benoitc/hackney

SSL certificate expired issue

Closed this issue · 6 comments

isubasti commented

There are issues with some SSL connections if you make any request to URL that has Sectigo SSL certificate on its certificate chain see https://twitter.com/__agwa/timelines/1266777818811322368.
openssl 1.1 seems to deal with this properly(match how browser does it) while 1.0 have the same problem as hackney so I would assume that how hackney follow the certificate chain is similar to 1.0 of openssl

npkhoa2197 commented

Encountered same issue. Hackney works fine last week but currently encounter certificate_expired error when making HTTPS request.

ilya-lopukhin commented

Any ideas how to fix it guys?

npkhoa2197 commented

@ilya-lopukhin

If you need a hotfix, you can use the option {insecure, true}.

But had better not bypass the SSL verification.

  • 👍1
rmnvncnt commented

Same issue here. We think this might be related : https://www.agwa.name/blog/post/fixing_the_addtrust_root_expiration

ananthakumaran commented

We ran into the same issue. We found that most of the other language clients were able to connect without issues, but hackney failed. We found two workarounds

  1. disable ssl verficiation via ssl: {:verify, :verify_none}
  2. remove addtrust key from the certificate bundle. curl -#fSlo priv/cacerts.pem https://mkcert.org/generate/all/except/addtrust
  • 👍4
benoitc commented

fixed in latest master. It will be part of the new release.