"signature check failed" when downloading Library and Boards Manager indexes on Raspberry Pi #9719
Comments
per1234
added
Type: Bug
Component: Board/Lib Manager
|
Testing with SSLPoke from https://gist.github.com/4ndrej/4547029 OpenJDK from Raspbian Buster: Good. Now let us test the JRE provided in arduino-1.8.11-linuxarm.tar.xz: Same results when using the cacert from Raspbian Buster (ca-certificates-java): |
|
FWIW, same error when testing against cloudflare.com: |
|
@tlk thanks for your tests. Moving to JRE 11 will create another set of problems, but it's something that we planned to do in the near future. May you try the Java 8 version (1.8.0_232) here https://adoptopenjdk.net/releases.html? |
|
You are welcome! Same results with Java 8 version (1.8.0_232) from https://adoptopenjdk.net/releases.html: |
|
Loading https://downloads.arduino.cc in Chrome version 79.0.3945.130 it reports a certificate chain where the root certificate (common name "COMODO ECC Certification Authority") has this SHA-256 fingerprint: Checking the trustStores both have a match, so that looks good: However, debugging with openssl it reports a certificate chain where the root certificate (same common name "COMODO ECC Certification Authority") has a different SHA-256 fingerprint: 🐇 There is probably a better way to fetch the fingerprints with openssl, but I took https://stackoverflow.com/a/44207749/936466 and adjusted it so it will fetch the certificate chain and print common name and SHA-256 fingerprint in pairs: Looking closer (at the output from the previous command but with the last grep and sed removed) shows that the CN = ssl788311.cloudflaressl.com certificate has this info: Ok. Checking the first two certificates (47:5F.. and CD:6C..) Chrome reports identical fingerprints. But while Chrome reports a 17:93.. fingerprint for the root cert, openssl reports a 95:73.. fingerprint. Odd. 🐌 Well, let's check the trustStores for this 95:73.. fingerprint: No match! I must have missed something because why would openssl and OpenJDK from Raspbian Buster happily accept a certificate chain with an unknown root cert? Let's have a closer look at that root cert with the 95:73.. fingerprint: Okay, so the "Issuer:" line claims that it was issued by a certificate with CN = AddTrust External CA Root. Maybe we can find that in the trustStores? Yup! Common names matching "AddTrust External CA Root" and they also have identical fingerprints. 🔍 I wonder if the 95:73.. certificate is properly signed by the "AddTrust External CA Root" certificate, and if so - why this is not accepted by the Java 8 version (1.8.0_232) from AdoptOpenJDK. To be continued... |
|
Ok, the fingerprints are not used in the chain validation (AFAIK) and the DN/CN, Serial number and X509v3 key identifiers are identical on the two certificates, so the two different fingerprints should be ok. I don't understand why the various Java versions from AdoptOpenJDK doesn't work, but on the bright side the issue is not limited to the downloads.arduino.cc domain and it is relatively easy to reproduce with SSLPoke. At first I thought the errors were caused by the AdoptOpenJDK cacert-files containing fewer CA root certificates than the Raspbian cacert. If that was the case the issue should be solved by using another cacert-file, but that does not help. |
|
I've tested the following JREs using your SSLPoke example:
There are no AdoptOpenJDK builds for arm32 before 1.8.0_222 and the latest available from raspbian is 1.8.0_212. Is Raspbian applying patches? Is the java version made by raspian redistributable? In that case we may consider to bundle that one. |
cmaglie
added
the
OpenJDK
Using Arduino IDE 1.8.11 Hourly Build 2020/02/03 07:20 on Raspbian 9.4 (stretch) and Raspbian 10.2 (buster)
~/.arduino15/cache(because if the Arduino IDE uses the cached indexes, it won't trigger the bug)~/.arduino15/library_index.json. The bug occurs with or without it, it just occurs a lot faster without.The index download fails:
Click for contents of `~/.arduino15/logs/application.log`:
The index download fails:
Click for contents of `~/.arduino15/logs/application.log`:
The issue does not occur with Arduino IDE 1.8.10.
The issue does occur with Arduino IDE 1.8.11.
The issue does not occur with Windows 10 64 bit or Linux 64 bit versions of the Arduino IDE.
Originally reported at:
The text was updated successfully, but these errors were encountered: