From: "Gerald A." Date: 2010-10-19T02:41:17+09:00 Subject: Re: Ubuntu, SSL, Ruby 1.9.2 Wasn't a security issue, just trying to keep the thread clean ; ) Here's the whole mess: openssl s_client -CApath /etc/ssl/certs -connect 192.168.0.23:443 CONNECTED(00000003) depth=0 /O=www.mydomain.com/OU=Domain Control Validated/CN=www.mydomain.com verify error:num=20:unable to get local issuer certificate verify return:1 depth=0 /O=www.mydomain.com/OU=Domain Control Validated/CN=www.mydomain.com verify error:num=27:certificate not trusted verify return:1 depth=0 /O=www.mydomain.com/OU=Domain Control Validated/CN=www.mydomain.com verify error:num=21:unable to verify the first certificate verify return:1 --- Certificate chain 0 s:/O=www.mydomain.com/OU=Domain Control Validated/CN=www.mydomain.com i:/C=US/ST=Arizona/L=Scottsdale/O=GoDaddy.com, Inc./OU=http://certificates.godaddy.com/repository/CN=Go Daddy Secure Certification Authority/serialNumber=07969287 --- Server certificate -----BEGIN CERTIFICATE----- MIIFXzCCBEegAwIBAgIHAJMR2vIT3zANBgkqhkiG9w0BAQUFADCByjELMAkGA1UE BhMCVVMxEDAOBgNVBAgTB0FyaXpvbmExEzARBgNVBAcTClNjb3R0c2RhbGUxGjAY BgNVBAoTEUdvRGFkZHkuY29tLCBJbmMuMTMwMQYDVQQLEypodHRwOi8vY2VydGlm aWNhdGVzLmdvZGFkZHkuY29tL3JlcG9zaXRvcnkxMDAuBgNVBAMTJ0dvIERhZGR5 IFNlY3VyZSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTERMA8GA1UEBRMIMDc5Njky ODcwHhcNMTAwNjE3MTIwMDU0WhcNMTEwNzI5MTYyNDM1WjBXMRgwFgYDVQQKEw93 d3cuc3dlZXBzdS5jb20xITAfBgNVBAsTGERvbWFpbiBDb250cm9sIFZhbGlkYXRl ZDEYMBYGA1UEAxMPd3d3LnN3ZWVwc3UuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOC AQ8AMIIBCgKCAQEAwu8aRZbZl7mi8z7azlhH2Ulz0haJkiKKfs3mO+nwvMDRt/zd rN1s2ndj4XJUfSI9xk+zKhx6wfOS1YTK9Tx9KBlMkEPs+prnb76rGkVMkUR/NYSr 2YOeOVY8TF8eYqbSf/t/S+wi8XLvqitQijXauRb7Ywvd4ldY4j/SzCoN4elMTcLJ Tb3jLgXN+JoQxzuLechrRo4ZrU+KwXQ+lqEVkCyutb+4MIseO5+C3uP0xhsZtI0S rtJ7bqU//ylCks1CrKEWFeuCu2A+a720fQ31ZVoM+TP5RnzTR9Ti8I8vs+SUnoNP zLzpKk8e+vJjw3L2f/YItdCrJPtMkEF8UtdfIQIDAQABo4IBujCCAbYwDwYDVR0T AQH/BAUwAwEBADAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwDgYDVR0P AQH/BAQDAgWgMDMGA1UdHwQsMCowKKAmoCSGImh0dHA6Ly9jcmwuZ29kYWRkeS5j b20vZ2RzMS0xOS5jcmwwUwYDVR0gBEwwSjBIBgtghkgBhv1tAQcXATA5MDcGCCsG AQUFBwIBFitodHRwOi8vY2VydGlmaWNhdGVzLmdvZGFkZHkuY29tL3JlcG9zaXRv cnkvMIGABggrBgEFBQcBAQR0MHIwJAYIKwYBBQUHMAGGGGh0dHA6Ly9vY3NwLmdv ZGFkZHkuY29tLzBKBggrBgEFBQcwAoY+aHR0cDovL2NlcnRpZmljYXRlcy5nb2Rh ZGR5LmNvbS9yZXBvc2l0b3J5L2dkX2ludGVybWVkaWF0ZS5jcnQwHwYDVR0jBBgw FoAU/axhMpNsRdbi7oVfmrrndplozOcwJwYDVR0RBCAwHoIPd3d3LnN3ZWVwc3Uu Y29tggtzd2VlcHN1LmNvbTAdBgNVHQ4EFgQUDR9e68imhp/pnxQYXgtWCPiLdrsw DQYJKoZIhvcNAQEFBQADggEBAAB0vEyM6jTYVY9+o9xJKxANIqz/Q1ZbzEhlHFkD Gqp16NY0aTkRZeBXosM8Mo7EIp2vqicTl/spyK/U0kNX7W53YeY7DtzItdMtVOei MGi+J5UnisoQGDLf6brzpVpbhTecfDqtpeGzN7DYgqPYlg41jQNJF6OgvrHTaFW8 tEWB4VbmJ5DTqtZy76LdhKwPmlYerr2D7H3vpPAfbtKmsXyy3g+4LhEhGN/fVFmi bb1Zl5qlWugjtB9mmB9uCtaHsc8ddiEwIkOFlofb5OMMcttTAisXlOJHGx2PYvvd 7mO8F53x/GsrzAhovT3/3GHoPkm3iei6TH1hgqLduW3aixY= -----END CERTIFICATE----- subject=/O=www.mydomain.com/OU=Domain Control Validated/CN=www.mydomain.com issuer=/C=US/ST=Arizona/L=Scottsdale/O=GoDaddy.com, Inc./OU=http://certificates.godaddy.com/repository/CN=Go Daddy Secure Certification Authority/serialNumber=07969287 --- No client certificate CA names sent --- SSL handshake has read 2257 bytes and written 293 bytes --- New, TLSv1/SSLv3, Cipher is DHE-RSA-AES256-SHA Server public key is 2048 bit Secure Renegotiation IS supported Compression: zlib compression Expansion: zlib compression SSL-Session: Protocol : TLSv1 Cipher : DHE-RSA-AES256-SHA Session-ID: 3A1A18B19DB8D1BDC808FDE28B9E1E08A9CB6C2439D58719426ABC2D02FED434 Session-ID-ctx: Master-Key: 1C0F6B40085031345A8BADACE239BD54F38A7ED6DF347A99EBFBC0D0E45414860EBADB75D97E2D954F43A0C8709A668A Key-Arg : None TLS session ticket: 0000 - 7a 74 7d 2a 8c 69 07 a2-b5 b5 ac 7b 75 0e a0 fb zt}*.i.....{u... 0010 - 5b 01 b4 c5 c8 f2 d4 79-c1 f7 de 04 69 5f 8f ce [......y....i_.. 0020 - c3 3b c8 47 9b c9 9a 13-ea 29 df b5 52 2b ec 6f .;.G.....)..R+.o 0030 - 5b 4f 92 39 d8 ab 8d 52-b1 49 cd ea ed ca 86 3e [O.9...R.I.....> 0040 - f9 f3 2b 39 ae 38 9e ac-d7 f3 9b 2b fc 58 37 be ..+9.8.....+.X7. 0050 - 68 ff 2c f0 b8 5a ed e3-a5 ba ea a0 31 dd 86 a8 h.,..Z......1... 0060 - a8 6f d9 bf a8 0c c9 ef-be be 07 eb e7 37 ae 49 .o...........7.I 0070 - 6e 17 79 2c 17 12 9a ca-dc 8a 94 8d 61 54 e3 3b n.y,........aT.; 0080 - 52 37 75 2f 49 4e 56 24-25 d8 49 6e 63 fc 3f 89 R7u/INV$%.Inc.?. 0090 - ca af da fc 83 77 c9 5c-4f 2b a3 24 ce a8 da 33 .....w.\O+.$...3 00a0 - eb 1e a8 5d 9b 50 a3 80-90 a5 5b 37 0c 20 f4 ac ...].P....[7. .. 00b0 - e1 9d ca 6d d6 2c 0d 51-4a d7 b6 b6 0b 9e 18 e2 ...m.,.QJ....... Compression: 1 (zlib compression) Start Time: 1287416918 Timeout : 300 (sec) Verify return code: 21 (unable to verify the first certificate) Available pems: lrwxrwxrwx 1 root root 58 2010-10-09 10:23 Go_Daddy_Class_2_CA.pem -> /usr/share/ca-certificates/mozilla/Go_Daddy_Class_2_CA.crt -rw-r--r-- 1 root root 1778 2010-04-15 09:28 UbuntuOne-Go_Daddy_CA.pem -rw-r--r-- 1 root root 1449 2010-04-15 09:28 UbuntuOne-Go_Daddy_Class_2_CA.pem Obviously just the one. Thanks Brian Candler wrote in post #955196: > Well, if you were to post the actual certificate (PEM file) then I can > look at it. A certificate is public information after all. Obviously not > the private key which goes with it :-) > > Otherwise, I can't help you, and it's not a ruby issue anyway. It's a > problem somewhere between Ubuntu and its certs repository. > > Looking on an Ubuntu 10.04 box, I see: > > $ find /etc/ssl/certs/ -iname '*daddy*' > /etc/ssl/certs/Go_Daddy_Class_2_CA.pem > /etc/ssl/certs/UbuntuOne-Go_Daddy_CA.pem > /etc/ssl/certs/UbuntuOne-Go_Daddy_Class_2_CA.pem > > But without your PEM I can't check if these are the CA certs you need. -- Posted via http://www.ruby-forum.com/.