public inbox for [email protected]  

help / color / mirror / Atom feed

From: Stefan Huehner <[email protected]>
To: [email protected]
Subject: apt.postgresql.org repo via https will fail will some users starting 2021-10-01
Date: Wed, 8 Sep 2021 16:48:06 +0000
Message-ID: <[email protected]> (raw)

Hello,

sending this here as looks like https://apt.postgresql.org is affected by this so this could trigger some support/user questions.

Note this only (!) happens when using https:// in sources.list for the pgdg repo.

Benefit of that is debatable (see recent debian-devel discussion) but i would not be surprised if some/many people use it.

Trigger:
https://community.letsencrypt.org/t/openssl-client-compatibility-changes-for-let-s-encrypt-certifica...

End of this month some CA cert will expire related to Let's Encrypt which will trigger an bug in clients using old openssl/gnutls.

apt is using gnutls backend and at least the version in Ubuntu <= 18.04 are affected and "apt update" will already fail for people starting that date.

Note that canonical is working in patching gnutls so if that finishes in time and (!) if people update before that date all good.

If not they will get error similar to:
Err:9 https://apt.postgresql.org/pub/repos/apt focal-pgdg Release               
  Certificate verification failed: The certificate is NOT trusted. The revocation or OCSP data are old and have been superseded. The certificate chain uses expired certificate.  Could not handshake: Error in the certificate verification. [IP: 87.238.57.227 443]

Can be triggered today i.e. with:

faketime "2021-10-01" apt update

Ideas:
- Do nothing apt.postgresql suggest http:// in the instructions
- Some on the website
- Think on reconfiguring certbot/Let's Encrypt on the server to switch to the alternative chain (avoiding this bug but breaking compatibility with old Android

- Raise as bug to debian also (against openssl/gnutls) to maybe patch both in stable also to avoid this ?
  - Not sure if that is a interesting/acceptable material for stable/old-stable?

Please CC me on replies i'm not on the list

Stefan

view thread (8+ messages)  latest in thread

reply

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Reply to all the recipients using the --to and --cc options:
  reply via email

  To: [email protected]
  Cc: [email protected]
  Subject: Re: apt.postgresql.org repo via https will fail will some users starting 2021-10-01
  In-Reply-To: <[email protected]>

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

This inbox is served by agora; see mirroring instructions
for how to clone and mirror all data and code used for this inbox