https://dyn.dns.he.net bad certificate?

an0nym · December 26, 2015, 02:06:39 PM

Hi

Since December 25 +- several days certificate of https://dyn.dns.he.net is no longer recognized as valid.

ddclient says

Quotecannot connect to dyn.dns.he.net:443 socket: SSL connect attempt failed error:14090086:SSL routines:ssl3_get_server_certificate:certificate verify failed SSL connect attempt failed error:14090086:SSL routines:ssl3_get_server_certificate:certificate verify failed

curl says

Quote* Server certificate:
*    subject: CN=dyn.dns.he.net
*    start date: Dec 23 18:48:32 2015 GMT
*    expire date: Dec 22 18:48:32 2017 GMT
*    common name: dyn.dns.he.net
*    issuer: CN=CAcert Class 3 Root,OU=http://www.cacert.org,O=CAcert Inc.
* NSS error -8179 (SEC_ERROR_UNKNOWN_ISSUER)
* Peer's Certificate issuer is not recognized.

openssl says

Quote$ openssl s_client -showcerts -host dyn.dns.he.net -port 443 </dev/null | openssl x509 -outform PEM
depth=0 CN = dyn.dns.he.net
verify error:num=20:unable to get local issuer certificate
verify return:1
depth=0 CN = dyn.dns.he.net
verify error:num=21:unable to verify the first certificate
verify return:1
DONE

Manually trusting the certificate does not help (Fedora 23)

Quoteopenssl s_client -showcerts -host dyn.dns.he.net -port 443 </dev/null | openssl x509 -outform PEM >/etc/pki/ca-trust/source/anchors/dyn.dns.he.net.pem
update-ca-trust extract

I've done it for the previous certificate and it worked. Now it doesn't.

It seems new certificate has been issued on December 23. Has it been setup right?

Could you help me make ddclient work again over ssl?

lordvader · December 29, 2015, 10:47:15 AM

I think it's impossible to use self-signed certificate to establish secure connection since they have renewed the certificate.
I can only avoid this problem by using parameter --inscure (or -k) with curl.

Why don't HE.net use authorized certificate on the dynamic DNS updater server?
Have no idea why they only use self-signed certificate on it.

an0nym · December 29, 2015, 11:31:28 AM

At the moment the certificate is not self signed. It is signed by authority not trusted anymore. (Not that it makes big difference.)

The problem is for some reason one cannot force trust it now. It worked prior to reissue on December 23. Now it does not.

lordvader · January 02, 2016, 05:35:04 AM

I just dumped the root cert that I couldn't dump before from dyn.dns.he.net.
Now, I can update my DDNS records in secure connection with it.
If anyone want to dump the cert by self, use openssl with option "-showcerts".
Or download it from cacert.org (Class 1 PKI Key).

Supposing HE.net has updated it with cacert.org signed, Thanks a lot!!
And Happy New Year to everyone read this thread ;p

Code Select

News:

https://dyn.dns.he.net bad certificate?

an0nym

lordvader

an0nym

lordvader