

Running freebsd 14.5 from my poudriere-repository.

Trying to update the cms grav I get SSL-Errors. Using the cli-tool gpm, there errors that seem to result from curl.

I can't clone the grav repsitory, also because of an SSL-error:

Code: 
git clone -b master https://github.com/getgrav/grav.git
Cloning into 'grav'...
fatal: unable to access 'https://github.com/getgrav/grav.git/': SSL: no alternative certificate subject name matches target hostname 'github.com'

Same with the horde6-repository:
Code: 
git clone https://github.com/maintaina-com/horde-deployment.git horde
Cloning into 'horde'...
fatal: unable to access 'https://github.com/maintaina-com/horde-deployment.git/': SSL: no alternative certificate subject name matches target hostname 'github.com'

Is there something wrong with my trust store?

Any help appreciated

Regards Hanns
 
hannsmattes said:
Is there something wrong with my trust store?
Click to expand...
Then I would expect it not being able to validate. Here it's claiming none of the certificates offered are for 'github.com'. What does openssl s_client -connect github.com:443 show?
 
Hi, SirDice,

Code: 
openssl s_client -connect github.com:443
CONNECTED(00000003)
depth=2 C = GB, O = Sectigo Limited, CN = Sectigo Public Server Authentication Root E46
verify return:1
depth=1 C = GB, O = Sectigo Limited, CN = Sectigo Public Server Authentication CA DV E36
verify return:1
depth=0 CN = github.com
verify return:1
---
Certificate chain
 0 s:CN = github.com
   i:C = GB, O = Sectigo Limited, CN = Sectigo Public Server Authentication CA DV E36
   a:PKEY: id-ecPublicKey, 256 (bit); sigalg: ecdsa-with-SHA256
   v:NotBefore: Oct 30 00:00:00 2026 GMT; NotAfter: Jan 27 23:59:59 2027 GMT
 1 s:C = GB, O = Sectigo Limited, CN = Sectigo Public Server Authentication CA DV E36
   i:C = GB, O = Sectigo Limited, CN = Sectigo Public Server Authentication Root E46
   a:PKEY: id-ecPublicKey, 256 (bit); sigalg: ecdsa-with-SHA384
   v:NotBefore: Mar 22 00:00:00 2021 GMT; NotAfter: Mar 21 23:59:59 2036 GMT
 2 s:C = GB, O = Sectigo Limited, CN = Sectigo Public Server Authentication Root E46
   i:C = US, ST = New Jersey, L = Jersey City, O = The USERTRUST Network, CN = USERTrust ECC Certification Authority
   a:PKEY: id-ecPublicKey, 384 (bit); sigalg: ecdsa-with-SHA384
   v:NotBefore: Mar 22 00:00:00 2021 GMT; NotAfter: Jan 18 23:59:59 2038 GMT
---
Server certificate
-----BEGIN CERTIFICATE-----
MIID9DCCA5ugAwIBAgIQPh1gJrSwrqJ53KLvu87YKzAKBggqhkjOPQQDAjBgMQsw
CQYDVQQGEwJHQjEYMBYGA1UEChMPU2VjdGlnbyBMaW1pdGVkMTcwNQYDVQQDEy5T
ZWN0aWdvIFB1YmxpYyBTZXJ2ZXIgQXV0aGVudGljYXRpb24gQ0EgRFYgRTM2MB4X
DTI2MTAzMDAwMDAwMFoXDTI3MDEyNzIzNTk1OVowFTETMBEGA1UEAxMKZ2l0aHVi
LmNvbTBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABDfKd4nH+v687AH/LbUBuI5o
XVsDbbLwRkLBCDbDmYWcrpxd8+9O0uPHpIgjAQ0gBToGy66v4d70x/jgDoosK3ej
ggKAMIICfDAfBgNVHSMEGDAWgBQXmagEwW/kLXCoChA9A9PpGrgmYzAdBgNVHQ4E
FgQUjLAqHq7uhl0AATWx5YtpI6U+PHEwDgYDVR0PAQH/BAQDAgeAMAwGA1UdEwEB
/wQCMAAwEwYDVR0lBAwwCgYIKwYBBQUHAwEwSQYDVR0gBEIwQDA0BgsrBgEEAbIx
AQICBzAlMCMGCCsGAQUFBwIBFhdodHRwczovL3NlY3RpZ28uY29tL0NQUzAIBgZn
gQwBAgEwgYQGCCsGAQUFBwEBBHgwdjBPBggrBgEFBQcwAoZDaHR0cDovL2NydC5z
ZWN0aWdvLmNvbS9TZWN0aWdvUHVibGljU2VydmVyQXV0aGVudGljYXRpb25DQURW
RTM2LmNydDAjBggrBgEFBQcwAYYXaHR0cDovL29jc3Auc2VjdGlnby5jb20wJQYD
VR0RBB4wHIIKZ2l0aHViLmNvbYIOd3d3LmdpdGh1Yi5jb20wggEMBgorBgEEAdZ5
AgQCBIH9BIH6APgAdQBGojlnxg22RofGbz35mZR2k6amESCEV9VV5+PQodm2RgAA
AaGKLocgAAAEAwBGMEQCICIQbbpOkqdkpMHlEO4IaqjUE51GdnAX8lTdfJqayeUy
AiBW+rfEnQghzD2sljP8DmiE364OeNXjRLnoS4/+EDmBMQB/AKKBABhzThduHUfg
lUDzgbpUZpfNY6hDUHFuuAlO2vENAAABoYouiCYACAAABQAyHujyBAMASDBGAiEA
qR77xK7WOstHFrsyltQlPHqO5UAlaD5EUGgfV+SyHngCIQCTdXIrVaNFlwq2jVoU
6eq3LTDtgBbBB8AS6pKHuIF94DAKBggqhkjOPQQDAgNHADBEAiAiIVULRbVeXo16
6wK3Vp15eud/nlbNTa+j4FUnKD6GYAIgBcK3WmeV05N87KRIoaIV/h97FykBOCul
KBsCT9qemhg=
-----END CERTIFICATE-----
subject=CN = github.com
issuer=C = GB, O = Sectigo Limited, CN = Sectigo Public Server Authentication CA DV E36
---
No client certificate CA names sent
Peer signing digest: SHA256
Peer signature type: ECDSA
Server Temp Key: X25519, 253 bits
---
SSL handshake has read 3093 bytes and written 380 bytes
Verification: OK
---
New, TLSv1.3, Cipher is TLS_AES_128_GCM_SHA256
Server public key is 256 bit
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
Early data was not sent
Verify return code: 0 (ok)
---
---
Post-Handshake New Session Ticket arrived:
SSL-Session:
    Protocol  : TLSv1.3
    Cipher    : TLS_AES_128_GCM_SHA256
    Session-ID: 864BAB4B48CFFAEA43420C1432B73F3F37ED1C42B632DBF9194545E1961D68EF
    Session-ID-ctx:
    Resumption PSK: 351C33B8758244EBF766D4B8A329C12A9736CC8F22F4A6E6E5912DEF75EA16F1
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    TLS session ticket lifetime hint: 7200 (seconds)
    TLS session ticket:
    0000 - ce be e2 cc 2f ca 51 e3-f6 b9 e7 6a 12 d3 26 0b   ..../.Q....j..&.
    0010 - fe f6 3a 05 cc 8a 8c 97-84 0d db 52 de c8 81 83   ..:........R....

    Start Time: 1794255354
    Timeout   : 7200 (sec)
    Verify return code: 0 (ok)
    Extended master secret: no
    Max Early Data: 0
---
read R BLOCK
---
Post-Handshake New Session Ticket arrived:
SSL-Session:
    Protocol  : TLSv1.3
    Cipher    : TLS_AES_128_GCM_SHA256
    Session-ID: B37A3AABD4E4AECCD62B6171C815D75D6BFACFF6F89C9DA57C19A731892B110F
    Session-ID-ctx:
    Resumption PSK: 2297E8A18857DBDB5ED987FC360FD0E08C8A7F9B4094942E0295E9E0919832F3
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    TLS session ticket lifetime hint: 7200 (seconds)
    TLS session ticket:
    0000 - 8c ee 6b 1f a7 78 86 0d-a4 1e 60 13 c1 03 d3 26   ..k..x....`....&
    0010 - a9 78 50 ef 2a 4a 0a 8d-17 0a d5 ca 13 dd b6 c3   .xP.*J..........

    Start Time: 1794255354
    Timeout   : 7200 (sec)
    Verify return code: 0 (ok)
    Extended master secret: no
    Max Early Data: 0
---
read R BLOCK
closed

Regards Hanns
 
You must log in or register to reply here.
Back
Top