CLA checker has ssl problems?

Question

CLA checker has ssl problems?

adriaanm opened this issue 6 years ago · 8 comments

2018-12-27 17:27:23,003 [ERROR] from spray.can.client.HttpClientConnection in application-akka.actor.default-dispatcher-6 - Aborting encrypted connection to www.lightbend.com/34.238.100.233:443 due to [SSLHandshakeException:General SSLEngine problem] -> [SSLHandshakeException:General SSLEngine problem] -> [ValidatorException:PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target] -> [SunCertPathBuilderException:unable to find valid certification path to requested target]

~~It happened when I upgraded that machine, so maybe the JVM was upgraded and cacerts were changed to no longer include what's needed to validate our own cert??~~

Looks like lightbend.com got a new cert around the time this started failing

adriaanm commented 6 years ago

Yep

Answer 1 · 2018-12-27T20:46:09.000Z

Was this using a SAN on the old cert? That is, www.lightbend.com should validate from a modern JVM, but other SAN hostnames on the cert were dropped from the certificate.

Answer 2 · 2018-12-27T22:38:08.000Z

I have no idea :-/ The error is

Aborting encrypted connection to www.lightbend.com/34.238.100.233:443 due to 
[SSLHandshakeException:General SSLEngine problem] 
-> [SSLHandshakeException:General SSLEngine problem] 
-> [ValidatorException:PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target] 
-> [SunCertPathBuilderException:unable to find valid certification path to requested target]

(So, it looks like it's just using plain www.lightbend.com as the hostname.)

Answer 3 · 2018-12-27T23:15:10.000Z

I followed https://askubuntu.com/questions/645818/how-to-install-certificates-for-command-line and added https://support.comodo.com/index.php?/Knowledgebase/Article/View/970/108/intermediate-2-sha-2-comodo-rsa-domain-validation-secure-server-ca. That fixed it.

Answer 4 · 2018-12-27T23:21:56.000Z

Interesting. So you needed to add the Comodo intermediate. @JustinPihony, did you upload or merge the comodo intermediate? If not, that would seem to be the change/difference. The CA vendor did not change between certs.

Answer 5 · 2018-12-28T08:46:01.000Z

I uploaded. It was a straight swap. I’ll review this in more depth in the am to make sure all is as is expected

…

On Dec 27, 2018, at 6:21 PM, Edward Callahan ***@***.***> wrote: Interesting. So you needed to add the Comodo intermediate. @JustinPihony, did you upload or merge the comodo intermediate? If not, that would seem to be the change/difference. The CA vendor did not change between certs. — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub, or mute the thread.

Answer 6 · 2019-01-03T04:56:50.000Z

This has been handled at the server level, so it should work everywhere now. I'm unsure if your workaround will need to be removed or not @adriaanm

Answer 7 · 2019-01-08T04:20:48.000Z

Can this be closed?