# gnutls-cli --x509cafile=ca.pem expired-root-ca-test.germancoding.com Processed 2 CA certificate(s). Resolving 'expired-root-ca-test.germancoding.com'... Connecting to '2a01:4f8:151:506c::2:443'... ... - Status: The certificate is NOT trusted. The certificate chain uses expired certificate. *** PKI verification of server certificate failed... *** Fatal error: Error in the certificate. *** Handshake has failed GnuTLS error: Error in the certificate.
# faketime 2021-10-01 gnutls-cli canonical.com Processed 129 CA certificate(s). Resolving 'canonical.com'... Connecting to '2001:67c:1360:8001::2c:443'... ... - Status: The certificate is NOT trusted. The certificate chain uses expired certificate. *** PKI verification of server certificate failed... *** Fatal error: Error in the certificate. *** Handshake has failed GnuTLS error: Error in the certificate. Reproduced original problem, upgraded libgnutls30 and gnutls-bin # dpkg-query -W libgnutls30 gnutls-bin gnutls-bin 3.4.10-4ubuntu1.9 libgnutls30:amd64 3.4.10-4ubuntu1.9 Things are good now: # gnutls-cli --x509cafile=ca.pem expired-root-ca-test.germancoding.com Processed 2 CA certificate(s). Resolving 'expired-root-ca-test.germancoding.com'... Connecting to '2a01:4f8:151:506c::2:443'... ... - Status: The certificate is trusted. - Description: (TLS1.2)-(ECDHE-RSA-SECP256R1)-(AES-256-GCM) - Session ID: 53:9C:C7:86:1B:69:79:FC:37:AD:AD:A5:82:11:46:84:4F:B4:46:DC:C1:E7:2E:A9:40:18:6C:8A:B9:4C:B9:7E - Ephemeral EC Diffie-Hellman parameters - Using curve: SECP256R1 - Curve size: 256 bits - Version: TLS1.2 - Key Exchange: ECDHE-RSA - Server Signature: RSA-SHA256 - Cipher: AES-256-GCM - MAC: AEAD - Compression: NULL - Options: extended master secret, safe renegotiation, OCSP status request, - Handshake was completed # faketime 2021-10-01 gnutls-cli canonical.com Processed 129 CA certificate(s). Resolving 'canonical.com'... Connecting to '2001:67c:1360:8001::2b:443'... - Certificate type: X.509 - Got a certificate list of 3 certificates. ... - Status: The certificate is trusted. - Description: (TLS1.2)-(ECDHE-RSA-SECP256R1)-(AES-256-GCM) - Session ID: 71:90:E2:22:86:03:D2:13:17:6E:F1:20:8A:57:B8:E9:FF:0E:07:AB:1E:61:F6:7F:56:43:EF:BF:7A:F3:EF:56 - Ephemeral EC Diffie-Hellman parameters - Using curve: SECP256R1 - Curve size: 256 bits - Version: TLS1.2 - Key Exchange: ECDHE-RSA - Server Signature: RSA-SHA256 - Cipher: AES-256-GCM - MAC: AEAD - Compression: NULL - Options: extended master secret, safe renegotiation, - Handshake was completed All is good. Test website connectivity works, and future connectivity to canonical.com also works. xenial is verified. ** Tags removed: verification-needed-xenial ** Tags added: verification-done-xenial -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1928648 Title: expiring trust anchor compatibility issue To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/gnutls28/+bug/1928648/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
