regolith-desktop.org cert expired.

[tellett]

Following the instructions to update my repos, and I'm getting failures w/ bad certs. Looks like they expired earlier today (6 Jan 2023).

Here is the cert chain:

% openssl s_client -connect regolith-desktop.org:443 -showcerts
CONNECTED(00000003)
depth=2 C = US, O = Internet Security Research Group, CN = ISRG Root X1
verify return:1
depth=1 C = US, O = Let's Encrypt, CN = R3
verify return:1
depth=0 CN = regolith-desktop.org
verify error:num=10:certificate has expired
notAfter=Jan  6 22:49:40 2023 GMT
verify return:1
depth=0 CN = regolith-desktop.org
notAfter=Jan  6 22:49:40 2023 GMT
verify return:1
---
Certificate chain
 0 s:CN = regolith-desktop.org
   i:C = US, O = Let's Encrypt, CN = R3
   a:PKEY: rsaEncryption, 2048 (bit); sigalg: RSA-SHA256
   v:NotBefore: Oct  8 22:49:41 2022 GMT; NotAfter: Jan  6 22:49:40 2023 GMT
-----BEGIN CERTIFICATE-----
MIIFLzCCBBegAwIBAgISAyg00AWEvkweu7nyxNz5LpUcMA0GCSqGSIb3DQEBCwUA
MDIxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNyeXB0MQswCQYDVQQD
EwJSMzAeFw0yMjEwMDgyMjQ5NDFaFw0yMzAxMDYyMjQ5NDBaMB8xHTAbBgNVBAMT
FHJlZ29saXRoLWRlc2t0b3Aub3JnMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB
CgKCAQEAuir+YObluaex5Hx7ji6dIZT9xarWyfkEY2/0/TB8LSSXEhlZBbqPyF6E
nr1aYt8lSYoMBMeknpUXvYUjhcZ04JsaSC62TaFQfYPqVH8k9kQLWFRgxyPOG/H2
9OFudGqUbWMsoYFjUVcJ+Cwh7En8xImg0NNUek3Dbz+VNAuNAfW8XAdtMZgE6yU3
imYvGDaJsS4Em0ZKcc2TbvZdIU95OliBIt71YISgrUm6e4XKmQGS6i+rZ6g+kIuk
OPlkos1K0iH7QxHcbAmq1CFoiPOe8EdhDINOkd8zwr8XL8LxspnyRyG4E6bEZhXw
foJkd8kayg2ld73VqG4e2iYCpE/CfwIDAQABo4ICUDCCAkwwDgYDVR0PAQH/BAQD
AgWgMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjAMBgNVHRMBAf8EAjAA
MB0GA1UdDgQWBBT7MlFqS3xFqobTsaPydgTjzArxTzAfBgNVHSMEGDAWgBQULrMX
t1hWy65QCUDmH6+dixTCxjBVBggrBgEFBQcBAQRJMEcwIQYIKwYBBQUHMAGGFWh0
dHA6Ly9yMy5vLmxlbmNyLm9yZzAiBggrBgEFBQcwAoYWaHR0cDovL3IzLmkubGVu
Y3Iub3JnLzAfBgNVHREEGDAWghRyZWdvbGl0aC1kZXNrdG9wLm9yZzBMBgNVHSAE
RTBDMAgGBmeBDAECATA3BgsrBgEEAYLfEwEBATAoMCYGCCsGAQUFBwIBFhpodHRw
Oi8vY3BzLmxldHNlbmNyeXB0Lm9yZzCCAQUGCisGAQQB1nkCBAIEgfYEgfMA8QB3
AN+lXqtogk8fbK3uuF9OPlrqzaISpGpejjsSwCBEXCpzAAABg7oBJpMAAAQDAEgw
RgIhAPCnpO1swDEV+1Vd0mp3K9RIRcIfpfoW5HTUcTyVYovdAiEAh3gcFLkFhTjw
mHzw0SXtYE9AIPebCcPv2PkjTp4PpTgAdgCt9776fP8QyIudPZwePhhqtGcpXc+x
DCTKhYY069yCigAAAYO6ASa8AAAEAwBHMEUCIQCRDx+alqwzXYcv4rNZFzUrfjjZ
QKG4xowIDjh1vvx0vQIgDvD3orvsaYzXUXOSgRyRIc77C/t+nyc0MOaSiopbYykw
DQYJKoZIhvcNAQELBQADggEBAFnjzfjfkCosu31sjQMfKENO8rO11YVnCNlbIbVl
xMcE+um0l7O6REcCMzKgzOvOqbMUyvJQyd2Yaoqai13C6wc+cO0qtWtFvIuSDoji
YmMbsxDl0edwWv+jEneipVb9D+Y4pWDl5TV9jI0koJOgUQZ4I9j3ubbQB3Lvnznc
cMvJ+6drxdcMd4qWFQYAABxhl5C4l68tPl8er8gG6LTVQFkbS9d8hFK0NSAtzvAO
vPw+EJi2tkdS8qoLXWarwff3rtBUpukHSGETf1pb+SYL+vOCYZ8bpvY6PXfC0uYR
iNsN2ICs/1zeGiaQ4fAWnDMzAyOURskENxbyOjHS7kRA5Is=
-----END CERTIFICATE-----
 1 s:C = US, O = Let's Encrypt, CN = R3
   i:C = US, O = Internet Security Research Group, CN = ISRG Root X1
   a:PKEY: rsaEncryption, 2048 (bit); sigalg: RSA-SHA256
   v:NotBefore: Sep  4 00:00:00 2020 GMT; NotAfter: Sep 15 16:00:00 2025 GMT
-----BEGIN CERTIFICATE-----
MIIFFjCCAv6gAwIBAgIRAJErCErPDBinU/bWLiWnX1owDQYJKoZIhvcNAQELBQAw
TzELMAkGA1UEBhMCVVMxKTAnBgNVBAoTIEludGVybmV0IFNlY3VyaXR5IFJlc2Vh
cmNoIEdyb3VwMRUwEwYDVQQDEwxJU1JHIFJvb3QgWDEwHhcNMjAwOTA0MDAwMDAw
WhcNMjUwOTE1MTYwMDAwWjAyMQswCQYDVQQGEwJVUzEWMBQGA1UEChMNTGV0J3Mg
RW5jcnlwdDELMAkGA1UEAxMCUjMwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEK
AoIBAQC7AhUozPaglNMPEuyNVZLD+ILxmaZ6QoinXSaqtSu5xUyxr45r+XXIo9cP
R5QUVTVXjJ6oojkZ9YI8QqlObvU7wy7bjcCwXPNZOOftz2nwWgsbvsCUJCWH+jdx
sxPnHKzhm+/b5DtFUkWWqcFTzjTIUu61ru2P3mBw4qVUq7ZtDpelQDRrK9O8Zutm
NHz6a4uPVymZ+DAXXbpyb/uBxa3Shlg9F8fnCbvxK/eG3MHacV3URuPMrSXBiLxg
Z3Vms/EY96Jc5lP/Ooi2R6X/ExjqmAl3P51T+c8B5fWmcBcUr2Ok/5mzk53cU6cG
/kiFHaFpriV1uxPMUgP17VGhi9sVAgMBAAGjggEIMIIBBDAOBgNVHQ8BAf8EBAMC
AYYwHQYDVR0lBBYwFAYIKwYBBQUHAwIGCCsGAQUFBwMBMBIGA1UdEwEB/wQIMAYB
Af8CAQAwHQYDVR0OBBYEFBQusxe3WFbLrlAJQOYfr52LFMLGMB8GA1UdIwQYMBaA
FHm0WeZ7tuXkAXOACIjIGlj26ZtuMDIGCCsGAQUFBwEBBCYwJDAiBggrBgEFBQcw
AoYWaHR0cDovL3gxLmkubGVuY3Iub3JnLzAnBgNVHR8EIDAeMBygGqAYhhZodHRw
Oi8veDEuYy5sZW5jci5vcmcvMCIGA1UdIAQbMBkwCAYGZ4EMAQIBMA0GCysGAQQB
gt8TAQEBMA0GCSqGSIb3DQEBCwUAA4ICAQCFyk5HPqP3hUSFvNVneLKYY611TR6W
PTNlclQtgaDqw+34IL9fzLdwALduO/ZelN7kIJ+m74uyA+eitRY8kc607TkC53wl
ikfmZW4/RvTZ8M6UK+5UzhK8jCdLuMGYL6KvzXGRSgi3yLgjewQtCPkIVz6D2QQz
CkcheAmCJ8MqyJu5zlzyZMjAvnnAT45tRAxekrsu94sQ4egdRCnbWSDtY7kh+BIm
lJNXoB1lBMEKIq4QDUOXoRgffuDghje1WrG9ML+Hbisq/yFOGwXD9RiX8F6sw6W4
avAuvDszue5L3sz85K+EC4Y/wFVDNvZo4TYXao6Z0f+lQKc0t8DQYzk1OXVu8rp2
yJMC6alLbBfODALZvYH7n7do1AZls4I9d1P4jnkDrQoxB3UqQ9hVl3LEKQ73xF1O
yK5GhDDX8oVfGKF5u+decIsH4YaTw7mP3GFxJSqv3+0lUFJoi5Lc5da149p90Ids
hCExroL1+7mryIkXPeFM5TgO9r0rvZaBFOvV2z0gp35Z0+L4WPlbuEjN/lxPFin+
HlUjr8gRsI3qfJOQFy/9rKIJR0Y/8Omwt/8oTWgy1mdeHmmjk7j1nYsvC9JSQ6Zv
MldlTTKB3zhThV1+XWYp6rjd5JW1zbVWEkLNxE7GJThEUG3szgBVGP7pSWTUTsqX
nLRbwHOoq7hHwg==
-----END CERTIFICATE-----
 2 s:C = US, O = Internet Security Research Group, CN = ISRG Root X1
   i:O = Digital Signature Trust Co., CN = DST Root CA X3
   a:PKEY: rsaEncryption, 4096 (bit); sigalg: RSA-SHA256
   v:NotBefore: Jan 20 19:14:03 2021 GMT; NotAfter: Sep 30 18:14:03 2024 GMT
-----BEGIN CERTIFICATE-----
MIIFYDCCBEigAwIBAgIQQAF3ITfU6UK47naqPGQKtzANBgkqhkiG9w0BAQsFADA/
MSQwIgYDVQQKExtEaWdpdGFsIFNpZ25hdHVyZSBUcnVzdCBDby4xFzAVBgNVBAMT
DkRTVCBSb290IENBIFgzMB4XDTIxMDEyMDE5MTQwM1oXDTI0MDkzMDE4MTQwM1ow
TzELMAkGA1UEBhMCVVMxKTAnBgNVBAoTIEludGVybmV0IFNlY3VyaXR5IFJlc2Vh
cmNoIEdyb3VwMRUwEwYDVQQDEwxJU1JHIFJvb3QgWDEwggIiMA0GCSqGSIb3DQEB
AQUAA4ICDwAwggIKAoICAQCt6CRz9BQ385ueK1coHIe+3LffOJCMbjzmV6B493XC
ov71am72AE8o295ohmxEk7axY/0UEmu/H9LqMZshftEzPLpI9d1537O4/xLxIZpL
wYqGcWlKZmZsj348cL+tKSIG8+TA5oCu4kuPt5l+lAOf00eXfJlII1PoOK5PCm+D
LtFJV4yAdLbaL9A4jXsDcCEbdfIwPPqPrt3aY6vrFk/CjhFLfs8L6P+1dy70sntK
4EwSJQxwjQMpoOFTJOwT2e4ZvxCzSow/iaNhUd6shweU9GNx7C7ib1uYgeGJXDR5
bHbvO5BieebbpJovJsXQEOEO3tkQjhb7t/eo98flAgeYjzYIlefiN5YNNnWe+w5y
sR2bvAP5SQXYgd0FtCrWQemsAXaVCg/Y39W9Eh81LygXbNKYwagJZHduRze6zqxZ
Xmidf3LWicUGQSk+WT7dJvUkyRGnWqNMQB9GoZm1pzpRboY7nn1ypxIFeFntPlF4
FQsDj43QLwWyPntKHEtzBRL8xurgUBN8Q5N0s8p0544fAQjQMNRbcTa0B7rBMDBc
SLeCO5imfWCKoqMpgsy6vYMEG6KDA0Gh1gXxG8K28Kh8hjtGqEgqiNx2mna/H2ql
PRmP6zjzZN7IKw0KKP/32+IVQtQi0Cdd4Xn+GOdwiK1O5tmLOsbdJ1Fu/7xk9TND
TwIDAQABo4IBRjCCAUIwDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMCAQYw
SwYIKwYBBQUHAQEEPzA9MDsGCCsGAQUFBzAChi9odHRwOi8vYXBwcy5pZGVudHJ1
c3QuY29tL3Jvb3RzL2RzdHJvb3RjYXgzLnA3YzAfBgNVHSMEGDAWgBTEp7Gkeyxx
+tvhS5B1/8QVYIWJEDBUBgNVHSAETTBLMAgGBmeBDAECATA/BgsrBgEEAYLfEwEB
ATAwMC4GCCsGAQUFBwIBFiJodHRwOi8vY3BzLnJvb3QteDEubGV0c2VuY3J5cHQu
b3JnMDwGA1UdHwQ1MDMwMaAvoC2GK2h0dHA6Ly9jcmwuaWRlbnRydXN0LmNvbS9E
U1RST09UQ0FYM0NSTC5jcmwwHQYDVR0OBBYEFHm0WeZ7tuXkAXOACIjIGlj26Ztu
MA0GCSqGSIb3DQEBCwUAA4IBAQAKcwBslm7/DlLQrt2M51oGrS+o44+/yQoDFVDC
5WxCu2+b9LRPwkSICHXM6webFGJueN7sJ7o5XPWioW5WlHAQU7G75K/QosMrAdSW
9MUgNTP52GE24HGNtLi1qoJFlcDyqSMo59ahy2cI2qBDLKobkx/J3vWraV0T9VuG
WCLKTVXkcGdtwlfFRjlBz4pYg1htmf5X6DYO8A4jqv2Il9DjXA6USbW1FzXSLr9O
he8Y4IWS6wY7bCkjCWDcRQJMEhg76fsO3txE+FiYruq9RUWhiF1myv4Q6W+CyBFC
Dfvp7OOGAN6dEOM4+qR9sdjoSYKEBpsr6GtPAQw4dy753ec5
-----END CERTIFICATE-----
---
Server certificate
subject=CN = regolith-desktop.org
issuer=C = US, O = Let's Encrypt, CN = R3
---
No client certificate CA names sent
Peer signing digest: SHA256
Peer signature type: RSA-PSS
Server Temp Key: X25519, 253 bits
---
SSL handshake has read 4583 bytes and written 402 bytes
Verification error: certificate has expired
---
New, TLSv1.3, Cipher is TLS_AES_256_GCM_SHA384
Server public key is 2048 bit
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
Early data was not sent
Verify return code: 10 (certificate has expired)
---
---
Post-Handshake New Session Ticket arrived:
SSL-Session:
    Protocol  : TLSv1.3
    Cipher    : TLS_AES_256_GCM_SHA384
    Session-ID: 3172BAFB65A722F9FEC22C10276F4ADCBB3AD0144D706B12755A654FCC8C2DB4
    Session-ID-ctx: 
    Resumption PSK: BB856FA99746636AB2F72E9528AF27E9B6908E00ED63F97C9CC555E54DCE3A29F8024906F6228C37725D64CDB5696159
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    TLS session ticket lifetime hint: 7200 (seconds)
    TLS session ticket:
    0000 - a3 86 d4 40 c0 e0 f7 7f-ea fa 2b 0b 8c 51 67 20   ...@......+..Qg 
    0010 - 71 c7 ce b4 18 7c 30 54-38 ef c3 ae 21 7d 7d 69   q....|0T8...!}}i
    0020 - 62 db c1 2c 10 83 d7 f8-7b a0 af f4 6c 61 a2 b0   b..,....{...la..
    0030 - 90 7f c0 53 20 68 87 3c-c1 d5 82 b4 99 23 6a 2a   ...S h.<.....#j*
    0040 - 41 48 14 5a 98 06 7f f2-eb 39 bc bd fd df 24 05   AH.Z.....9....$.
    0050 - 7c 5b b8 e9 f5 43 59 f9-65 75 68 8c 79 43 07 38   |[...CY.euh.yC.8
    0060 - 9b bc ef 2f ed bc fd 33-7c 08 ec 82 d1 0f b7 6b   .../...3|......k
    0070 - 8e 28 6b ac 80 b3 cb 57-45 46 96 c7 4c 18 bd d4   .(k....WEF..L...
    0080 - b8 ba 79 68 11 7e 9a 6a-16 42 73 49 7a d6 1a 50   ..yh.~.j.BsIz..P
    0090 - 31 04 db de 19 99 37 7e-e6 74 23 12 3c 2b 32 c8   1.....7~.t#.<+2.
    00a0 - 85 fe c3 28 ea c8 d4 37-32 38 b8 f6 79 74 18 aa   ...(...728..yt..
    00b0 - 51 29 c6 02 ab 53 24 35-d5 38 3a 3a a1 7d c0 db   Q)...S$5.8::.}..
    00c0 - 55 6a 12 e8 1d 8b 0c d5-69 ff 33 72 c2 e9 a4 eb   Uj......i.3r....

    Start Time: 1673049217
    Timeout   : 7200 (sec)
    Verify return code: 10 (certificate has expired)
    Extended master secret: no
    Max Early Data: 0
---
read R BLOCK
---
Post-Handshake New Session Ticket arrived:
SSL-Session:
    Protocol  : TLSv1.3
    Cipher    : TLS_AES_256_GCM_SHA384
    Session-ID: EE273C5D24DDB8637FD4678C795BEF30F2648D4931554BC694D2815DE867CD79
    Session-ID-ctx: 
    Resumption PSK: 144B63D5345A6505147DA80EB88A5416FD15E7D662BD9E9754D4E34C27A2B2D69956F21A25209DC230AAC30F57D13240
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    TLS session ticket lifetime hint: 7200 (seconds)
    TLS session ticket:
    0000 - a3 86 d4 40 c0 e0 f7 7f-ea fa 2b 0b 8c 51 67 20   ...@......+..Qg 
    0010 - 1f cc 49 16 02 10 42 ed-4e 46 97 d7 21 20 6f 54   ..I...B.NF..! oT
    0020 - 1f 19 0c 2b 35 d9 00 40-ab 06 73 40 31 8e c1 48   [email protected]@1..H
    0030 - 54 cf 69 5d e1 5d cf 43-8b 9e e7 71 02 6d 5b 03   T.i].].C...q.m[.
    0040 - ef 7b 2a b6 5f 0b 74 b4-95 69 af 2a 2c ec e0 48   .{*._.t..i.*,..H
    0050 - 58 8c 83 b5 e3 2a 02 77-d8 f4 d7 46 0f 22 bb c1   X....*.w...F."..
    0060 - e1 5f ef 20 49 41 4f 4b-42 b1 f0 82 88 77 77 95   ._. IAOKB....ww.
    0070 - d8 30 5f 8f ca 05 01 6d-c9 55 f7 fb fb 4e 40 15   .0_....m.U...N@.
    0080 - a9 25 ab 0b 35 b2 2a 96-7d 73 63 43 1f 92 bd 0d   .%..5.*.}scC....
    0090 - 46 4d 9c 7f c7 7c b1 7d-ed ea a9 43 ee 94 ba b6   FM...|.}...C....
    00a0 - 7e 46 02 08 75 40 77 1b-9c 8c e0 cc 5b 35 ca 5d   ~F..u@w.....[5.]
    00b0 - b4 a0 f6 d6 e5 0c d4 31-96 35 c2 90 08 2d 76 e5   .......1.5...-v.
    00c0 - fe 78 2a a0 b5 6d ff 40-f4 b4 06 7b 95 c7 a3 4c   .x*..m.@...{...L

    Start Time: 1673049217
    Timeout   : 7200 (sec)
    Verify return code: 10 (certificate has expired)
    Extended master secret: no
    Max Early Data: 0
---
read R BLOCK
closed

[mpareja]

Judging by this prior answer and the fact that this is a Let's Encrypt certificate, I'm guessing @kgilmer needs to setup something like cert-manager or put the site behind pomerium to automatically have the certs renewed regularly.

[tellett]

Thanks for the pointers, I'm a huge fan of cert-manager, and I'll have to look into the other one. I'm mainly raising awareness of the issue to the team. Thankfully, I'm not blocked.

[mpareja]

@tellett This should be fixed at some point soon - Ken's really responsive. In the mean time, you can create the following file as a work around. Make sure you leave a TODO for yourself to remove it in a few days!

$ cat /etc/apt/apt.conf.d/80regolith
Acquire::https::regolith-desktop.org::Verify-Peer "false";
Acquire::https::regolith-desktop.org::Verify-Host "false";

[tellett]

Thanks for the pointer, this was a new one for me.

[kgilmer]

Should be fixed now. You know me too well @mpareja 😅 Thanks for the tips I'll look into those options.

[mpareja]

Cert-manager is a kubernetes native approach. Depending on your setup, you might need to use something simpler like certbot. Good luck!

[lmisea]

Yep, now regolith-desktop.org cert is working just fine. You may want to close the issue related to this: #809
Thanks a lot.