On 2016-11-27 09:30:21, Mikhail Kshevetskiy wrote:
> Package: torbrowser-launcher
> Version: 0.2.6-2
> Severity: grave
> Tags: upstream
>
> Trying to start torbrowser for the first time produce the following message
>
> The SSL certificate served by https://www.torproject.org is invalid!
> You may be under attack.
>
> After that the program terminate. Running it from terminal results in the
> following console output:
>
> Tor Browser Launcher
> By Micah Lee, licensed under MIT
> version 0.2.6
> https://github.com/micahflee/torbrowser-launcher
> Downloading over Tor
> Downloading and installing Tor Browser for the first time.
> Downloading
> https://dist.torproject.org/torbrowser/update_2/release/Linux_x86_64-gcc3/x/en-US
> Download error: [<twisted.python.failure.Failure OpenSSL.SSL.Error: [('SSL
> routines', 'ssl3_get_server_certificate', 'certificate verify failed')]>]
> <class 'twisted.web._newclient.ResponseNeverReceived'>
I have seen a similar error recently, restarted the browser, and it
went away.
This could potentially be a hostile exit node doing SSL interception.
Workaround: restart the browser.
Fix: use a hidden service for dist.torproject.org
Optionally: identify the exit node and take it down
--
My passionate sense of social justice and social responsibility has
always contrasted oddly with my pronounced lack of need for direct
contact with other human beings and communities. I am truly a "lone
traveler" and have never belonged to my country, my home, my friends,
or even my immediate family, with my whole heart; in the face of all
these ties, I have never lost a sense of distance and a need for
solitude.
- Albert Einstein
