install local certificate

[kp]

hello,

 how do i install local certificate on picore?
# openssl s_client  -connect <server:port>
shows me a problem that localhost could not send across a cert.
i see that /tmp/tcloop/openssl/etc/ssl/certs is read-only. so how to setup a cert and env parameters so that openssl uses it correctly?

[Juanito]

You should be able to write in /etc/ssl/certs, no?

[kp]

yes but it is not picking from there. Pl try
# openssl s_client -conect <some server>

to see the problem for yourself. if you have a procedure to get it working for a fresh installation of picore, pl let me know.

thanks

[Juanito]

It's difficult to troubleshoot if you don't supply the error message.

If the problem is trying to write to /tmp/tcloop/openssl/etc/ssl/certs, then you could use copy2fs to load openssl.

[Paul_123]

Need version of piCore as well.

[kp]

picore   10.0 beta 5. error message is :-

No Client CA names sent
...
Verification error: Unable to get local issuer certs

[Paul_123]

Openssl is built with /etc/ssl location for certs.   I've had no issues accessing https sites with piCore 10.x.   What is the server you are trying to access? have you checked the actual site certificate?

https://www.openssl.org/docs/manmaster/man1/verify.html

[Paul_123]

Actually, now that I'm home.   I see some package configuration errors.   Certs are contained in ca-certificates.tcz, and located in /usr/local/etc/ssl/certs,  whereas openssl is configured for /etc/ssl.

ca-certificates.tcz is a copy from the 9.x repo, and needs regenerated against the latest openssl.

I'll work on this over the weekend and submit the corrected extensions.

[kp]

when/how can i get an update to resolve this issue?

[Paul_123]

I've rebuild ca-certificates, just needs to be posted to the repo.

[kp]

tce-load -wi ca-certificates
says it is already installed and doing a tae-remove doesn't remove the existing one. so, when you update the repo, pl tell me how to update it at my end.

[Juanito]

updated ca-certificates posted to piCore 10.x repos

[Rich]

Hi kp
Try:

Code: [Select]

tce-audit builddb
tce-audit updatedeps
tce-audit fetchmissing
tce-updateThen reboot.