https://bugzilla.novell.com/show_bug.cgi?id=854163 https://bugzilla.novell.com/show_bug.cgi?id=854163#c2 --- Comment #2 from Marcus Meissner 2013-12-06 15:53:12 UTC --- There is a root chain down to verisign on my machine. I think this might be because the site certificate is not allowed to sign TLS/HTTPS traffic, which is now more strictly checked in 13.1. Subject: 1.3.6.1.4.1.311.60.2.1.3=ES/businessCategory=Private Organization/serialNumber=F25014754, C=ES, ST=Lleida, L=GUISSONA, O=CAJA RURAL DE GUISSONA SOCIEDAD COOPERATIVA DE CREDITO, OU=INFORMATICA, OU=Terms of use at www.verisign.com/rpa (c)05, CN=www.caixaguissona.com X509v3 Key Usage: critical Digital Signature, Key Encipherment but no X509v3 Extended Key Usage: amazon.de in comparison has: X509v3 Key Usage: critical Digital Signature, Key Encipherment X509v3 Extended Key Usage: TLS Web Server Authentication, TLS Web Client Authentication Including "TLS Web Server Authentication." -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=854163 https://bugzilla.novell.com/show_bug.cgi?id=854163#c4 --- Comment #4 from Oscar Curero 2013-12-06 20:50:26 UTC --- (In reply to comment #3)

Hmm, this seems incorreect, appaerently I am reading something wrong.

(Firefox is happy, which is a sign something is incorrect somewhere else)

will continue debug this later.

Marcus, I forgot to add two things: 1.- Not all sites have this problem. For example, the one you wrote (https://www.amazon.de) works fine in both versions. 2.- Copying the missing file from another machine still on 12.3 and renaming it has /etc/ssl/certs/415660c1.1 solves the problem for me: oscar@hedera:~> ls -l /etc/ssl/certs/415660c1* lrwxrwxrwx 1 root root 59 dic 6 12:29 /etc/ssl/certs/415660c1.0 -> Verisign_Class_3_Public_Primary_Certification_Authority.pem -rw-r--r-- 1 root root 1003 dic 6 16:09 /etc/ssl/certs/415660c1.1 oscar@hedera:~> curl -v --head https://www.caixaguissona.com * Rebuilt URL to: https://www.caixaguissona.com/ * Adding handle: conn: 0x8085ee8 * Adding handle: send: 0 * Adding handle: recv: 0 * Curl_addHandleToPipeline: length: 1 * - Conn 0 (0x8085ee8) send_pipe: 1, recv_pipe: 0 * About to connect() to www.caixaguissona.com port 443 (#0) * Trying 195.77.119.3... * Connected to www.caixaguissona.com (195.77.119.3) port 443 (#0) * successfully set certificate verify locations: * CAfile: none CApath: /etc/ssl/certs/ * SSLv3, TLS handshake, Client hello (1): * SSLv3, TLS handshake, Server hello (2): * SSLv3, TLS handshake, CERT (11): * SSLv3, TLS handshake, Server finished (14): * SSLv3, TLS handshake, Client key exchange (16): * SSLv3, TLS change cipher, Client hello (1): * SSLv3, TLS handshake, Finished (20): * SSLv3, TLS change cipher, Client hello (1): * SSLv3, TLS handshake, Finished (20): * SSL connection using DES-CBC3-SHA * Server certificate: * subject: 1.3.6.1.4.1.311.60.2.1.3=ES; businessCategory=Private Organization; serialNumber=F25014754; C=ES; ST=Lleida; L=GUISSONA; O=CAJA RURAL DE GUISSONA SOCIEDAD COOPERATIVA DE CREDITO; OU=INFORMATICA; OU=Terms of use at www.verisign.com/rpa (c)05; CN=www.caixaguissona.com * start date: 2013-12-04 00:00:00 GMT * expire date: 2016-02-02 23:59:59 GMT * subjectAltName: www.caixaguissona.com matched * issuer: C=US; O=VeriSign, Inc.; OU=VeriSign Trust Network; OU=Terms of use at https://www.verisign.com/rpa (c)06; CN=VeriSign Class 3 Extended Validation SSL SGC CA * SSL certificate verify ok. Thanks, -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=854163 https://bugzilla.novell.com/show_bug.cgi?id=854163#c6 Ludwig Nussel changed: What |Removed |Added ---------------------------------------------------------------------------- AssignedTo|lnussel@suse.com |meissner@suse.com --- Comment #6 from Ludwig Nussel 2013-12-09 11:03:22 CET --- The problem was that there are some certificates with the same name but signed with different algorithms. When switching to the new certdata2pem.py those name clashes went unnoticed. I've updated the spec file to create different files for certificates with the same name again. Marcus, you updated the ca lists, I suppose this should be a maintenance update? -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=854163 https://bugzilla.novell.com/show_bug.cgi?id=854163#c Swamp Workflow Management changed: What |Removed |Added ---------------------------------------------------------------------------- Status Whiteboard| |obs:running:2339:important -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=854163 https://bugzilla.novell.com/show_bug.cgi?id=854163#c9 --- Comment #9 from Swamp Workflow Management 2013-12-13 14:04:21 UTC --- openSUSE-SU-2013:1870-1: An update that contains security fixes can now be installed. Category: security (important) Bug References: 854163,854367 CVE References: Sources used: openSUSE 11.4 (src): ca-certificates-mozilla-1.95-17.1 -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=854163 https://bugzilla.novell.com/show_bug.cgi?id=854163#c11 Marcus Meissner changed: What |Removed |Added ---------------------------------------------------------------------------- Status|ASSIGNED |RESOLVED Resolution| |FIXED --- Comment #11 from Marcus Meissner 2013-12-16 14:25:30 UTC --- i just released the update ... should be available in around 1 hour. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

http://bugzilla.novell.com/show_bug.cgi?id=854163 Swamp Workflow Management changed: What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|obs:running:2339:important | -- You are receiving this mail because: You are on the CC list for the bug.