Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Lots of "unable to get local issuer certificate" warnings when pinging "https://" ressources. #16

Open
TurtleWilly opened this issue Mar 31, 2024 · 2 comments
Open

Lots of "unable to get local issuer certificate" warnings when pinging "https://" ressources. #16

TurtleWilly opened this issue Mar 31, 2024 · 2 comments

Comments

@TurtleWilly
Copy link

I'm getting a lot of "unable to get local issuer certificate" warnings when pinging https resources:

$ ./httping https://someserver.foo.bar/
Auto enabling SSL due to https-URL
PING someserver.foo.bar:443 (/):
connected to 1.2.3.4:443 (194 bytes), seq=0 time=121,21 ms 
SSL certificate validation failed: unable to get local issuer certificate
connected to 1.2.3.4:443 (194 bytes), seq=1 time=120,12 ms 
SSL certificate validation failed: unable to get local issuer certificate
connected to 1.2.3.4:443 (194 bytes), seq=2 time=121,04 ms 
SSL certificate validation failed: unable to get local issuer certificate
connected to 1.2.3.4:443 (194 bytes), seq=3 time=110,75 ms 
SSL certificate validation failed: unable to get local issuer certificate
connected to 1.2.3.4:443 (194 bytes), seq=4 time=119,35 ms 
SSL certificate validation failed: unable to get local issuer certificate
connected to 1.2.3.4:443 (194 bytes), seq=5 time=120,77 ms
…

I did a trace and noted that httping opens openssl libraries fine but never loads any cert file (like curl or wget do which are linked against the very same set of openssl libraries) from the trust stores.

$ sudo opensnoop -ve -n httping
STRTIME                UID    PID COMM          FD ERR PATH                 
2024 Mar 31 17:29:07   501   5076 httping        3   0 .                    
2024 Mar 31 17:29:07   501   5076 httping        3   0 /usr/local/silo/openssl/latest@3/lib/libssl.3.dylib 
2024 Mar 31 17:29:07   501   5076 httping        3   0 /usr/local/silo/openssl/latest@3/lib/libcrypto.3.dylib 
2024 Mar 31 17:29:07   501   5076 httping        3   0 /usr/local/silo/fftw/latest/lib/libfftw3.3.dylib 
2024 Mar 31 17:29:07   501   5076 httping        3   0 /usr/local/silo/gettext/latest/lib/libintl.8.dylib 
2024 Mar 31 17:29:07   501   5076 httping        3   0 /usr/local/silo/libiconv/latest/lib/libiconv.2.dylib 
2024 Mar 31 17:29:07   501   5076 httping        3   0 /dev/dtracehelper    
2024 Mar 31 17:29:07   501   5076 httping       -1   2 /usr/share/locale/UTF-8/LC_COLLATE 
2024 Mar 31 17:29:07   501   5076 httping        3   0 /usr/share/locale/UTF-8/LC_CTYPE 
2024 Mar 31 17:29:07   501   5076 httping        3   0 /Volumes/Temporary/HTTPing-2.9 
2024 Mar 31 17:29:07   501   5076 httping        3   0 /Volumes/Temporary/HTTPing-2.9 
2024 Mar 31 17:29:07   501   5076 httping        3   0 /Volumes/Temporary/HTTPing-2.9/./httping 
2024 Mar 31 17:29:07   501   5076 httping       -1   2 /etc/.mdns_debug     
2024 Mar 31 17:29:07   501   5076 httping       -1   2 /usr/share/locale/en_DE/LC_NUMERIC 
2024 Mar 31 17:29:07   501   5076 httping        4   0 /usr/share/locale/de_DE/LC_NUMERIC 
2024 Mar 31 17:29:07   501   5076 httping       -1   2 /usr/share/locale/en_DE/LC_TIME 
2024 Mar 31 17:29:07   501   5076 httping        4   0 /usr/share/locale/de_DE/LC_TIME 
2024 Mar 31 17:29:07   501   5076 httping       -1   2 /usr/share/locale/en_DE/LC_COLLATE 
2024 Mar 31 17:29:07   501   5076 httping        4   0 /usr/share/locale/de_DE/LC_COLLATE 
2024 Mar 31 17:29:07   501   5076 httping       -1   2 /usr/share/locale/en_DE/LC_MONETARY 
2024 Mar 31 17:29:07   501   5076 httping        4   0 /usr/share/locale/de_DE/LC_MONETARY 
2024 Mar 31 17:29:07   501   5076 httping       -1   2 /usr/share/locale/en_DE/LC_MESSAGES/LC_MESSAGES 
2024 Mar 31 17:29:07   501   5076 httping       -1   2 /usr/share/locale/en/LC_MESSAGES/LC_MESSAGES 
2024 Mar 31 17:29:07   501   5076 httping       -1   2 /usr/local/silo/httping/2.9/share/locale/en/LC_MESSAGES/httping.mo 
2024 Mar 31 17:29:07   501   5076 httping        4   0 /usr/local/etc/openssl/openssl.cnf 
2024 Mar 31 17:29:07   501   5076 httping        4   0 /dev/urandom         
2024 Mar 31 17:29:07   501   5076 httping        5   0 /etc/localtime       
2024 Mar 31 17:29:07   501   5076 httping        7   0 /usr/share/zoneinfo/UTC

It seems code in mssl.c in initialize_ctx() prevents the standard trust store to be loaded, because it forces some unsuitable hard-coded "ca_path":

	if (ca_path == NULL)
#if defined(__NetBSD__)
		ca_path = "/etc/openssl/certs";
#else
		ca_path = "/etc/ssl/certs";
#endif

Neither do I run NetBSD, nor do I have "/etc/ssl/certs". I do have "/usr/local/etc/openssl/cert.pem" and "/usr/local/etc/openssl/certs" here though.

I do not know much about OpenSSL and its API, but I adjusted the code like this:

#if 0
	if (ca_path == NULL)
#if defined(__NetBSD__)
		ca_path = "/etc/openssl/certs";
#else
		ca_path = "/etc/ssl/certs";
#endif
#else
	if (ca_path == NULL)
		SSL_CTX_set_default_verify_paths(ctx);
#endif

and now it seemingly works for me (no more errors). I do not know if the above code is correct in any way, but as hotfix it does the trick.

On related note the regular dumping of the warnings entirely broke the ncurses UI output. It seems the extra newline or something makes things go wild:

Screenshot

HTTPing Version: 2.9 (release tarball)
OpenSSL Version: 3.1.1
OS: OS X 10.10.5 (Yosemite)
@folkertvanheusden
Copy link
Owner

folkertvanheusden commented Apr 4, 2024 via email

@TurtleWilly
Copy link
Author

Yes, this is on an older OS X.

Not sure adding more #ifdefs is a good thing? My path/ example may not agree with other Mac OS X/ OS X/ macOS users. For example they may run OpenSSL via MacPorts or Homebrew installations where paths may be different again.

Hence my idea was to query OpenSSL for the path and let it decide what is right (e.g. also allow SSL_CERT_DIR/ SSL_CERT_FILE environment variables for overriding by the user) rather than hardcode anything. I just don't know if that SSL_CTX_set_default_verify_paths() is the proper way to do things (I just trial-and-errored this basically and it worked by luck afterwards. 😎)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@TurtleWilly @folkertvanheusden