I'm diagnosing a TLS certificate verification problem in Ubuntu Xenial that resulted from the recent Let's Encrypt root certificate expiration. The problem happens in cURL which uses GnuTLS under the hood -- so I've used gnutls-cli to diagnose it (when using openssl, a different problem happens even before certificate verification -- so it's of no use).
Despite the fact that I've updated the DST Root CA X3 certificate (with apt install ca-certificates) and confirmed that by comparing the contents of /usr/share/ca-certificates/mozilla/ (by file names, sizes and MD5 sums) on the problem machine and on another one where there's no error, the problem persists. Diffing the contents of /etc/ssl/certs/ca-certificates.crt (which is the file that GnuTLS directly uses, allegedly autogenerated from the former directory by /usr/sbin/update-ca-certificates) does show differences, but the DST Root CA X3 certificate is not among them.
Now I'm stuck at the point where I can reproduce the problem with gnutls-cli -- but it doesn't show which root certificate it uses, only the server-provided certificate chain which is all okay:
$ gnutls-cli download.clis.cloud.ibm.com --print-cert </dev/null 2>&1
Processed 129 CA certificate(s).
Resolving 'download.clis.cloud.ibm.com'...
Connecting to '69.192.0.152:443'...
- Certificate type: X.509
- Got a certificate list of 3 certificates.
- Certificate[0] info:
- subject `CN=cert-00045-cdnedge-bluemix.akamaized.net', issuer `C=US,O=Let's Encrypt,CN=R3', RSA key 2048 bits, signed using RSA-SHA256, activated `2021-10-19 02:05:23 UTC', expires `2022-01-17 02:05:22 UTC', SHA-1 fingerprint `8a13f222870579984cf6a0c6cf8ebfe6f122eb0b'
Public Key ID:
8bb871d529bc8edcd0158b6a16787990e7334bc9
Public key's random art:
<...>
-----BEGIN CERTIFICATE-----
<...>
-----END CERTIFICATE-----
- Certificate[1] info:
- subject `C=US,O=Let's Encrypt,CN=R3', issuer `C=US,O=Internet Security Research Group,CN=ISRG Root X1', RSA key 2048 bits, signed using RSA-SHA256, activated `2020-09-04 00:00:00 UTC', expires `2025-09-15 16:00:00 UTC', SHA-1 fingerprint `a053375bfe84e8b748782c7cee15827a6af5a405'
-----BEGIN CERTIFICATE-----
<...>
AYYwHQYDVR*** Fatal error: Error in the certificate.
*** Handshake has failed
GnuTLS error: Error in the certificate.
<...>
-----END CERTIFICATE-----
- Certificate[2] info:
- subject `C=US,O=Internet Security Research Group,CN=ISRG Root X1', issuer `O=Digital Signature Trust Co.,CN=DST Root CA X3', RSA key 4096 bits, signed using RSA-SHA256, activated `2021-01-20 19:14:03 UTC', expires `2024-09-30 18:14:03 UTC', SHA-1 fingerprint `933c6ddee95c9c41a40f9f50493d82be03ad87bf'
-----BEGIN CERTIFICATE-----
<...>
-----END CERTIFICATE-----
- Status: The certificate is NOT trusted. The certificate chain uses expired certificate.
*** PKI verification of server certificate failed...
So I cannot see which local certificate keeps causing the problem. Is there a way to retrieve this information?
