<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html>
<body>
<div dir="auto">
<div dir="auto"><br></div><div dir='auto'><br></div>
<div id="aqm-original" style="color: black;">
<div dir="auto">On 3 September 2022 19:26:50 Shawn Heisey via openssl-users <openssl-users@openssl.org> wrote:</div>
<div><br></div>
<blockquote type="cite" class="gmail_quote" style="margin: 0 0 0 0.75ex; border-left: 1px solid #808080; padding-left: 0.75ex;">
<div dir="auto">On 9/2/22 21:42, Shawn Heisey via openssl-users wrote:</div>
<blockquote type="cite" class="gmail_quote" style="margin: 0 0 0 0.75ex; border-left: 1px solid #0099CC; padding-left: 0.75ex;">
<div dir="auto">Other bare metal systems and their results with the same PEM file:</div>
<div dir="auto"><br></div>
<div dir="auto">Verifies on Proxmox (the one running the VM) with openssl 1.1.1n</div>
<div dir="auto">Verifies on Ubuntu 22.04 with openssl 3.0.2</div>
<div dir="auto">Fails on CentOS 7.5.1804 with openssl 1.0.2k-fips</div>
</blockquote>
<div dir="auto"><br></div>
<div dir="auto">Additional tests done with an identical PEM file and the results:</div>
<div dir="auto"><br></div>
<div dir="auto">Passed on Ubuntu Server 22.04 VM, openssl 3.0.2, installed on the same </div>
<div dir="auto">proxmox host as the Alma VM that fails.</div>
<div dir="auto">Passed on Ubuntu 22.04 desktop bare metal, openssl 3.0.2</div>
<div dir="auto">Failed on Centos 7 VM running in qemu on that Ubuntu desktop, openssl </div>
<div dir="auto">1.0.2k-fips</div>
<div dir="auto">Failed on Fedora35 VM running in qemu on that Ubuntu desktop, openssl 1.1.1q</div>
<div dir="auto">Passed on Ubuntu Server 22.04 bare metal, using quictls openssl version </div>
<div dir="auto">3.0.5+quic</div>
<div dir="auto"><br></div>
<div dir="auto">Looks like there is something about RPM-based distros that breaks part </div>
<div dir="auto">of openssl.</div>
<div dir="auto"><br></div>
<div dir="auto">One other bit of info. I ran another test on the Alma VM where I </div>
<div dir="auto">compiled the master branch of https://github.com/openssl/openssl to </div>
<div dir="auto">/usr/local/ossl3 and used that to try the verify. This is the failure </div>
<div dir="auto">output:</div>
<div dir="auto"><br></div>
<div dir="auto">[root@certs ~]# /usr/local/bin/ossl verify -CAfile </div>
<div dir="auto">/etc/ssl/certs/local/DOMAIN.wildcards.pem </div>
<div dir="auto">/etc/ssl/certs/local/DOMAIN.wildcards.pem</div>
<div dir="auto">C=US, O=Let's Encrypt, CN=R3</div>
<div dir="auto">error 2 at 1 depth lookup: unable to get issuer certificate</div>
<div dir="auto">error /etc/ssl/certs/local/DOMAIN.wildcards.pem: verification failed</div>
<div dir="auto">[root@certs ~]# /usr/local/bin/ossl version</div>
<div dir="auto">OpenSSL 3.1.0-dev (Library: OpenSSL 3.1.0-dev )</div>
<div dir="auto"><br></div>
<div dir="auto"><br></div>
<div dir="auto">Thoughts?</div>
<div dir="auto"><br></div>
<div dir="auto">Thanks,</div>
<div dir="auto">Shawn</div>
</blockquote>
</div><div dir="auto">R3 is a lets encrypt intermediate cert. This could be due to the retirement of the ISRG X1 certificate last year. I would check that /etc/ssl/certs or wherever the default ca store is on your systems, is up to date.</div>
</div></body>
</html>