openid_connect fails on cert validation during login #2328
Comments
jswk
added a commit
that referenced
this issue
Oct 4, 2021
Force httpclient to use the default system cacert configuration. Otherwise, when the cacerts bundled with httpclient expire we are prone to get validation errors in different places (for example, openid_connect gem depends on this, and we were left without login). This patch has been copied from the gitlab PR: https://gitlab.com/gitlab-org/gitlab-foss/-/merge_requests/30749/diffs.
jswk
added a commit
that referenced
this issue
Oct 5, 2021
Force httpclient to use the default system cacert configuration. Otherwise, when the cacerts bundled with httpclient expire we are prone to get validation errors in different places (for example, openid_connect gem depends on this, and we were left without login). This patch has been copied from the gitlab PR: https://gitlab.com/gitlab-org/gitlab-foss/-/merge_requests/30749/diffs.
jswk
added a commit
that referenced
this issue
Oct 6, 2021
Force httpclient to use the default system cacert configuration. Otherwise, when the cacerts bundled with httpclient expire we are prone to get validation errors in different places (for example, openid_connect gem depends on this, and we were left without login). This patch has been copied from the gitlab PR: https://gitlab.com/gitlab-org/gitlab-foss/-/merge_requests/30749/diffs.
jswk
added a commit
that referenced
this issue
Oct 12, 2021
Force httpclient to use the default system cacert configuration. Otherwise, when the cacerts bundled with httpclient expire we are prone to get validation errors in different places (for example, openid_connect gem depends on this, and we were left without login). This patch has been copied from the gitlab PR: https://gitlab.com/gitlab-org/gitlab-foss/-/merge_requests/30749/diffs.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
When trying to log in to the application, i.e. on redirection to
/users/auth/checkinuser is confronted with a generic 500 message. The direct cause being an exception readingSSL_connect returned=1 errno=0 state=error: certificate verify failed (certificate has expired), such verification fails specifically for urlhttps://aai.eosc-portal.eu/oidc/. (The commit dd10f62 introduces a mitigation.)The httpclient gem uses bundled cacerts, which are quite old (last updated 6 years ago: https://github.com/nahi/httpclient/blob/4658227/lib/httpclient/cacert.pem). As discussed in nahi/httpclient#444, nahi/httpclient#446 and nahi/httpclient#386.
Gitlab has a sensible patch in place for this, it may be worth a try, since it switches to using system certs.
The text was updated successfully, but these errors were encountered: