Cert verify failed: BADCERT_EXPIRED (Letsencrypt global root cert)

[LarryPowel]

Yes, it's installed. I cannot build now, the repo is constantly unavailable.

% opkg update
Downloading https://downloads.openwrt.org/releases/21.02.0/targets/ramips/mt76x8/packages/Packages.gz
*** Failed to download the package list from https://downloads.openwrt.org/releases/21.02.0/targets/ramips/mt76x8/packages/Packages.gz

No matter if I disable the package -libwolfssl4.7.0.66253b90 or -libwolfssl, it just keeps being installed.

[LarryPowel]

Sorry, yes, using --insecure does work.
BTW, I'm using image builder, not source.

[jow]

Server side workaround on downloads.openwrt.org implemented, at least I am able to connect using a vanilla OpenWrt 21.02.0 x86/64 VM now

[LarryPowel]

Jow, not following. What is the server side workaround?

[hnyman]

@LarryPowel

. What is the server side workaround?

See the other threads...

@jow

Specifically I am seeking to implement Workaround #3 as mentioned in https://www.openssl.org/blog/blog/2021/09/13/LetsEncryptRootCertExpire/

For now I ended up simply removing the LE-shipped cross-signed ISRG Root X1 from the ACME client generated chain and that appears to make the server compatible with uclient-fetch in OpenWrt 21.02.0 by forcing it to fall back to the system ISRG Root.

[LarryPowel]

This is nuts. I simply cannot prevent libwolfssl4.7.0.66253b90 from getting installed.

[LarryPowel]

Should I start a new thread asking how I can remove libustream-wolfssl when using image builder. Nothing works so far. It's always added.

[LarryPowel]

Let's close this as it will not be of any use to someone who comes across it. At this point, we know what happened so time to build a new version but that is now another question.

Thanks very much for all the help.

[LarryPowel]

As an update, I went ahead and purchased a cert from GoDaddy.

I cannot get a build to work with any letsencrypt site and I've started a new post asking for help with that so I can get back to letsencrypt at some point.

% curl https://shop.bbc.com/
curl: (51) Cert verify failed: BADCERT_EXPIRED
% curl https://help.behance.net/
curl: (51) Cert verify failed: BADCERT_EXPIRED
% curl https://www.pinterest.com/
Works fine.

[apccv]

Posted on your other thread.

But in short, curl is linked to wolfssl. You will need to rebuild it too.

root@wrt:/tmp# ldd /usr/bin/curl
	/lib/ld-musl-armhf.so.1 (0xb6e9e000)
	libcurl.so.4 => /usr/lib/libcurl.so.4 (0xb6e49000)
	libnghttp2.so.14 => /usr/lib/libnghttp2.so.14 (0xb6e1a000)
	libwolfssl.so.4.7.0.66253b90 => /usr/lib/libwolfssl.so.4.7.0.66253b90 (0xb6ca4000)
	libgcc_s.so.1 => /lib/libgcc_s.so.1 (0xb6c88000)
	libc.so => /lib/ld-musl-armhf.so.1 (0xb6e9e000)

[LarryPowel]

I am using the image builder, not source and I've not found any way to get past this so far.
I started a new question so as not to confuse whom ever finds this one.

21.02.0 Cannot connect to any letsencrypt site using ssl (Letsencrypt global root cert expiration)

You can try curl -k but I don't think that will work. Let us know how you go

[biangbiangmian]

I can confirm that recompiling curl and using OpenSSL as the SSL lib works. Understandably, this isn't going to be a solution for everyone unfortunately.

[vpolischuk]

Faced analogical issue with dnscrypt-proxy:

Fri Oct  1 12:37:04 2021 daemon.err dnscrypt-proxy[6174]: dnscrypt-proxy Unable to retrieve server certificates
Fri Oct  1 12:37:05 2021 daemon.info dnscrypt-proxy[6174]: dnscrypt-proxy Refetching server certificates
Fri Oct  1 12:37:20 2021 daemon.err dnscrypt-proxy[6174]: dnscrypt-proxy Unable to retrieve server certificates
Fri Oct  1 12:37:23 2021 daemon.info dnscrypt-proxy[6174]: dnscrypt-proxy Refetching server certificates

I'm just installed openssl1.1 and issue was gone
opkg install libopenssl1.1

[LarryPowel]

How can I close a post so that folks don't keep adding things that might be lost once the reader finds the 'solution'.

[biangbiangmian]

Another solution, which does not require making any changes on deployed devices:

Opkg (uclient-fetch) can't download from https site: Invalid SSL certificate (Letsencrypt global root cert expiration)

In my case editing the /etc/letsencrypt/site.name/fullchain.pem file to remove the last certificate and restarting nginx did it for me.

[LarryPowel]

I tried that using an LE thread I found but that didn't work for me. Not sure why.