[heroes] pontifex - daily fetch of routeviews disabled? - Heroes - openSUSE Mailing Lists

newer
[heroes] Re: ** RECOVERY Service...

[heroes] pontifex - daily fetch of routeviews disabled?

older
[heroes] bit of a mirror tidy up

Per Jessen

24 Jan 2020 24 Jan '20

09:13

I see the daily fetch from mirrorbrain was stopped, last one was 10/1 - I presume because of the certificate problem? I was just wondering. -- Per Jessen, Zürich (-0.1°C) Member, openSUSE Heroes -- To unsubscribe, e-mail: heroes+unsubscribe@opensuse.org To contact the owner, e-mail: heroes+owner@opensuse.org

Reply

Sign in to reply online Use email software

Show replies by date

Per Jessen

24 Jan 24 Jan

09:32

Per Jessen wrote:

I see the daily fetch from mirrorbrain was stopped, last one was 10/1 - I presume because of the certificate problem?

I was just wondering.

I opened a ticket about 3 weeks ago, but I don't remember disabling the cron-job: https://progress.opensuse.org/issues/61789 -- Per Jessen, Zürich (1.0°C) Member, openSUSE Heroes -- To unsubscribe, e-mail: heroes+unsubscribe@opensuse.org To contact the owner, e-mail: heroes+owner@opensuse.org

Reply

Sign in to reply online Use email software

Per Jessen

10:55

Per Jessen wrote:

Per Jessen wrote:

...
I see the daily fetch from mirrorbrain was stopped, last one was 10/1 - I presume because of the certificate problem?

I was just wondering.

I opened a ticket about 3 weeks ago, but I don't remember disabling the cron-job:

https://progress.opensuse.org/issues/61789

I have installed the Lets Encrcypt X3 cross-signed CA - I don't know why the DST CA does not work, but it doesn't. Is anyone else working on the mirror setup right now? I can tell the cron table was modified on Jan 10, at 0352. I very rarely have reason to be that late/early :-) I'll ask on IRC too. -- Per Jessen, Zürich (0.9°C) Member, openSUSE Heroes -- To unsubscribe, e-mail: heroes+unsubscribe@opensuse.org To contact the owner, e-mail: heroes+owner@opensuse.org

Reply

Sign in to reply online Use email software

Michael Ströder

18:45

On 1/24/20 11:55 AM, Per Jessen wrote:

Per Jessen wrote:

...
Per Jessen wrote:

...
I see the daily fetch from mirrorbrain was stopped, last one was 10/1 - I presume because of the certificate problem?

I was just wondering.

I opened a ticket about 3 weeks ago, but I don't remember disabling the cron-job:

https://progress.opensuse.org/issues/61789

I have installed the Lets Encrcypt X3 cross-signed CA - I don't know why the DST CA does not work, but it doesn't.

Is anyone else working on the mirror setup right now? I can tell the cron table was modified on Jan 10, at 0352. I very rarely have reason to be that late/early :-)

I'll ask on IRC too.

It's still a problem? https://mirrorbrain.org is clearly misconfigured: It lacks to send the intermediate CA cert needed by the TLS client to build the CA cert chain up to pre-installed root cert. You can check that with $ openssl s_client -connect mirrorbrain.org:443 -showcerts CONNECTED(00000003) depth=0 CN = mirrorbrain.org verify error:num=20:unable to get local issuer certificate verify return:1 depth=0 CN = mirrorbrain.org verify error:num=21:unable to verify the first certificate verify return:1 --- Certificate chain 0 s:CN = mirrorbrain.org i:C = US, O = Let's Encrypt, CN = Let's Encrypt Authority X3 You can use a PEM file containing the CA cert chain downloaded and concatenated like this: $ wget -O - https://letsencrypt.org/certs/letsencryptauthorityx3.pem.txt

letsencrypt-chain.crt

$ wget -O - https://letsencrypt.org/certs/isrgrootx1.pem.txt >> letsencrypt-chain.crt Check again with explicitly providing the PEM file with CA cert chain: $ openssl s_client -connect mirrorbrain.org:443 -showcerts -CAfile letsencrypt-chain.crt It's ok if the output ends with "Verify return code: 0 (ok)" Ciao, Michael. -- To unsubscribe, e-mail: heroes+unsubscribe@opensuse.org To contact the owner, e-mail: heroes+owner@opensuse.org

Reply

Sign in to reply online Use email software

Per Jessen

25 Jan 25 Jan

09:43

Michael Strc3b6der wrote:

On 1/24/20 11:55 AM, Per Jessen wrote:

...
Per Jessen wrote:

...
Per Jessen wrote:

...
I see the daily fetch from mirrorbrain was stopped, last one was 10/1 - I presume because of the certificate problem?

I was just wondering.

I opened a ticket about 3 weeks ago, but I don't remember disabling the cron-job:

https://progress.opensuse.org/issues/61789

I have installed the Lets Encrcypt X3 cross-signed CA - I don't know why the DST CA does not work, but it doesn't.

Is anyone else working on the mirror setup right now? I can tell the cron table was modified on Jan 10, at 0352. I very rarely have reason to be that late/early :-)

I'll ask on IRC too.

It's still a problem?

No, I installed the LE X3 cross-signed CA and it's working.

https://mirrorbrain.org is clearly misconfigured: It lacks to send the intermediate CA cert needed by the TLS client to build the CA cert chain up to pre-installed root cert. [snip]

Ciao, Michael.

Thanks for explaining that - I was loosing my last hair trying to figure it out. -- Per Jessen, Zürich (1.6°C) Member, openSUSE Heroes -- To unsubscribe, e-mail: heroes+unsubscribe@opensuse.org To contact the owner, e-mail: heroes+owner@opensuse.org

Reply

Sign in to reply online Use email software

Lars Vogdt

18:03

Am January 24, 2020 9:13:07 AM UTC schrieb Per Jessen :

I see the daily fetch from mirrorbrain was stopped, last one was 10/1 - I presume because of the certificate problem?

I was just wondering.

That was probably me, sorry. The mirror setup (pontifex, mirrordb*, provo-mirror, ...) is currently very noisy on admin-auto. As the job had a known problem, I disabled it. Sorry for not notifying you in advance. I was just doing this while debugging something else - and forgot about this later... :-( Lars -- To unsubscribe, e-mail: heroes+unsubscribe@opensuse.org To contact the owner, e-mail: heroes+owner@opensuse.org

Reply

Sign in to reply online Use email software

Per Jessen

18:59

Lars Vogdt wrote:

Am January 24, 2020 9:13:07 AM UTC schrieb Per Jessen :

...
I see the daily fetch from mirrorbrain was stopped, last one was 10/1 - I presume because of the certificate problem?

I was just wondering.

That was probably me, sorry. The mirror setup (pontifex, mirrordb*, provo-mirror, ...) is currently very noisy on admin-auto. As the job had a known problem, I disabled it.

Sorry for not notifying you in advance. I was just doing this while debugging something else - and forgot about this later... :-(

No big deal, I just couldn't remember if I'd done it myself :-) In fact, it was probably a Good Thing(R) because it made me look at tha routeviews process - only to find out it hasn't been working for a while :-( -- Per Jessen, Zürich (0.2°C) Member, openSUSE Heroes -- To unsubscribe, e-mail: heroes+unsubscribe@opensuse.org To contact the owner, e-mail: heroes+owner@opensuse.org

Reply

Sign in to reply online Use email software

Lars Vogdt

26 Jan 26 Jan

11:23

Am January 25, 2020 6:59:10 PM UTC schrieb Per Jessen :

No big deal, I just couldn't remember if I'd done it myself :-)

Thanks for your understanding. I'm still sorry for this, especially as I'm currently still concentrating on other things that are not related to the mirroring. There is a lot of movement in many areas - and I tend to forget to write down what happened at the end of my (evening ;-) activities. But I hope not to forget too much, when I send the next "work reports" to this list in a few days. Regards, Lars -- To unsubscribe, e-mail: heroes+unsubscribe@opensuse.org To contact the owner, e-mail: heroes+owner@opensuse.org

Reply

Sign in to reply online Use email software

1561

Age (days ago)

1563

Last active (days ago)

Download

7 comments

3 participants

tags

participants (3)

Lars Vogdt
Michael Ströder
Per Jessen