DaemonForums  

Go Back   DaemonForums > OpenBSD > OpenBSD General

OpenBSD General Other questions regarding OpenBSD which do not fit in any of the categories below.

Reply
 
Thread Tools Display Modes
  #1   (View Single Post)  
Old 16th January 2022
PingPing's Avatar
PingPing PingPing is offline
Real Name: Hammond
Port Guard
 
Join Date: Jan 2015
Location: United Kingdom
Posts: 18
Default [RESOLVED] acme-client tls_read: handshake failed

I'm using OpenBSD 6.8 (GENERIC.MP).
I've been using Let's Encrypt for an SSL Certificate for one of my website.
I set it up shortly after 6.8 was release and it all worked fine.
I then pretty much left things for a while.
I've just recently noticed that I'm getting a "Your connection is not private" in my browser, so I tried debugging the problem.

So far I'm seeing this:

Code:
$ doas acme-client -Fv gondwanapl.com
acme-client: /etc/ssl/gondwanapl.com.fullchain.pem: certificate valid: 76 days left
acme-client: /etc/ssl/gondwanapl.com.fullchain.pem: forcing renewal
acme-client: https://acme-v02.api.letsencrypt.org/directory: directories
acme-client: acme-v02.api.letsencrypt.org: DNS: 172.65.32.248
acme-client: 172.65.32.248: tls_write: certificate verification failed: certificate is not yet valid
acme-client: 172.65.32.248: tls_read: handshake failed: error:14FFF086:SSL routines:(UNKNOWN)SSL_internal:certificate verify failed
acme-client: https://acme-v02.api.letsencrypt.org/directory: bad comm
acme-client: bad exit: netproc(79636): 1
I'm not sure why it's failing. Is anyone able to explain this and tell me how to fix it?

Thank you.

Last edited by PingPing; 17th January 2022 at 06:37 AM. Reason: Resolution
Reply With Quote
  #2   (View Single Post)  
Old 16th January 2022
jggimi's Avatar
jggimi jggimi is offline
More noise than signal
 
Join Date: May 2008
Location: USA
Posts: 7,597
Default

"Certificate not yet valid" leads me to believe that the system running acme-client has an incorrect date / time set.
Reply With Quote
  #3   (View Single Post)  
Old 17th January 2022
J65nko J65nko is offline
Administrator
 
Join Date: May 2008
Location: Budel - the Netherlands
Posts: 3,798
Default

Did you install all the published system patches for OpenBSD 6.8? See https://www.openbsd.org/errata68.html
What is the output of # syspatch -l?
__________________
You don't need to be a genius to debug a pf.conf firewall ruleset, you just need the guts to run tcpdump
Reply With Quote
  #4   (View Single Post)  
Old 17th January 2022
PingPing's Avatar
PingPing PingPing is offline
Real Name: Hammond
Port Guard
 
Join Date: Jan 2015
Location: United Kingdom
Posts: 18
Default

Thank you both for taking the time to consider my post.

@J65nko, I will look into patching my EdgeRouter Lite install. It's not something I've done before.

@jggimi, you are spot on (again). My 'date' was showing Jan 22 2021. I recall something about a network time daemon to keep systime up to date. I'll need to look into that so that this doesn't happen again.

Cheers all!
Reply With Quote
Reply

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off

Forum Jump

Similar Threads
Thread Thread Starter Forum Replies Last Post
httpd & Acme frcc OpenBSD General 2 19th September 2021 02:00 PM
acme-client fail toprank OpenBSD General 7 23rd February 2018 11:55 AM
Openbsd 4.9 ftp as a client mikygee OpenBSD Security 8 25th December 2011 04:08 PM
OBSD client hangs mounting NFS; Linux client doesn't amorphousone OpenBSD General 7 26th August 2010 05:21 AM
IM Client schrodinger OpenBSD Packages and Ports 6 16th September 2008 02:09 PM


All times are GMT. The time now is 07:35 AM.


Powered by vBulletin® Version 3.8.4
Copyright ©2000 - 2022, Jelsoft Enterprises Ltd.
Content copyright © 2007-2010, the authors
Daemon image copyright ©1988, Marshall Kirk McKusick