From Newsgroup: alt.os.linux.slackware

Hello!

I have the issue that wget/openssl complains about some certificates.

m@slack:~$ openssl verify /etc/ssl/certs/Sectigo_Public_Server_Authentication_Root_*
C = GB, O = Sectigo Limited, CN = Sectigo Public Server Authentication
Root E46
error 18 at 0 depth lookup: self signed certificate
error /etc/ssl/certs/Sectigo_Public_Server_Authentication_Root_E46.pem: verification failed
C = GB, O = Sectigo Limited, CN = Sectigo Public Server Authentication
Root R46
error 18 at 0 depth lookup: self signed certificate
error /etc/ssl/certs/Sectigo_Public_Server_Authentication_Root_R46.pem: verification failed
m@slack:~$

I have the latest ca-certificates-20260717-noarch-1_slack15.0 installed.

On a Debian system, the both certificates have the same content, but the verification succeeds.

What is the issue here?
--
Gru|f
Marco

Spam bitte an abfalleimer2001@stinkedores.dorfdsl.de

--- Synchronet 3.22a-Linux NewsLink 1.2

From Newsgroup: alt.os.linux.slackware

Marco Moock <mm@dorfdsl.de> writes:

I have the issue that wget/openssl complains about some certificates.
I have the latest ca-certificates-20260717-noarch-1_slack15.0 installed.

A few things you can check:

1. Look at the hash of those certs.
openssl x509 -subject_hash -noout -in Sectigo_Public_Server_Authentication_Root_E46.pem
da0cfd1d
openssl x509 -subject_hash -noout -in Sectigo_Public_Server_Authentication_Root_R46.pem
9046744a


The files need to link against that hash with ".0" on the end.
ls -l | grep Secti
lrwxrwxrwx 1 root root 49 Jul 20 10:01 9046744a.0 -> Sectigo_Public_Server_Authentication_Root_R46.pem
lrwxrwxrwx 1 root root 49 Jul 20 10:01 da0cfd1d.0 -> Sectigo_Public_Server_Authentication_Root_E46.pem
lrwxrwxrwx 1 root root 84 Jul 20 10:01 Sectigo_Public_Server_Authentication_Root_E46.pem -> /usr/share/ca-certificates/mozilla/Sectigo_Public_Server_Authentication_Root_E46.crt
lrwxrwxrwx 1 root root 84 Jul 20 10:01 Sectigo_Public_Server_Authentication_Root_R46.pem -> /usr/share/ca-certificates/mozilla/Sectigo_Public_Server_Authentication_Root_R46.crt

On my (Current) system, there's a tool, /etc/ssl/misc/c_rehash that will
make those symlinks. You can also make them by hand if you need
to. Maybe they got deleted?

2. The .pem files are actually symlinks down into
/usr/share/ca-certificates (as above). Check those are correct.

3. Check if you have any old left over CA bundle file. Some people cat
all the certs into one big file and use that. If you do, make sure it's up-to-date.

4. Check the cert files themselves are the correct ones.
openssl verify Sectigo_Public_Server_Authentication_Root_* Sectigo_Public_Server_Authentication_Root_E46.pem: OK Sectigo_Public_Server_Authentication_Root_R46.pem: OK

pushd /usr/share/ca-certificates/mozilla/
sha1sum Sectigo_Public_Server_Authentication_Root_* 323c21e30628ec823ce32209214a1526cce65e22 Sectigo_Public_Server_Authentication_Root_E46.crt
fb39baf23f5d3ab1f981ec407992211a3d2518ba Sectigo_Public_Server_Authentication_Root_R46.crt
--
PGP Key ID: 781C A3E2 C6ED 70A6 B356 7AF5 B510 542E D460 5CAE
"The Internet should always be the Wild West!"
--- Synchronet 3.22a-Linux NewsLink 1.2

From Newsgroup: alt.os.linux.slackware

Am 21.07.26 um 22:46 schrieb Marco Moock:

I have the issue that wget/openssl complains about some certificates.

I assume this was caused by a crashing virtual machine during an update.
I cannot reproduce that a new installs.
--
Gru|f
Marco

Spam bitte an abfalleimer2001@stinkedores.dorfdsl.de
--- Synchronet 3.22a-Linux NewsLink 1.2