[Gmane-discuss] Gmane's certificate

[Joseph Mingrone]

Hi,

When trying to connect to news.gname.org [1], GnuTLS complains about the
certificate [2]. A workaround is to download the certificate and update
`gnutls-trustfiles' to point to it. But, now that Let's Encrypt offers
free certificates, could Gmane use a certificate issued by a recognized
authority?

Thanks,

Joseph

[1]
(setq (gnus-secondary-select-methods
'((nntp "news.gmane.org"
(nntp-port-number 563)
(nntp-open-connection-function nntp-open-tls-stream))))

[2]
Checking new news...
gnutls.c: [1] (Emacs) connecting to host: news.gmane.org
gnutls.c: [1] (Emacs) allocating credentials
gnutls.c: [2] (Emacs) allocating x509 credentials
gnutls.c: [2] (Emacs) using default verification flags
gnutls.c: [1] (Emacs) setting the trustfile: /usr/local/share/certs/ca-root-nss.crt
gnutls.c: [1] (Emacs) gnutls callbacks
gnutls.c: [1] (Emacs) gnutls_init
gnutls.c: [1] (Emacs) got non-default priority string: NORMAL
gnutls.c: [1] (Emacs) setting the priority string
gnutls.c: [2] HSK[0x3202000]: sent server name: 'news.gmane.org'

gnutls.c: [1] (Emacs) non-fatal error: Resource temporarily unavailable, try again. [5358 times]
gnutls.c: [2] GNUTLS_SEC_PARAM_LOW: certificate's issuer security level is unacceptable

gnutls.c: [1] (Emacs) verification: certificate was signed with an insecure algorithm
gnutls.c: [1] (Emacs) verification: the certificate was signed by an unknown and therefore untrusted authority
gnutls.c: [1] (Emacs) verification: certificate could not be verified

[Steinar Bang]

Post by Joseph Mingrone
When trying to connect to news.gname.org [1], GnuTLS complains about the
certificate [2]. A workaround is to download the certificate and update
`gnutls-trustfiles' to point to it. But, now that Let's Encrypt offers
free certificates, could Gmane use a certificate issued by a recognized
authority?

Here's a simple HOWTO for debian:
https://steinar.bang.priv.no/2017/05/11/sign-nginx-website-and-dovecot-imap-server-on-debian-with-lets-encrypt/

[Joseph Mingrone]

Post by Joseph Mingrone
Hi,
When trying to connect to news.gname.org [1], GnuTLS complains about the
certificate [2]. A workaround is to download the certificate and update
`gnutls-trustfiles' to point to it. But, now that Let's Encrypt offers
free certificates, could Gmane use a certificate issued by a recognized
authority?
Thanks,
Joseph
[1]
(setq (gnus-secondary-select-methods
'((nntp "news.gmane.org"
(nntp-port-number 563)
(nntp-open-connection-function nntp-open-tls-stream))))
[2]
Checking new news...
gnutls.c: [1] (Emacs) connecting to host: news.gmane.org
gnutls.c: [1] (Emacs) allocating credentials
gnutls.c: [2] (Emacs) allocating x509 credentials
gnutls.c: [2] (Emacs) using default verification flags
gnutls.c: [1] (Emacs) setting the trustfile: /usr/local/share/certs/ca-root-nss.crt
gnutls.c: [1] (Emacs) gnutls callbacks
gnutls.c: [1] (Emacs) gnutls_init
gnutls.c: [1] (Emacs) got non-default priority string: NORMAL
gnutls.c: [1] (Emacs) setting the priority string
gnutls.c: [2] HSK[0x3202000]: sent server name: 'news.gmane.org'
gnutls.c: [1] (Emacs) non-fatal error: Resource temporarily unavailable, try again. [5358 times]
gnutls.c: [2] GNUTLS_SEC_PARAM_LOW: certificate's issuer security level is unacceptable
gnutls.c: [1] (Emacs) verification: certificate was signed with an insecure algorithm
gnutls.c: [1] (Emacs) verification: the certificate was signed by an unknown and therefore untrusted authority
gnutls.c: [1] (Emacs) verification: certificate could not be verified

...

And now the certificate has expired.

% gnutls-cli --crlf news.gmane.org -p nntps <<<QUIT
Processed 154 CA certificate(s).
Resolving 'news.gmane.org:nntps'...
Connecting to '195.159.176.226:563'...
- Certificate type: X.509
- Got a certificate list of 1 certificates.
- Certificate[0] info:
- subject `CN=news.gmane.org,O=Gmane,ST=Some-State,C=NO', issuer `CN=news.gmane.org,O=Gmane,ST=Some-State,C=NO', serial 0x009398630d3ab6ffd6, RSA key 1024 bits, signed using RSA-SHA1, activated `2015-01-13 21:13:46 UTC', expires `2018-01-12 21:13:46 UTC', pin-sha256="V/d+/hePkSL5MylBGzvZ/c21qMz+E9H1SfyP1NKBr1Y="
Public Key ID:
sha1:d21a01452b5a9b06106946930e64717869ff7ae0
sha256:57f77efe178f9122f93329411b3bd9fdcdb5a8ccfe13d1f549fc8fd4d281af56
Public Key PIN:
pin-sha256:V/d+/hePkSL5MylBGzvZ/c21qMz+E9H1SfyP1NKBr1Y=
Public key's random art:
+--[ RSA 1024]----+
|=O+.ooo |
|+*o+ . . |
|= + + o |
| . + = o |
| . + + S |
| . . = |
| . + |
| E . |
| . |
+-----------------+

- Status: The certificate is NOT trusted. The certificate issuer is unknown. The certificate chain uses insecure algorithm. The certificate chain uses expired certificate.
*** PKI verification of server certificate failed...
*** Fatal error: Error in the certificate.
*** handshake has failed: Error in the certificate.

[Steinar Bang]

Post by Joseph Mingrone
And now the certificate has expired.

Yep. I've noticed it as well.

It might be an idea to sign news.gmane.org with let's encrypt?

It's very easy to do on debian if you can set up a web server on
http://news.gmane.org
https://steinar.bang.priv.no/2017/05/11/sign-nginx-website-and-dovecot-imap-server-on-debian-with-lets-encrypt/

[Joseph Mingrone]

Post by Steinar Bang

Post by Joseph Mingrone
And now the certificate has expired.

Yep. I've noticed it as well.
It might be an idea to sign news.gmane.org with let's encrypt?
It's very easy to do on debian if you can set up a web server on
http://news.gmane.org
https://steinar.bang.priv.no/2017/05/11/sign-nginx-website-and-dovecot-imap-server-on-debian-with-lets-encrypt/

This is the same suggestion we both offered back in November. :-/

[Steinar Bang]

Post by Joseph Mingrone
This is the same suggestion we both offered back in November. :-/

Ah... they say the memory is the first thing to go...

[Alexandros Diamantidis]

The current (self-signed) certificate has expired since Jan 12. It
would be nice to have a valid one (even if self-signed). Nicer still, of
course, to add one from Let's Encrypt as suggested by others.

Thanks!
Alexandros