Fedora Account System
Red Hat Associate
Red Hat Customer
After upgrading to nss-3.12.5-7.fc12.x86_64 in updates-testing, fedora-packager-setup no longer works. It seems if 'setup-nsssysinit.sh on' it no longer works. Turning that off makes it work. Here's curl output from each case: setup-nsssysinit.sh off: ohm(kevin)[~] curl -svo/dev/null --cacert $HOME/.fedora-upload-ca.cert --cert $HOME/.fedora.cert https://koji.fedoraproject.org * About to connect() to koji.fedoraproject.org port 443 (#0) * Trying 209.132.181.7... connected * Connected to koji.fedoraproject.org (209.132.181.7) port 443 (#0) * Initializing NSS with certpath: /etc/pki/nssdb * CAfile: /home/kevin/.fedora-upload-ca.cert CApath: none * NSS: client certificate: PEM Token #1:.fedora.cert * subject: E=kevin,CN=kevin,OU=Fedora User Cert,O=Fedora Project,ST=North Carolina,C=US * start date: Aug 19 16:11:20 2009 GMT * expire date: Feb 15 16:11:20 2010 GMT * common name: kevin * issuer: E=admin,CN=Fedora Project CA,OU=Fedora Project CA,O=Fedora Project,L=Raleigh,ST=North Carolina,C=US * SSL connection using TLS_DHE_RSA_WITH_AES_256_CBC_SHA * Server certificate: * subject: E=buildsys,CN=koji.fedoraproject.org,OU=Buildsys,O=Fedora Project,ST=North Carolina,C=US * start date: Aug 20 15:17:06 2008 GMT * expire date: Aug 18 15:17:06 2018 GMT * common name: koji.fedoraproject.org * issuer: E=admin,CN=Fedora Project CA,OU=Fedora Project CA,O=Fedora Project,L=Raleigh,ST=North Carolina,C=US > GET / HTTP/1.1 > User-Agent: curl/7.19.7 (x86_64-redhat-linux-gnu) libcurl/7.19.7 NSS/3.12.4.5 zlib/1.2.3 libidn/1.9 libssh2/1.2 > Host: koji.fedoraproject.org > Accept: */* > < HTTP/1.1 302 Found < Date: Fri, 22 Jan 2010 17:55:29 GMT < Server: Apache/2.2.3 (Red Hat) < Location: https://koji.fedoraproject.org/koji < Content-Length: 308 < Connection: close < Content-Type: text/html; charset=iso-8859-1 < { [data not shown] * Closing connection #0 setup-nsssysinit.sh on: ohm(kevin)[~] curl -svo/dev/null --cacert $HOME/.fedora-upload-ca.cert --cert $HOME/.fedora.cert https://koji.fedoraproject.org * About to connect() to koji.fedoraproject.org port 443 (#0) * Trying 209.132.181.7... connected * Connected to koji.fedoraproject.org (209.132.181.7) port 443 (#0) * Initializing NSS with certpath: /etc/pki/nssdb * CAfile: /home/kevin/.fedora-upload-ca.cert CApath: none * Bad certificate received. Subject = 'E=buildsys,CN=koji.fedoraproject.org,OU=Buildsys,O=Fedora Project,ST=North Carolina,C=US', Issuer = 'E=admin,CN=Fedora Project CA,OU=Fedora Project CA,O=Fedora Project,L=Raleigh,ST=North Carolina,C=US' * NSS error -8182 * Closing connection #0 * Peer certificate cannot be authenticated with known CA certificates I'm not sure where it defaulted to on, but this broke with the nss update. Happy to provide more info, etc.
The reproducer from comment #0 does not seem to be the simplest one. I am able to achieve the same result with the following command: $ curl -sv https://bugzilla.redhat.com * About to connect() to bugzilla.redhat.com port 443 (#0) * Trying 10.4.127.4... connected * Connected to bugzilla.redhat.com (10.4.127.4) port 443 (#0) * Initializing NSS with certpath: /etc/pki/nssdb * CAfile: /etc/pki/tls/certs/ca-bundle.crt CApath: none * Bad certificate received. Subject = 'CN=bugzilla.redhat.com,OU=Information Systems,O=Red Hat Inc,L=Raleigh,ST=North Carolina,C=US', Issuer = 'OU=Equifax Secure Certificate Authority,O=Equifax,C=US' * NSS error -8182 * Closing connection #0 * Peer certificate cannot be authenticated with known CA certificates It looks exactly like bug 545779, what actually means the bug has been not fixed by the update. Therefore I am closing it as duplicate to keep the patches etc. at one place for the next iteration. *** This bug has been marked as a duplicate of bug 545779 ***