From: PG Bug reporting form <noreply@postgresql.org>
To: pgsql-bugs@lists.postgresql.org
Cc: tschweikle@bfs.de
Subject: BUG #17701: Certificate verification problem when using proxies to access the server
Date: Mon, 28 Nov 2022 15:27:17 +0000
Message-ID: <17701-a8407bcf3b087b02@postgresql.org> (raw)
The following bug has been logged on the website:
Bug reference: 17701
Logged by: Thomas Schweikle
Email address: tschweikle@bfs.de
PostgreSQL version: 15.1
Operating system: Windows 10
Description:
After successfully installed postgersql 15.1 calling stack builder leads to
message:
```
A certification problem was encountered whilst accessing
https://www.postgresql.org/applications-v2.xml
Fauled to connect to www.postgresql.org port 443 after after 64389 ms:
Couldn't connect to server.
This means that the source of the download cannot be verified. It is
recommended [...]
```
It does not matter: whatever you enter for your proxy, whatever variables
you define within the environment you'll have this error. No way out.
Accessing the same using wget, curl or links, lynx works without problems.
No messages about certificate verification problems. If you run wget with
turned on debugging it shows: all ok with the servers certificate. Using
stack builder: same problem again: it's got problems verifying the
certificate.
wget:
```
> wget --debug https://www.postgresql.org/applications-v2.xmlDEBUG output created by Wget 1.21.3 on cygwin.
Reading HSTS entries from /home/sct-muc/.wget-hsts
URI encoding = 'ANSI_X3.4-1968'
converted 'https://www.postgresql.org/applications-v2.xml'; (ANSI_X3.4-1968)
-> 'https://www.postgresql.org/applications-v2.xml'; (UTF-8)
URI encoding = 'ANSI_X3.4-1968'
Converted file name 'applications-v2.xml' (UTF-8) -> 'applications-v2.xml'
(ANSI_X3.4-1968)
--2022-11-28 16:21:23-- https://www.postgresql.org/applications-v2.xml
Certificates loaded: 349
Resolving proxy-**** (proxy-****)... 10.****
Caching proxy-**** => 10.****
Connecting to proxy-**** (proxy-****)|10.****|:8080... connected.
Created socket 3.
Releasing 0x0000000800a4de20 (new refcount 1).
---request begin---
CONNECT www.postgresql.org:443 HTTP/1.1
User-Agent: Wget/1.21.3
Host: www.postgresql.org:443
---request end---
proxy responded with: [HTTP/1.1 200 Connection established
]
---request begin---
GET /applications-v2.xml HTTP/1.1
Host: www.postgresql.org
User-Agent: Wget/1.21.3
Accept: */*
Accept-Encoding: identity
Connection: Keep-Alive
Proxy-Connection: Keep-Alive
---request end---
Proxy request sent, awaiting response...
---response begin---
HTTP/1.1 200 OK
Server: nginx
Date: Mon, 28 Nov 2022 14:01:27 GMT
Content-Type: text/xml; charset=UTF-8
X-Frame-Options: DENY
Content-Security-Policy: default-src 'self' ; img-src * data: ; script-src
'unsafe-eval' 'self' www.google-analytics.com ssl.google-analytics.com
www.googletagmanager.com tagmanager.google.com data: ; connect-src 'self'
www.google-analytics.com ssl.google-analytics.com ; media-src 'self' ;
style-src 'self' fonts.googleapis.com tagmanager.google.com ; font-src
'self' fonts.gstatic.com data: ; frame-ancestors 'none' ; report-uri
https://csp-report.postgresql.org/
X-XSS-Protection: 1; mode=block
Vary: Accept-Encoding
X-Varnish: 17610214 11251526
Age: 4796
Via: 1.1 varnish (Varnish/6.0)
Strict-Transport-Security: max-age=31536000
Accept-Ranges: bytes
Content-Length: 176182
Connection: keep-alive
---response end---
200 OK
Registered socket 3 for persistent reuse.
Parsed Strict-Transport-Security max-age = 31536000, includeSubDomains =
false
Updated HSTS host: www.postgresql.org:443 (max-age: 31536000,
includeSubdomains: false)
URI content encoding = 'UTF-8'
Length: 176182 (172K) [text/xml]
Saving to: 'applications-v2.xml.3'
applications-v2.xml.3
100%[==========================================================>] 172.05K
950KB/s in 0.2s
2022-11-28 16:21:24 (950 KB/s) - 'applications-v2.xml.3' saved
[176182/176182]
Saving HSTS entries to /home/sct-muc/.wget-hsts
```
This bug seems old and seen with PostgreSQL stack builder 12, 13, 14, and
now 15 and 15.1.
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-bugs@postgresql.org
Cc: noreply@postgresql.org, pgsql-bugs@lists.postgresql.org, tschweikle@bfs.de
Subject: Re: BUG #17701: Certificate verification problem when using proxies to access the server
In-Reply-To: <17701-a8407bcf3b087b02@postgresql.org>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox