[Bf-committers] Let's Encrypt SSL certificates incident on the blender.org servers

[Danny McGrath]

Hi Howard,

I got the same on Ubuntu until I updated the ca-certificates to the latest
version.

Does this also work for you?

On Sat, Oct 2, 2021 at 9:50 AM Howard Trickey via Bf-committers <
bf-committers at blender.org> wrote:

> I am getting this error on my Linux:
>
> $ git submodule foreach git pull
> Entering 'release/datafiles/locale'
> fatal: unable to access 'https://git.blender.org/blender-translations.git/
> ':
> server certificate verification failed. CAfile: none CRLfile: none
> fatal: run_command returned non-zero status for release/datafiles/locale
> .
>
> On Sat, Oct 2, 2021 at 8:19 AM Danny McGrath via Bf-committers <
> bf-committers at blender.org> wrote:
>
> > Hi,
> >
> > Just a heads up that I think I might have solved this server side by
> > removing the expired CA from the certificate chain.
> >
> > I updated git, svn, builder, and developer scripts to remove the
> > problematic (expired) DST root CA from the web servers. I tried the
> certbot
> > --preferred-ca option as well, but it doesn't seem to work, compared to
> > just removing it from the chain.pem/fullchain.pem files.
> >
> > As a test on my Windows 10 machine with TortoiseSVN, it works without
> error
> > here. Let me know if it helps or breaks anything!
> >
> > On Thu, Sep 30, 2021 at 10:35 PM Ray Molenkamp via Bf-committers <
> > bf-committers at blender.org> wrote:
> >
> > > For people having ssl issues with arcanist, the easiest solution is
> > >
> > > 1) grab the latest cacert.pem from https://curl.se/docs/caextract.html
> > > 2) copy it to [arcanist_installation_folder]/resources/ssl/custom.pem
> > >
> > > Pay attention to the slightly different filename it *NEEDS* to be
> > > custom.pem the original filename cacert.pem will not work.
> > >
> > > This should do the trick on all platforms (but it's only been tested
> > > on Linux and Windows).
> > >
> > > --Ray
> > > On 2021-09-30 1:06 p.m., Sergey Sharybin via Bf-committers wrote:
> > > > Hi,
> > > >
> > > > Just a quick memo about the issue of expired Let's Encrypt
> > certificates.
> > > It
> > > > might be useful for developers who experience issues with HTTPS
> > > connection
> > > > to our servers.
> > > >
> > > > One of the root Let's Encrypt certificates did expire today which
> > > affected
> > > > parts of our development infrastructure. In all cases it doesn't seem
> > to
> > > be
> > > > an issue with the server configuration but is caused by quirks on the
> > > > client side. We are only aware of issues on Windows.
> > > >
> > > > The Subversion clients did not trust the SSL certificate of
> > > > https://svn.blender.org/. The work-around we did for the
> > > builder.blender.org
> > > > was to install the Let’s Encrypt R3 intermediate certificate [1].
> This
> > > > "worked (tm)", although ideally intermediate certificates shouldn't
> > need
> > > to
> > > > be installed and the system should go by the root CA certificates
> from
> > > the
> > > > Windows Certificates Store.
> > > >
> > > > The Arcanist uses the CURL extension of PHP, and it does not use the
> > > > Windows Certificates Store. The way it was fixed on the buildbot
> > workers
> > > > was by creating a cacert.pem with the "ISRG Root X1" certificate
> which
> > > was
> > > > exported from the Store (and matched the one from Let's Encrypt
> > > information
> > > > page [1]).
> > > >
> > > > Our server administrator Danny McGrath also took the liberty of
> > disabling
> > > > TLSv1.0 and TLSv1.1 on some of the sites during tests. Provided that
> > this
> > > > doesn't make matters worse, the changes are likely to be kept.
> > > >
> > > > [1] https://letsencrypt.org/certificates/
> > > >
> > > > Best regards,
> > > > - Your Engineering Team Danny and Sergey -
> > > > --------------------------------------------------------------------
> > > > Sergey Sharybin - sergey at blender.org - www.blender.org
> > > > Principal Software Engineer, Blender
> > > > Buikslotermeerplein 161, 1025 ET Amsterdam, the Netherlands
> > > > _______________________________________________
> > > > Bf-committers mailing list
> > > > Bf-committers at blender.org
> > > > List details, subscription details or unsubscribe:
> > > > https://lists.blender.org/mailman/listinfo/bf-committers
> > > _______________________________________________
> > > Bf-committers mailing list
> > > Bf-committers at blender.org
> > > List details, subscription details or unsubscribe:
> > > https://lists.blender.org/mailman/listinfo/bf-committers
> > >
> >
> >
> > --
> > Cheers,
> > Danny
> >
> > -------------------------------------------------
> > Danny McGrath - dan at blender.org - www.blender.org
> > System Administrator at Blender
> > GPG key: 0x696871CA
> > _______________________________________________
> > Bf-committers mailing list
> > Bf-committers at blender.org
> > List details, subscription details or unsubscribe:
> > https://lists.blender.org/mailman/listinfo/bf-committers
> >
> _______________________________________________
> Bf-committers mailing list
> Bf-committers at blender.org
> List details, subscription details or unsubscribe:
> https://lists.blender.org/mailman/listinfo/bf-committers
>


-- 
Cheers,
Danny

-------------------------------------------------
Danny McGrath - dan at blender.org - www.blender.org
System Administrator at Blender
GPG key: 0x696871CA