On Sat, Feb 04, 2012 at 08:03:44PM -0500, Rafael D'Halleweyn wrote:
> I had the same problem as described above. I noticed that the
> extensions.gnome.org uses a certificate from StartCom. Upon
> inspection, I found that this CA was disabled in
> /etc/ca-certificates.config. After editing the file, and running
> update-ca-certificates, I was able to install gnome-shell extensions
> through the browser.
On both my workstation (bug present) and the laptop (everything works) this
file contains:
mozilla/StartCom_Certification_Authority.crt
!mozilla/StartCom_Ltd..crt
(e.g. one certificate is enabled and the other is disabled)
Test connection with openssl from the problem system seems to be ok:
$ openssl s_client -connect extensions.gnome.org:443 -CApath /etc/ssl/certs
CONNECTED(00000003)
depth=2 C = IL, O = StartCom Ltd., OU = Secure Digital Certificate Signing, CN
= StartCom Certification Authority
verify return:1
depth=1 C = IL, O = StartCom Ltd., OU = Secure Digital Certificate Signing, CN
= StartCom Class 1 Primary Intermediate Server CA
verify return:1
depth=0 description = 524807-rrlSge06II5amy2w, CN = extensions.gnome.org,
emailAddress = hostmas...@gnome.org
verify return:1
---
Certificate chain
0
s:/description=524807-rrlSge06II5amy2w/CN=extensions.gnome.org/emailAddress=hostmas...@gnome.org
i:/C=IL/O=StartCom Ltd./OU=Secure Digital Certificate Signing/CN=StartCom
Class 1 Primary Intermediate Server CA
1 s:/C=IL/O=StartCom Ltd./OU=Secure Digital Certificate Signing/CN=StartCom
Class 1 Primary Intermediate Server CA
i:/C=IL/O=StartCom Ltd./OU=Secure Digital Certificate Signing/CN=StartCom
Certification Authority
---
Server certificate
-----BEGIN CERTIFICATE-----
MIIHITCCBgmgAwIBAgIDBFp6MA0GCSqGSIb3DQEBBQUAMIGMMQswCQYDVQQGEwJJ
…
ZVpqWzc=
-----END CERTIFICATE-----
subject=/description=524807-rrlSge06II5amy2w/CN=extensions.gnome.org/emailAddress=hostmas...@gnome.org
issuer=/C=IL/O=StartCom Ltd./OU=Secure Digital Certificate Signing/CN=StartCom
Class 1 Primary Intermediate Server CA
---
No client certificate CA names sent
---
SSL handshake has read 4581 bytes and written 369 bytes
---
New, TLSv1/SSLv3, Cipher is DHE-RSA-AES256-SHA
Server public key is 2048 bit
Secure Renegotiation IS supported
Compression: zlib compression
Expansion: zlib compression
SSL-Session:
Protocol : SSLv3
Cipher : DHE-RSA-AES256-SHA
Session-ID: 2753A54DB1CE3B5EFCE8AF561BAE2BEA68668C65C82654D1A3960EF3A9F15B11
Session-ID-ctx:
Master-Key:
FEE6B6D1A49C8883D601B0B5366876474D697252542F3873079AC04267FA3BC0A4026B3CAC8A6F1C0922F5F845E0BC72
Key-Arg : None
PSK identity: None
PSK identity hint: None
Compression: 1 (zlib compression)
Start Time: 1328427268
Timeout : 7200 (sec)
Verify return code: 0 (ok)
---
^D
DONE
If I omit the -CApath option, I get "Verify return code: 20 (unable to get
local issuer certificate)" on both systems.
I'll try running update-ca-certificates and retry when I get to my workstation,
just in case it changes anything.
--
To UNSUBSCRIBE, email to debian-bugs-dist-requ...@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org
