Dotaz: letsencrypt SSL: CERTIFICATE_VERIFY_FAILED

[jiri.one]

Používám normálně debian stable, zkoušel jsem standardní verzi ze stable repozitářů, verzi přímo z gitu, verzi z testingu a vždy to stejné:

cat /var/log/letsencrypt/letsencrypt.log
2012-01-01 00:43:04,898:DEBUG:letsencrypt.cli:Root logging level set at 30
2012-01-01 00:43:04,901:INFO:letsencrypt.cli:Saving debug log to /var/log/letsencrypt/letsencrypt.log
2012-01-01 00:43:04,904:DEBUG:letsencrypt.cli:letsencrypt version: 0.4.1
2012-01-01 00:43:04,904:DEBUG:letsencrypt.cli:Arguments: ['-d', 'klerik.cz', '--manual']
2012-01-01 00:43:04,906:DEBUG:letsencrypt.cli:Discovered plugins: PluginsRegistry(PluginEntryPoint#webroot,PluginEntryPoint#null,PluginEntryPoint#manual,PluginEntryPoint#standalone)
2012-01-01 00:43:04,919:DEBUG:letsencrypt.cli:Requested authenticator manual and installer None
2012-01-01 00:43:04,921:DEBUG:letsencrypt.display.ops:Single candidate plugin: * manual
Description: Manually configure an HTTP server
Interfaces: IAuthenticator, IPlugin
Entry point: manual = letsencrypt.plugins.manual:Authenticator
Initialized: letsencrypt.plugins.manual.Authenticator object at 0x7f0f4c0ad850
Prep: True
2012-01-01 00:43:04,924:DEBUG:letsencrypt.cli:Selected authenticator letsencrypt.plugins.manual.Authenticator object at 0x7f0f4c0ad850 and installer None
2012-01-01 00:43:09,316:DEBUG:root:Sending GET request to https://acme-v01.api.letsencrypt.org/directory. args: (), kwargs: {}
2012-01-01 00:43:09,368:INFO:requests.packages.urllib3.connectionpool:Starting new HTTPS connection (1): acme-v01.api.letsencrypt.org
2012-01-01 00:43:09,564:DEBUG:letsencrypt.cli:Exiting abnormally:
Traceback (most recent call last):
  File "/usr/bin/letsencrypt", line 9, in module
    load_entry_point('letsencrypt==0.4.1', 'console_scripts', 'letsencrypt')()
  File "/usr/lib/python2.7/dist-packages/letsencrypt/cli.py", line 1986, in main
    return config.func(config, plugins)
  File "/usr/lib/python2.7/dist-packages/letsencrypt/cli.py", line 689, in obtain_cert
    le_client = _init_le_client(config, authenticator, installer)
  File "/usr/lib/python2.7/dist-packages/letsencrypt/cli.py", line 206, in _init_le_client
    acc, acme = _determine_account(config)
  File "/usr/lib/python2.7/dist-packages/letsencrypt/cli.py", line 191, in _determine_account
    config, account_storage, tos_cb=_tos_cb)
  File "/usr/lib/python2.7/dist-packages/letsencrypt/client.py", line 116, in register
    acme = acme_from_config_key(config, key)
  File "/usr/lib/python2.7/dist-packages/letsencrypt/client.py", line 41, in acme_from_config_key
    return acme_client.Client(config.server, key=key, net=net)
  File "/usr/lib/python2.7/dist-packages/acme/client.py", line 63, in __init__
    self.net.get(directory).json())
  File "/usr/lib/python2.7/dist-packages/acme/client.py", line 627, in get
    self._send_request('GET', url, **kwargs), content_type=content_type)
  File "/usr/lib/python2.7/dist-packages/acme/client.py", line 609, in _send_request
    response = requests.request(method, url, *args, **kwargs)
  File "/usr/lib/python2.7/dist-packages/requests/api.py", line 50, in request
    response = session.request(method=method, url=url, **kwargs)
  File "/usr/lib/python2.7/dist-packages/requests/sessions.py", line 468, in request
    resp = self.send(prep, **send_kwargs)
  File "/usr/lib/python2.7/dist-packages/requests/sessions.py", line 576, in send
    r = adapter.send(request, **kwargs)
  File "/usr/lib/python2.7/dist-packages/requests/adapters.py", line 433, in send
    raise SSLError(e, request=request)
SSLError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:581)

Můj dotaz tedy zní: Jak to spravit?

---

---

Odpovědi

[dan]

skus export TERM=xterm pozri si issue #2520 na gite letsencryptu je tam komentar mozno to je tvoj problem

[jiri.one]

este som zabudol ten datum 2012-01-01 ten je dobre? crt nemaju nejake not before?

[jiri.one]

Já myslím, že jsi na to kápnul, teď nějsem u toho stroje, ale řekl bych, že se tam asi něco stalo z hodinama - sice je tam nastavená NTP synchronizace, ale mohlo se něco pokazit. Hned jak u toho budu, tak to vyzkouším a dám vědět. Díky moc. Taková blbá chyba, člověk kontroluje log, ale když to zrovna proběhlo, tak na čas nekouká :)).

[jiri.one]

Opravdu šlo jen o ten čas, který se na tom stroji nějak rozbil i přesto, že tam bylo zapnuto ntp synchro. Každopádně už to jede a díky za pomoc.