Admin message

Self sign-up has been disabled due to increased spam activity. If you want to get access, please send an email to a project owner (preferred) or at gitlab(at)nic(dot)cz. We apologize for the inconvenience.

[Turris OS 3.x] GnuTLS fails to verify Let's Encrypt certificates
### Cause Let's Encrypt original cross-signed root CA *DST Root CA X3* expired at *Sep 30 14:01:15 2021 GMT* (today). LE' issued certificates are signed with *ISRG Root X1*, which is present in certificate store for a long time as a trusted root CA. However, GnuTLS fails to verify Let's Encrypt certificate, returning `Status: The certificate is NOT trusted. The certificate chain uses expired certificate.` ### Issue As a result, `kresd` at Turris OS 3.x fails to verify TLS certificate on `odvr.nic.cz` server and returns `SERVFAIL` on every DNS query ~High ~Bug ### Further info | Package | version in Turris OS 3.x | version in Turris OS 5.x | |--|--|--| | turris-version | 3.11.23 | 5.2.7 | | knot-resolver | 5.2.0-1 | 5.3.2-2 | | libgnutls | 3.6.7-4 | 3.6.15-2 | Issue can be simply verified via command: ``` gnutls-cli -p 853 odvr.nic.cz ``` Which is successful on _TOS 5.x_ but unsuccessful on _TOS 3.x_: ``` - Status: The certificate is NOT trusted. The certificate chain uses expired certificate. *** PKI verification of server certificate failed... *** Fatal error: Error in the certificate. ``` <details> <summary>Certificate chain</summary> ``` +-------------------------------------------+ | subject=CN = odvr.nic.cz | | issuer=C = US, O = Let's Encrypt, CN = R3 | | notBefore=Aug 31 17:23:50 2021 GMT | | notAfter=Nov 29 17:23:49 2021 GMT | +-------------------------------------------+ \ \ \ +------------------------------------------------------------------------+ | subject=C = US, O = Let's Encrypt, CN = R3 | | issuer=C = US, O = Internet Security Research Group, CN = ISRG Root X1 | | notBefore=Sep 4 00:00:00 2020 GMT | | notAfter=Sep 15 16:00:00 2025 GMT | +------------------------------------------------------------------------+ \ \ \ +-------------------------------------------------------------------------+ | subject=C = US, O = Internet Security Research Group, CN = ISRG Root X1 | | issuer=O = Digital Signature Trust Co., CN = DST Root CA X3 | | notBefore=Jan 20 19:14:03 2021 GMT | | notAfter=Sep 30 18:14:03 2024 GMT | +-------------------------------------------------------------------------+ / \ | \ | | \ | | \ | | +-----------------------------------------------------------+ | | | subject= /O=Digital Signature Trust Co./CN=DST Root CA X3 | | | | issuer= /O=Digital Signature Trust Co./CN=DST Root CA X3 | | | | notBefore=Sep 30 21:12:19 2000 GMT | | | | notAfter=Sep 30 14:01:15 2021 GMT | | | +-----------------------------------------------------------+ | \ / ``` </details> <details> <summary>/etc/ssl/certs/DST_Root_CA_X3.crt</summary> Original and expired root CA that should be ignored now ``` subject= /O=Digital Signature Trust Co./CN=DST Root CA X3 issuer= /O=Digital Signature Trust Co./CN=DST Root CA X3 notBefore=Sep 30 21:12:19 2000 GMT notAfter=Sep 30 14:01:15 2021 GMT ``` </details> <details> <summary>/etc/ssl/certs/ISRG_Root_X1.crt</summary> Current valid root CA ``` subject= /C=US/O=Internet Security Research Group/CN=ISRG Root X1 issuer= /C=US/O=Internet Security Research Group/CN=ISRG Root X1 notBefore=Jun 4 11:04:38 2015 GMT notAfter=Jun 4 11:04:38 2035 GMT ``` </details> <details> <summary>/etc/resolver/dns_servers/00_odvr-cznic.conf</summary> kresd DNS forwarding to DoT ODVR servers configuration: ``` name="00_odvr-cznic.conf" description="CZ.NIC (TLS)" enable_tls="1" port="853" ipv4="193.17.47.1 185.43.135.1" ipv6="2001:148f:ffff::1 2001:148f:fffe::1" ca_file="/etc/ssl/certs/ca-certificates.crt" hostname="odvr.nic.cz" ``` </details>
issue