Cellular Network Infrastructure » Radio Access Network » OsmoBTS

tried to resolve it for 201705-nightly in:

commit 8d3ccdf0eb5c555684287f4fb51bba51dc2ed4f3
Author: Harald Welte <laforge@osmocom.org>
Date:   Tue Oct 12 21:13:03 2021 +0200

    ca-certificates: Migrate from DST_X3 to ISRG_X1

    Closes: OS#5259

let's see if that works and then introduce the change to 201705 next.

please test the attached image if it resolves the problem. thanks!

Unfortunately on booting the test image we still get:

root@sysmobts-v2:/etc# opkg update                                                                                                                                        
Downloading https://autoupdate:***@feeds.sysmocom.de/generic/sysmobts/201705/ipk/all/Packages.gz.
Downloading https://autoupdate:***@feeds.sysmocom.de/generic/sysmobts/201705/ipk/armv5te/Packages.gz.
Downloading https://autoupdate:***@feeds.sysmocom.de/generic/sysmobts/201705/ipk/sysmobts_v2/Packages.gz.
Collected errors:
 * opkg_download_backend: Failed to download https://autoupdate:***@feeds.sysmocom.de/generic/sysmobts/201705/ipk/all/Packages.gz, wget returned 5.
 * opkg_download_backend: Failed to download https://autoupdate:***@feeds.sysmocom.de/generic/sysmobts/201705/ipk/armv5te/Packages.gz, wget returned 5.
 * opkg_download_backend: Failed to download https://autoupdate:***@feeds.sysmocom.de/generic/sysmobts/201705/ipk/sysmobts_v2/Packages.gz, wget returned 5.

root@sysmobts-v2:/etc# wget -O - https://autoupdate:***@feeds.sysmocom.de/                                                                                                
--2021-10-19 19:58:03--  https://autoupdate:*password*@feeds.sysmocom.de/
Resolving feeds.sysmocom.de... 136.243.0.173, 2a01:4f8:211:1a1e::2
Connecting to feeds.sysmocom.de|136.243.0.173|:443... connected.
ERROR: The certificate of 'feeds.sysmocom.de' is not trusted.
ERROR: The certificate of 'feeds.sysmocom.de' has expired.

root@sysmobts-v2:/etc# date
Tue Oct 19 19:58:08 UTC 2021

root@sysmobts-v2:/etc# grep X3 ca-certificates.conf 
mozilla/DST_Root_CA_X3.crt

root@sysmobts-v2:/etc# sed -i '/^mozilla\/DST_Root_CA_X3/s/^/!/' /etc/ca-certificates.conf && update-ca-certificates -f
Clearing symlinks in /etc/ssl/certs...
done.
Updating certificates in /etc/ssl/certs...
openssl:Error: 'rehash' is an invalid command. [Hmm. Another issue?  ..openssl help output removed...]

0 added, 1 removed; done.
Running hooks in /etc/ca-certificates/update.d...
done.

root@sysmobts-v2:/etc# wget -O - https://autoupdate:***@feeds.sysmocom.de/         
--2021-10-19 20:00:38--  https://autoupdate:*password*@feeds.sysmocom.de/
Resolving feeds.sysmocom.de... 136.243.0.173, 2a01:4f8:211:1a1e::2
Connecting to feeds.sysmocom.de|136.243.0.173|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 219 [text/html]
Saving to: 'STDOUT'
[...]
2021-10-19 20:00:40 (8.87 MB/s) - written to stdout [219/219]

asssigning to osmith for further investigation and hopefully resolution

I've flashed the test image and was able to reproduce what keith reported above.

Installed cert packages:

# opkg list | grep cert
ca-cacert-rootcert - 1.0-r7.0
ca-certificates - 20210119-r0.1

• ca-cacert-rootcert - 1.0-r7.0: looks like the expected version based on Harald's patch above
• ca-certificates - 20210119-r0.1: this is weird, why is it not "20120623", from here? Does it get installed from another repository?

DST_Root_CA_X3.crt is not in ca-cacert-rootcert (as expected with Haralds patch):

root@sysmobts-v2:~# opkg files ca-cacert-rootcert
Package ca-cacert-rootcert (1.0-r7.0) is installed on root and has the following files:
/usr/lib/ssl/certs/4042bcee.0
/usr/lib/ssl/certs/cacert.org.pem
/usr/lib/ssl/certs/99d0fa06.0
/usr/lib/ssl/certs/ISRG_Root_X1.pem
/usr/lib/ssl/certs/
/usr/lib/ssl/certs/e5662767.0
/usr/lib/ssl/certs/5ed36f99.0
/usr/lib/ssl/

DST_Root_CA_X3.crt is in the ca-certificates package:

root@sysmobts-v2:~# opkg files ca-certificates | grep DST
/usr/share/ca-certificates/mozilla/DST_Root_CA_X3.crt
root@sysmobts-v2:~# opkg search /usr/share/ca-certificates/mozilla/DST_Root_CA_X3.crt
ca-certificates - 20210119-r0.1

The ca-certificates.conf is in ca-certificates, too:

opkg search /etc/ca-certificates.conf
ca-certificates - 20210119-r0.1

laforge: do you know where the ca-certificates "20210119-r0.1" package comes from? The description from your uploaded image is "test build image with ca-certificates package 20210119", maybe you did another test commit that bumped the ca-certificates version? If so, we probably only need to adjust the package recipe in meta-sysmocom-bsp.git to drop that certificate too.

The updated ca-certificates package is from the attached patch which I backported from upstream OE

Meanwhile upstream has updated the package to a new version, from 2021-01-19 -> 2021-10-16:
https://lists.openembedded.org/g/openembedded-core/message/157722

This containts the following commit, which explicitly blacklists "DST Root CA X3":
https://salsa.debian.org/debian/ca-certificates/-/commit/5b83fd984706ea03101dbb011846e60364c3a149

When running make in ca-certificates.git current master (the commit that's packaged in OE 2021-10-16), it says:

Certificate "DST Root CA X3" blacklisted, ignoring.

So it should work now when backporting this version.

laforge: please review: https://gitea.sysmocom.de/sysmo-bts/meta-sysmocom-bsp/pulls/2

Note that I didn't try to build this, I just copied the files from the upstream repository, hardknott branch assuming that it should then build in our OE image too.

updated build attached for testing

attachment:sysmocom-nitb-image-sysmobts-v2-20211105115934.rootfs.ubi