Bug 1323510

Summary:	units_cur: ssl certificate verify fails
Product:	[Fedora] Fedora	Reporter:	Martin Tarenskeen <m.tarenskeen>
Component:	ca-certificates	Assignee:	Kai Engert (:kaie) (inactive account) <kengert>
Status:	CLOSED DUPLICATE	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	medium	Docs Contact:
Priority:	unspecified
Version:	23	CC:	jorton, kdudka, kengert, pwouters, tmraz
Target Milestone:	---
Target Release:	---
Hardware:	x86_64
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2016-04-05 13:21:49 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:

Description Martin Tarenskeen 2016-04-03 19:32:56 UTC

Description of problem:
units_cur fails with "error connecting to currency server"


Version-Release number of selected component (if applicable):
units-2.11-5.fc23.x86_64


How reproducible:
always

Steps to Reproduce:
1. open a terminal
2. on the commandline run units_cur

Actual results:
Error connecting to currency server. [Errno socket error] [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:590)

Expected results:
update of the file /usr/share/units/currency.units

Additional info:
Has been working fine in the past, except for some warning messages.

Comment 1 Kamil Dudka 2016-04-04 13:06:33 UTC

units_cur connects http://rss.timegenie.com/forex.xml which now redirects to https://rss.timegenie.com/forex.xml .  The server certificate is signed by the Let's Encrypt certificate authority, which does not seem to be trusted on Fedora 23.  After adding the CA certificate among trusted roots, units_cur works as expected.

I am switching the component to ca-certificates, which maintains roots of trust.

Minimal example:

$ wget https://rss.timegenie.com/forex.xml
--2016-04-04 14:56:47--  https://rss.timegenie.com/forex.xml
Resolving rss.timegenie.com (rss.timegenie.com)... 178.63.47.14
Connecting to rss.timegenie.com (rss.timegenie.com)|178.63.47.14|:443... connected.
ERROR: cannot verify rss.timegenie.com's certificate, issued by ‘CN=Let's Encrypt Authority X1,O=Let's Encrypt,C=US’:
  Unable to locally verify the issuer's authority.
To connect to rss.timegenie.com insecurely, use `--no-check-certificate'.

Comment 2 Joe Orton 2016-04-05 13:21:49 UTC

I guess this type of error will become increasingly common until Mozilla accepts the LE root.

*** This bug has been marked as a duplicate of bug 1294526 ***

Comment 3 Tomas Mraz 2016-04-05 13:38:36 UTC

I believe this is misconfiguration on their side - they should include the cross-signed intermediated certificate that Let's Encrypt has.

Comment 4 Tomas Mraz 2016-04-05 13:41:00 UTC

https://letsencrypt.org/certificates/

Comment 5 Tomas Mraz 2016-04-05 13:43:46 UTC

Also it seems it was already resolved on the server side.