certificate verify failed when creating jail or reporting a bug

Description

I am unable to create a new jail or report a bug from the UI, it throws this error

HTTPSConnectionPool(host='www.freebsd.org', port=443): Max retries exceeded with url: /security/unsupported.html (Caused by SSLError(SSLError("bad handshake: Error([('SSL routines', 'ssl3_get_server_certificate', 'certificate verify failed')])")))

Error: Traceback (most recent call last):
File "/usr/local/lib/python3.7/site-packages/urllib3/contrib/pyopenssl.py", line 485, in wrap_socket
cnx.do_handshake()
File "/usr/local/lib/python3.7/site-packages/OpenSSL/SSL.py", line 1915, in do_handshake
self._raise_ssl_error(self._ssl, result)
File "/usr/local/lib/python3.7/site-packages/OpenSSL/SSL.py", line 1647, in _raise_ssl_error
_raise_current_error()
File "/usr/local/lib/python3.7/site-packages/OpenSSL/_util.py", line 54, in exception_from_error_queue
raise exception_type(errors)
OpenSSL.SSL.Error: [('SSL routines', 'ssl3_get_server_certificate', 'certificate verify failed')]

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
File "/usr/local/lib/python3.7/site-packages/urllib3/connectionpool.py", line 672, in urlopen
chunked=chunked,
File "/usr/local/lib/python3.7/site-packages/urllib3/connectionpool.py", line 376, in _make_request
self._validate_conn(conn)
File "/usr/local/lib/python3.7/site-packages/urllib3/connectionpool.py", line 994, in _validate_conn
conn.connect()
File "/usr/local/lib/python3.7/site-packages/urllib3/connection.py", line 394, in connect
ssl_context=context,
File "/usr/local/lib/python3.7/site-packages/urllib3/util/ssl_.py", line 370, in ssl_wrap_socket
return context.wrap_socket(sock, server_hostname=server_hostname)
File "/usr/local/lib/python3.7/site-packages/urllib3/contrib/pyopenssl.py", line 491, in wrap_socket
raise ssl.SSLError("bad handshake: %r" % e)
ssl.SSLError: ("bad handshake: Error([('SSL routines', 'ssl3_get_server_certificate', 'certificate verify failed')])",)

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
File "/usr/local/lib/python3.7/site-packages/requests/adapters.py", line 449, in send
timeout=timeout
File "/usr/local/lib/python3.7/site-packages/urllib3/connectionpool.py", line 720, in urlopen
method, url, error=e, _pool=self, _stacktrace=sys.exc_info()[2]
File "/usr/local/lib/python3.7/site-packages/urllib3/util/retry.py", line 436, in increment
raise MaxRetryError(_pool, url, error or ResponseError(cause))
urllib3.exceptions.MaxRetryError: HTTPSConnectionPool(host='www.freebsd.org', port=443): Max retries exceeded with url: /security/unsupported.html (Caused by SSLError(SSLError("bad handshake: Error([('SSL routines', 'ssl3_get_server_certificate', 'certificate verify failed')])")))

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
File "/usr/local/lib/python3.7/site-packages/middlewared/main.py", line 130, in call_method
io_thread=False)
File "/usr/local/lib/python3.7/site-packages/middlewared/main.py", line 1098, in _call
return await run_method(methodobj, *args)
File "/usr/local/lib/python3.7/site-packages/middlewared/main.py", line 1022, in _run_in_conn_threadpool
return await self.run_in_executor(self.__ws_threadpool, method, *args, **kwargs)
File "/usr/local/lib/python3.7/site-packages/middlewared/main.py", line 1010, in run_in_executor
return await loop.run_in_executor(pool, functools.partial(method, *args, **kwargs))
File "/usr/local/lib/python3.7/concurrent/futures/thread.py", line 57, in run
result = self.fn(*self.args, **self.kwargs)
File "/usr/local/lib/python3.7/site-packages/middlewared/schema.py", line 965, in nf
return f(*args, **kwargs)
File "/usr/local/lib/python3.7/site-packages/middlewared/plugins/jail.py", line 674, in releases_choices
choices = {str(k): str(k) for k in ListableReleases(remote=remote)}
File "/usr/local/lib/python3.7/site-packages/iocage_lib/release.py", line 46, in _init_
self.eol_list = IOCFetch._fetch_eol_check_()
File "/usr/local/lib/python3.7/site-packages/iocage_lib/ioc_fetch.py", line 114, in _fetch_eol_check_
req = requests.get(_eol)
File "/usr/local/lib/python3.7/site-packages/requests/api.py", line 75, in get
return request('get', url, params=params, **kwargs)
File "/usr/local/lib/python3.7/site-packages/requests/api.py", line 60, in request
return session.request(method=method, url=url, **kwargs)
File "/usr/local/lib/python3.7/site-packages/requests/sessions.py", line 533, in request
resp = self.send(prep, **send_kwargs)
File "/usr/local/lib/python3.7/site-packages/raven/breadcrumbs.py", line 341, in send
resp = real_send(self, request, *args, **kwargs)
File "/usr/local/lib/python3.7/site-packages/requests/sessions.py", line 646, in send
r = adapter.send(request, **kwargs)
File "/usr/local/lib/python3.7/site-packages/requests/adapters.py", line 514, in send
raise SSLError(e, request=request)
requests.exceptions.SSLError: HTTPSConnectionPool(host='www.freebsd.org', port=443): Max retries exceeded with url: /security/unsupported.html (Caused by SSLError(SSLError("bad handshake: Error([('SSL routines', 'ssl3_get_server_certificate', 'certificate verify failed')])")))

This probably has to do with the expiration of the Lets encrypt root cert but when I checked I seem to have both the old expired cert and the new one.

root@freenas:~ # cat /usr/local/openssl/cert.pem | grep "ISRG Root X1"
Issuer: C=US, O=Internet Security Research Group, CN=ISRG Root X1
Subject: C=US, O=Internet Security Research Group, CN=ISRG Root X1
root@freenas:~ # cat /usr/local/openssl/cert.pem | grep "DST Root CA X3"
Issuer: O=Digital Signature Trust Co., CN=DST Root CA X3
Subject: O=Digital Signature Trust Co., CN=DST Root CA X3

Problem/Justification

None

Impact

None

Activity

iX-Tony 
December 14, 2021 at 2:13 PM

Thank you for the report! Unfortunately, 11.3 has reached its end of life (EOL) and is no longer supported. The community forums are available for help with unsupported versions: https://www.truenas.com/community/.

SK 
October 5, 2021 at 11:39 AM

Looking deeper into this, it seems to stem from this https://www.openssl.org/blog/blog/2021/09/13/LetsEncryptRootCertExpire/ ,

 

root@freenas:~ # python -m OpenSSL.debug
pyOpenSSL: 19.0.0
cryptography: 2.6.1
cffi: 1.12.3
cryptography's compiled against OpenSSL: OpenSSL 1.0.2s-freebsd 28 May 2019cryptography's linked OpenSSL: OpenSSL 1.0.2s-freebsd 28 May 2019
Pythons's OpenSSL: OpenSSL 1.0.2s-freebsd 28 May 2019Python executable: /usr/local/bin/python
Python version: 3.7.5 (default, Jul 28 2020, 15:37:33)
[Clang 8.0.0 (tags/RELEASE_800/final 356365)]
Platform: freebsd11
sys.path: ['/root', '/usr/local/lib/python37.zip', '/usr/local/lib/python3.7', '
/usr/local/lib/python3.7/lib-dynload', '/usr/local/lib/python3.7/site-packages']
root@freenas:~ #

Third Party to Resolve

Details

Assignee

Reporter

Labels

Impact

Components

Fix versions

Affects versions

Priority

More fields

Katalon Platform

Created October 5, 2021 at 7:21 AM
Updated July 6, 2022 at 8:57 PM
Resolved December 14, 2021 at 2:14 PM