Re: Sectigo root CA expiry issue

[Tim Rühsen]

Thanks for your report. This is fixed now in GnuTLS and likely goes into
the release 3.6.14, scheduled for tomorrow.

https://gitlab.com/gnutls/gnutls/-/issues/1008
https://gitlab.com/gnutls/gnutls/-/merge_requests/1271

Regards, Tim

On 30.05.20 19:57, Tenboro wrote:
> Hello,
> 
> Today I started getting some errors with a maintenance script that makes
> use of wget, where it claims that a certificate has expired.
> 
> DEBUG output created by Wget 1.19.5 on linux-gnu.
> 
> Reading HSTS entries from /root/.wget-hsts
> URI encoding = ‘UTF-8’
> --2020-05-30 17:29:58--  https://ehwiki.org/
> Certificates loaded: 154
> Resolving ehwiki.org (ehwiki.org)... 94.100.29.76
> Caching ehwiki.org => 94.100.29.76
> Connecting to ehwiki.org (ehwiki.org)|94.100.29.76|:443... connected.
> Created socket 4.
> Releasing 0x00005633a3c84880 (new refcount 1).
> ERROR: The certificate of ‘ehwiki.org’ is not trusted.
> ERROR: The certificate of ‘ehwiki.org’ has expired.
> 
> However, the certificate does not expire until March 2021. Doing the same
> with curl on the same box produces no errors, so it does not seem to be an
> issue with the system CA certs. Based on some slouching around, it seems to
> have something to do with wget not correctly handling the expiry of the
> Sectigo AddTrust root certificate:
> 
> https://support.sectigo.com/articles/Knowledge/Sectigo-AddTrust-External-CA-Root-Expiring-May-30-2020
> 
> This test link from Sectigo similarly works in Chrome/Firefox/curl, but not
> in wget.
> 
> https://addtrustchain.test.certificatetest.com/
> 
> wget -d https://addtrustchain.test.certificatetest.com/
> DEBUG output created by Wget 1.19.5 on linux-gnu.
> 
> Reading HSTS entries from /root/.wget-hsts
> URI encoding = ‘UTF-8’
> Converted file name 'index.html' (UTF-8) -> 'index.html' (UTF-8)
> --2020-05-30 17:50:32--  https://addtrustchain.test.certificatetest.com/
> Certificates loaded: 154
> Resolving addtrustchain.test.certificatetest.com (
> addtrustchain.test.certificatetest.com)... 35.245.138.9
> Caching addtrustchain.test.certificatetest.com => 35.245.138.9
> Connecting to addtrustchain.test.certificatetest.com (
> addtrustchain.test.certificatetest.com)|35.245.138.9|:443... connected.
> Created socket 3.
> Releasing 0x0000559518283390 (new refcount 1).
> ERROR: The certificate of ‘addtrustchain.test.certificatetest.com’ is not
> trusted.
> ERROR: The certificate of ‘addtrustchain.test.certificatetest.com’ has
> expired.
> 
> curl https://addtrustchain.test.certificatetest.com/
> Certificate issued from a CA signed by <b>USERTrust RSA Certification
> Authority</b> with a cross cert via server chain from <b>AddTrust External
> CA Root</b>
> 
> 
> The issue is present on CentOS 6, CentOS 7 and CentOS 8 installations with
> all updates applied.
> 
> I'm not sure if this is a distro issue or an issue with wget itself?
>

signature.asc
Description: OpenPGP digital signature