Conversation

Notices

1. Aral Balkan (aral@mastodon.ar.al)'s status on Tuesday, 25-Apr-2023 18:50:01 JST Aral Balkan

   Great, it looks like whatever they changed in Chrome no longer trusts Kitten’s¹ local certificate authority (installed and trusted by the system trust store, as you’d do in a *spit* enterprise).

   Applies to previously trusted and working certificates too.

   (The directly related module is Auto Encrypt Localhost²)

   Going to look into it today and see if I can’t find a workaround.

   FFS…

   ¹ https://codeberg.org/kitten/app
   ² https://codeberg.org/small-tech/auto-encrypt-localhost

   #web #tls #Chrome #Kitten #AutoEncryptLocalhost #SmallWeb

   • Aral Balkan (aral@mastodon.ar.al)'s status on Wednesday, 26-Apr-2023 17:26:07 JST Aral Balkan

     in reply to

     Right, well, first the good news: It doesn’t look like anything has changed in how Chrom(ium) handles certificates installed in the system trust store.

     Now the bad news: I have no idea why the certificate authority that was previously trusted on my main development machine is now showing up as untrusted. Could a Fedora Silverblue update have broken it? Will keep looking into it.

     🤔

     #Kitten #AutoEncryptLocalhost #SmallWeb #Chrome #Chromium #tls #web #dev

   • Aral Balkan (aral@mastodon.ar.al)'s status on Wednesday, 26-Apr-2023 19:17:31 JST Aral Balkan

     in reply to

     • Jan

     @jan Yep, ca-certificates is installed. Going to look into the configuration now :)

   • Jan (jan@toot.io)'s status on Wednesday, 26-Apr-2023 19:17:32 JST Jan

     in reply to

     @aral Is the package ca-certificates installed and linked to /etc/ssl/certs?

   • Aral Balkan (aral@mastodon.ar.al)'s status on Wednesday, 26-Apr-2023 20:13:05 JST Aral Balkan

     in reply to

     • Jan

     @jan Really odd… comparing the machine where it works with the one where it doesn’t:

     - /etc/pki/ca-trust are same on both machines (inc. permissions)

     - /etc/ssl/certs/ca-certificates.crt is symlinked to /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem on both

     - On both, following shows the cert has been added correctly: cat /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem | rg Local

     However, only on the machine that works does this show the cert: trust list --filter=ca-anchors | rg Local

   • Aral Balkan (aral@mastodon.ar.al)'s status on Wednesday, 26-Apr-2023 20:16:47 JST Aral Balkan

     in reply to

     • Jan

     @jan Have done. I wonder if it’s not sticking for some reason. (And, oddly, it _stopped_ working so the CA _was_ trusted before.) Odd.

   • Jan (jan@toot.io)'s status on Wednesday, 26-Apr-2023 20:16:48 JST Jan

     in reply to

     @aral I think you need to execute update-ca-trust or?

   • Aral Balkan (aral@mastodon.ar.al)'s status on Wednesday, 26-Apr-2023 20:19:19 JST Aral Balkan

     in reply to

     • Jan

     @jan (And, weirdly, curl has no trouble connecting using it. Neither does Firefox. It’s just Chrome.)

   • Aral Balkan (aral@mastodon.ar.al)'s status on Wednesday, 26-Apr-2023 20:50:01 JST Aral Balkan

     in reply to

     • Jan

     @jan Yeah, same issue in both. Very odd. But I feel the real issue is with the trust command not returning the cert. Going to look into it further. Thanks for talking it through with me :)

   • Jan (jan@toot.io)'s status on Wednesday, 26-Apr-2023 20:50:02 JST Jan

     in reply to

     @aral Maybe you can try Chromium.

   • Jan (jan@toot.io)'s status on Wednesday, 26-Apr-2023 20:50:03 JST Jan

     in reply to

     @aral Ah ok then some Chrome issue.

   • Aral Balkan (aral@mastodon.ar.al)'s status on Wednesday, 26-Apr-2023 21:37:11 JST Aral Balkan

     in reply to

     So I figured out what the problem is: #Homebrew. Looks like at some point I installed something with brew that installed @python3.11 and @openssl@1.1 – that installed ca-certificates and p11-kit via #brew and those messed up my system trust store. Similar to the issue I had with systemd as it looks like brew installed systemd for something as well.

     (Remember, I’m on #FedoraSilverblue – an immutable OS, so I was trying out Brew as an account-level package manager. Turn out, not a great idea.)

   • Aral Balkan (aral@mastodon.ar.al)'s status on Wednesday, 26-Apr-2023 21:38:01 JST Aral Balkan

     in reply to

     • Jan

     @jan In case you don’t see it: the culprit was… *drumroll* Homebrew 👀

     https://mastodon.ar.al/@aral/110265146490051342

   • screenbeard :Kinoite: (screenbeard@aus.social)'s status on Wednesday, 26-Apr-2023 22:59:30 JST screenbeard :Kinoite:

     in reply to

     @aral every problem I've ever had with Linux has been some variation on "I'll install this thing that looks interesting. Oh, it requires a different version of Python than I have running. Oh, now nothing works and my machine no longer boots".

   • Aral Balkan (aral@mastodon.ar.al)'s status on Wednesday, 26-Apr-2023 22:59:30 JST Aral Balkan

     in reply to

     • screenbeard :Kinoite:

     @screenbeard Hahaha, too true :) Which is a problem I hadn’t had with Silverblue until I decided to mess with brew :)

   • Aral Balkan (aral@mastodon.ar.al)'s status on Thursday, 27-Apr-2023 03:43:12 JST Aral Balkan

     in reply to

     • Kaffeetrinkr

     @kaffeetrinkr Yeah, I’ll be sticking to rust and go CLI apps whenever possible (installed via cargo and go) and, if I need to build something myself, toolbox.

   • Kaffeetrinkr (kaffeetrinkr@nerdculture.de)'s status on Thursday, 27-Apr-2023 03:43:14 JST Kaffeetrinkr

     in reply to

     @aral
     This encourages me to stick with my current approach use toolbox for almost everything.

   • Sebastian (svyaene@techhub.social)'s status on Thursday, 27-Apr-2023 15:06:09 JST Sebastian

     in reply to

     @aral You aren't using Pop!_OS or ElementaryOs anymore?

   • Aral Balkan (aral@mastodon.ar.al)'s status on Thursday, 27-Apr-2023 15:06:09 JST Aral Balkan

     in reply to

     • Sebastian

     @svyaene Nope. Either is a fine choice but I’m very much enjoying the stability and predictability of Silverblue and the experience of vanilla GNOME.