Ubuntu

SSL Certificates not validatable with Cloudflare certificates

Asked by Thorsten Brandau

Hi
I am using Ubuntu 16.04LTS with Apache2 and Contao CMS System.
Contao uses an external site for updates and other functions, however recently this stopped working, due to a SSL certificate that cannot be validated.
Specifically it is "CloudFlare Inc ECC CA-2" that cannot be validated.

If I test:
wget https://contao.org/de/

The following message is displayed;
ERROR: cannot verify contao.org's certificate, issued by ‘CN=CloudFlare Inc ECC CA-2,O=CloudFlare\\, Inc.,L=San Francisco,ST=CA,C=US’:
  Unable to locally verify the issuer's authority.

If I use

openssl s_client -connect contao.org:443 -servername contao.org -showcerts

This is displayed
depth=1 C = US, ST = CA, L = San Francisco, O = "CloudFlare, Inc.", CN = CloudFlare Inc ECC CA-2
verify error:num=20:unable to get local issuer certificate

So I went to Cloudflare and worked through their support pages and installed various root CA they offer (converted pem->crt and the with dpkg-reconfigure and upadate-ca-certificate included the certificaes)

However, the error is persisting.

It does not occurr under:

Firefox (Windows 10)
Edge (Windows 10)
Suse Tumbleweed
Suse Leap 15.0
Suse Leap 15.1

Could anyone help me finding the problem and solving it? Thank you.

Question information

Language:
English Edit question
Status:
Expired
For:
Ubuntu Edit question
Assignee:
No assignee Edit question
Last query:
Last reply:
Revision history for this message
Launchpad Janitor (janitor) said : 		#1

This question was expired because it remained in the 'Open' state without activity for the last 15 days.

Revision history for this message
Thorsten Brandau (new-pork) said : 		#2

Hi

anyone any idea?

I could get the CMS to work by hardwiring the ca-certificates in the
PHP.INI file. However, openssl sclient and wget still are not able to
confirm the validity.

Any idea where to set the ca-bundle or ca-certificates for openssl to
check the validity?

Greeting

Revision history for this message
Launchpad Janitor (janitor) said : 		#3

This question was expired because it remained in the 'Open' state without activity for the last 15 days.