Mantis - openssl_utils
Viewing Issue Advanced Details
5193 packaging major always 2014-07-30 10:17 2014-08-09 12:08
laurent  
yann  
normal  
closed  
fixed  
none    
none  
0005193: OpenSSL does not look for the certificates in the right place
I'm not 100% sure this is only an OpenSSL issue, but I think it's the right place to start:

Symptom is that OpenCSW wget refuses to connect via https because the certificate cannot be verified:

$ type wget
wget is hashed (/opt/csw/bin/wget)

$ wget https://github.com/oetiker/znapzend/releases/download/v0.8.3/znapzend-0.8.3.tar.gz [^]
--2014-07-30 10:06:42-- https://github.com/oetiker/znapzend/releases/download/v0.8.3/znapzend-0.8.3.tar.gz [^]
Resolving github.com (github.com)... 192.30.252.131
Connecting to github.com (github.com)|192.30.252.131|:443... connected.
ERROR: cannot verify github.com's certificate, issued by '/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert SHA2 Extended Validation Server CA':
  Unable to locally verify the issuer's authority.
To connect to github.com insecurely, use `--no-check-certificate'.

truss shows it's failing to find it, and is looking in a non-existent directory:
27097: xstat(2, "/opt/csw/ssl/certs/244b5494.0", 0x08046AB0) Err#2 ENOENT

Just adding a symlink to the right directory is enough to make it work:
# ln -s /etc/opt/csw/ssl/certs /opt/csw/ssl/

So I guess either the symlink should be packaged, or OpenSSL should be built to look into /etc/opt/csw/ssl/certs by default.
My preference goes to the latter.
Issue History
2014-07-30 10:17 laurent New Issue
2014-07-30 22:19 yann Note Added: 0010880
2014-07-30 22:19 yann Assigned To => yann
2014-07-30 22:19 yann Status new => assigned
2014-08-09 00:39 yann Note Added: 0010886
2014-08-09 00:39 yann Status assigned => feedback
2014-08-09 11:58 laurent Note Added: 0010887
2014-08-09 11:59 laurent Status feedback => resolved
2014-08-09 11:59 laurent Resolution open => fixed
2014-08-09 12:08 yann Note Added: 0010888
2014-08-09 12:08 yann Status resolved => closed

Notes
(0010880)
yann   
2014-07-30 22:19   

Ah the symlink is still provided by the obsolete libssl0.9.8 package.
I will have a look how to fix this.

(0010886)
yann   
2014-08-09 00:39   
This should be fixed in last upload (1.0.1i).
Can you test it to confirm that it is ok ?

Yann
(0010887)
laurent   
2014-08-09 11:58   
Yep, works for me, good!

Thanks!
(0010888)
yann   
2014-08-09 12:08   
I am confident so I am closing it right away