3 ms·

I'm getting certificate errors. This is a giant red flag to me.

frostiness 4y ago
Are you sure you're not on a network that may be blocking the site? I had the same issue but it went away once I connected to a VPN.
_ache_ 4y ago
I don't. It a basic Let's Encrypt certificate. It comes from you side.
LinuxBender 4y ago
For which domain? joinpeertube.org or one of the video hosting nodes? Use Qualys [1] to test the domain in question to link here or use the testssl.sh [2] code only depends on openssl and bash to test from your machine. If one of the many self hosted nodes, see if you can find a way to reach out to them and kindly suggest they set up certbot or a cron job to renew their certs. Joinpeertube.org looks good to me [3] so I assume you find a self-hosted node that needs some attention. If someone here knows of a way to query a list of all the self-hosted domains joined into peertube perhaps we could run testssl.sh against all of them to generate reports. I am not opposed to doing this if someone knows how I can get a list of all the domains using curl. [1] - https://www.ssllabs.com/ssltest/ https://www.ssllabs.com/ssltest/ [2] - https://github.com/drwetter/testssl.sh https://github.com/drwetter/testssl.sh [3] - https://www.ssllabs.com/ssltest/analyze.html?d=joinpeertube.org https://www.ssllabs.com/ssltest/analyze.html?d=joinpeertube....
- ehutch79 4y ago
  joinpeertube.org Clicking on the HN link, as a user how would I know this is to be expected? or that it's one random node?
  - LinuxBender 4y ago
    Joinpeertube.org is not a random node, however that site links to many random nodes for the videos. One may or may not realize when they click on a video that they are on a new domain unless they glance at the URL bar. That is why I was looking for clarification. If you are experiencing issues on joinpeertube.org then it may be worth running an OS update and ensuring you also have the latest version of your browser to rule out CA certificate store issues. CA stores are periodically updated and LetsEncrypt did go through a change that will eventually invalidate its older signing keys and intermediate certificates. This would only impact people that have stagnant operating systems or browsers unless one is being routed through an outdated MitM Man-in-the-Middle HTTPS proxy. We may be able to rule out MitM with openssl, see if the fingerprint is the same for you. openssl s_client -servername joinpeertube.com -connect joinpeertube.com:443 < /dev/null 2>/dev/null | openssl x509 -fingerprint -noout -in /dev/stdin SHA1 Fingerprint=C0:4E:F2:F6:EA:2B:72:C5:84:E0:73:2C:2C:2B:BB:FB:A1:34:C8:20
    - ehutch79 4y ago
      Something looks weird with dns on my end. Now I have to figure that out
      - LinuxBender 4y ago
        It seems China is the only place that shows a different IP for joinpeertube.org [1] Are you seeing the same IP? [1] - https://www.whatsmydns.net/#A/joinpeertube.org https://www.whatsmydns.net/#A/joinpeertube.org
aendruk 4y ago
What errors?
- ehutch79 4y ago
  NET::ERR_CERT_AUTHORITY_INVALID It's showing as some kind of cicso cert valid for a couple of days. There's no interception on this network. Other let's encrypt certs work just fine.

Are you sure you're not on a network that may be blocking the site? I had the same issue but it went away once I connected to a VPN.

_ache_ 4y ago

I don't. It a basic Let's Encrypt certificate. It comes from you side.

LinuxBender 4y ago

For which domain? joinpeertube.org or one of the video hosting nodes? Use Qualys [1] to test the domain in question to link here or use the testssl.sh [2] code only depends on openssl and bash to test from your machine. If one of the many self hosted nodes, see if you can find a way to reach out to them and kindly suggest they set up certbot or a cron job to renew their certs. Joinpeertube.org looks good to me [3] so I assume you find a self-hosted node that needs some attention. If someone here knows of a way to query a list of all the self-hosted domains joined into peertube perhaps we could run testssl.sh against all of them to generate reports. I am not opposed to doing this if someone knows how I can get a list of all the domains using curl. [1] - https://www.ssllabs.com/ssltest/ https://www.ssllabs.com/ssltest/ [2] - https://github.com/drwetter/testssl.sh https://github.com/drwetter/testssl.sh [3] - https://www.ssllabs.com/ssltest/analyze.html?d=joinpeertube.org https://www.ssllabs.com/ssltest/analyze.html?d=joinpeertube....

ehutch79 4y ago
joinpeertube.org Clicking on the HN link, as a user how would I know this is to be expected? or that it's one random node?
- LinuxBender 4y ago
  Joinpeertube.org is not a random node, however that site links to many random nodes for the videos. One may or may not realize when they click on a video that they are on a new domain unless they glance at the URL bar. That is why I was looking for clarification. If you are experiencing issues on joinpeertube.org then it may be worth running an OS update and ensuring you also have the latest version of your browser to rule out CA certificate store issues. CA stores are periodically updated and LetsEncrypt did go through a change that will eventually invalidate its older signing keys and intermediate certificates. This would only impact people that have stagnant operating systems or browsers unless one is being routed through an outdated MitM Man-in-the-Middle HTTPS proxy. We may be able to rule out MitM with openssl, see if the fingerprint is the same for you. openssl s_client -servername joinpeertube.com -connect joinpeertube.com:443 < /dev/null 2>/dev/null | openssl x509 -fingerprint -noout -in /dev/stdin SHA1 Fingerprint=C0:4E:F2:F6:EA:2B:72:C5:84:E0:73:2C:2C:2B:BB:FB:A1:34:C8:20
  - ehutch79 4y ago
    Something looks weird with dns on my end. Now I have to figure that out
    - LinuxBender 4y ago
      It seems China is the only place that shows a different IP for joinpeertube.org [1] Are you seeing the same IP? [1] - https://www.whatsmydns.net/#A/joinpeertube.org https://www.whatsmydns.net/#A/joinpeertube.org

aendruk 4y ago

What errors?

ehutch79 4y ago
NET::ERR_CERT_AUTHORITY_INVALID It's showing as some kind of cicso cert valid for a couple of days. There's no interception on this network. Other let's encrypt certs work just fine.