Fedora Account System
Red Hat Associate
Red Hat Customer
When trying to build some packages for rpmfusion using plague-client I get the following error: OpenSSL.SSL.Error: [('asn1 encoding routines', 'ASN1_item_verify', 'unknown message digest algorithm'), ('SSL routines', 'SSL3_GET_SERVER_CERTIFICATE', 'certificate verify failed')] Since things work in F-20 I started with downgrading my openssl packages to: openssl-1.0.1e-37.fc21.x86_64.rpm openssl-devel-1.0.1e-37.fc21.x86_64.rpm openssl-libs-1.0.1e-37.fc21.i686.rpm openssl-libs-1.0.1e-37.fc21.x86_64.rpm Which are the rawhide equivalent of the latest pkgs in F-20, which do work. Downgrading to these versions did *not* fix my issues. However downgrading to: openssl-1.0.1e-37.fc20.x86_64.rpm openssl-devel-1.0.1e-37.fc20.x86_64.rpm openssl-libs-1.0.1e-37.fc20.i686.rpm openssl-libs-1.0.1e-37.fc20.x86_64.rpm Does fix my issue, so it seems that something in the rawhide build-root causes openssl in rawhide to miss support for certain mda-s. The server using the troublesome cert can be found here: https://buildsys.rpmfusion.org:8887
OpenSSL in Rawhide does not support MD5 signatures in certificates as these possess significant security risk.
For those like me who also spent a lot of time with messing with RPM Fusion's MD5 signatures in certificates: "OPENSSL_ENABLE_MD5_VERIFY=1 make build"
It can also be worked around on runtime: OPENSSL_ENABLE_MD5_VERIFY=1 openssl verify -CAfile ca.crt my.crt I guess that should go to the f21 faq and have a prominent place in the upgrade notes. I have however not found a way to apply that when I am on the openvpn client side and only have a md5 cert that my client side refuse to send to the server.