https://btrfs.wiki.kernel.org having OCSP issues?
Firefox is currently giving me OCSP errors for the wiki. Links has no problem, presumably because it doesn't validate the cert or ignores OCSP timeouts, but lynx is throwing errors as well, so it's not just firefox.
Others? What's up?
Signature · 3 lines
Duncan - List replies preferred. No HTML msgs. "Every nonfree program has a lord, a master -- and if you use the program, he is your master." Richard Stallman
Quoted 3 lines · On Mon, 28 Dec 2015 09:20:09 +0000 (UTC) Duncan <[email protected]> wrote:
Firefox is currently giving me OCSP errors for the wiki. Links has no problem, presumably because it doesn't validate the cert or ignores OCSP timeouts, but lynx is throwing errors as well, so it's not just firefox.
Do you get the same problem with https://www.kernel.org/ ?
Or any other wiki listed at https://wiki.kernel.org/ ?
Can you download http://crl.startssl.com/crt2-crl.crl at your machine?
In general this seems to be a kernel.org webmasters concern, not for Btrfs developers to do anything about.
Signature · 2 lines
With respect, Roman
Roman Mamedov posted on Mon, 28 Dec 2015 14:29:43 +0500 as excerpted:
Quoted 9 lines
Quoted 4 lines · On Mon, 28 Dec 2015 09:20:09 +0000 (UTC) Duncan <[email protected]> wrote:
Firefox is currently giving me OCSP errors for the wiki. Links has no problem, presumably because it doesn't validate the cert or ignores OCSP timeouts, but lynx is throwing errors as well, so it's not just firefox.
Do you get the same problem with https://www.kernel.org/ ?
That one works fine.
Quoted 1 line
Or any other wiki listed at https://wiki.kernel.org/ ?
That one doesn't. Same sec_error_ocsp_bad_signature error.
Quoted 1 line
Can you download http://crl.startssl.com/crt2-crl.crl at your machine?
That works fine. But according to wikipedia (where https is working fine, BTW), OCSP was created as an alternative to CRLs.
https://en.wikipedia.org/wiki/Online_Certificate_Status_Protocol
Based on the sequence outlined there and the error firefox is returning, seems the OCSP responder is returning responses that don't verify against its public key. So assuming no MitM attack, it'd be the OCSP responder that's badly configured, not (directly) wiki.kernel.org or its cert.
Quoted 2 lines
In general this seems to be a kernel.org webmasters concern, not for Btrfs developers to do anything about.
Agreed. But bugzilla.kernel.org is failing with the same error, so I can't report the bug there... or even look to see if anyone else has in the hour or two since I started seeing issues. And this is the only vger list I follow, so...
Signature · 3 lines
Duncan - List replies preferred. No HTML msgs. "Every nonfree program has a lord, a master -- and if you use the program, he is your master." Richard Stallman
Duncan posted on Mon, 28 Dec 2015 10:34:49 +0000 as excerpted:
Quoted 4 lines
Quoted 4 lines
Quoted 1 line · On Mon, 28 Dec 2015 09:20:09 +0000 (UTC) Duncan <[email protected]> wrote:
Firefox is currently giving me OCSP errors for the wiki.
Whatever the problem was, it seems to be fixed, now. =:^)
Signature · 3 lines
Duncan - List replies preferred. No HTML msgs. "Every nonfree program has a lord, a master -- and if you use the program, he is your master." Richard Stallman
Quoted 8 lines · Duncan
Duncan posted on Mon, 28 Dec 2015 10:34:49 +0000 as excerpted:
Quoted 4 lines
Quoted 4 lines
Quoted 1 line · On Mon, 28 Dec 2015 09:20:09 +0000 (UTC) Duncan <[email protected]> wrote:
Firefox is currently giving me OCSP errors for the wiki.
Whatever the problem was, it seems to be fixed, now. =:^)
I caught this after the magic fix, but I can always forward to kernel.org admins when other tools are busted. Thanks for sending it along.
-chris