Sign in

unable to get local issuer certificate. but the cert is new!

Solvedcertificateshttpstls8 replies · 171 views · started
Reply
Accepted solution by Rhea Mendes — oof most likely the server isnt sending the intermediate certificate. Desktop browsers often fill it in from cache or via AIA fetching,…
  1. Omar Thorne
    @early_rider237

    We renewed teh certificate on our internal API yesterday. On my desktop browser everything looks fine. But Python requests now fails with:

    Your connection is not private

    Your connection is not private
Attackers might be trying to steal your information from portal.example.org
(for example, passwords, messages, or credit cards).
NET::ERR_CERT_DATE_INVALID

    the certificate isnt expired, the name matches... nothing else changed... why would only some clients complain??

    Ive checked the dates, the hostname and the isuser. Everything looks correct when i click the padlock in my browser. Im clearly missing something, but i dont know what tool shows what the client actually receives.

    5
  2. Ivan R.
    @cron_den405

    check the order. some servers send teh intermediate before teh leaf or include an old intermediate from a previous CA. openssl s_client output shows s: (subject) and i: (issuer) for each certificate; each issuer must be the next subject.

    2 0 helpful
  4. Elif Arslan
    @elif.arslan16

    @elif.arslan16 did u ever fix it? ??

    0 2 helpful
  5. Diego Sorensen
    @diego.sorensen

    oof java and Python clients use their own trust stores. Java uses cacerts in the JRE; Python requests uses teh certifi bundle. if teh root is new or private, those stores need updating even when teh OS trusts it.

    6 5 helpful
  7. Rhea Mendes
    @rmendes_45
    Accepted solution

    oof most likely the server isnt sending the intermediate certificate. Desktop browsers often fill it in from cache or via AIA fetching, but many clients (Python requests included) dont. Check what teh server sends:

    openssl s_client -connect host:443 -servername host -showcerts

    If you only see one certificate, the chain is incomplete.

    12 5 helpful
  8. Elif Arslan
    @elif.arslan16
    in reply to @rmendes_45

    i'd add an automated chain check to monitoring. An external TLS scan after every reenwal would have caught this before customers did. just my 2 cents

    2 0 helpful
  9. Omar Thorne
    @early_rider237
    in reply to @rmendes_45

    @rmendes_45 switched nginx to the fullchain file and reloaded. s_client shows the full chain and teh internal API works everywhere. u guys are the best!!!

    6 0 helpful

Reply to this topic

Sign in or create an account to reply.