Hide Forgot
Description of problem: units_cur fails with "error connecting to currency server" Version-Release number of selected component (if applicable): units-2.11-5.fc23.x86_64 How reproducible: always Steps to Reproduce: 1. open a terminal 2. on the commandline run units_cur Actual results: Error connecting to currency server. [Errno socket error] [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:590) Expected results: update of the file /usr/share/units/currency.units Additional info: Has been working fine in the past, except for some warning messages.
units_cur connects http://rss.timegenie.com/forex.xml which now redirects to https://rss.timegenie.com/forex.xml . The server certificate is signed by the Let's Encrypt certificate authority, which does not seem to be trusted on Fedora 23. After adding the CA certificate among trusted roots, units_cur works as expected. I am switching the component to ca-certificates, which maintains roots of trust. Minimal example: $ wget https://rss.timegenie.com/forex.xml --2016-04-04 14:56:47-- https://rss.timegenie.com/forex.xml Resolving rss.timegenie.com (rss.timegenie.com)... 178.63.47.14 Connecting to rss.timegenie.com (rss.timegenie.com)|178.63.47.14|:443... connected. ERROR: cannot verify rss.timegenie.com's certificate, issued by ‘CN=Let's Encrypt Authority X1,O=Let's Encrypt,C=US’: Unable to locally verify the issuer's authority. To connect to rss.timegenie.com insecurely, use `--no-check-certificate'.
I guess this type of error will become increasingly common until Mozilla accepts the LE root. *** This bug has been marked as a duplicate of bug 1294526 ***
I believe this is misconfiguration on their side - they should include the cross-signed intermediated certificate that Let's Encrypt has.
https://letsencrypt.org/certificates/
Also it seems it was already resolved on the server side.