<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<p><font face="Helvetica, Arial, sans-serif">Good morning,</font></p>
<p><font face="Helvetica, Arial, sans-serif">I tested the same setup
on a Buster system and it works perfectly.</font></p>
<p><font face="Helvetica, Arial, sans-serif">Same CA, same
intermediates, same configuration and same file locations. Also
with update-ca-certificates.</font></p>
<p><font face="Helvetica, Arial, sans-serif">And, however, if there
was a problem with the algorithm implementing the EC curves on
certificates I am using, the verification should not fail for
all certificates, but only for the one I added. Correct me if
I'm wrong.<br>
</font></p>
<p><font face="Helvetica, Arial, sans-serif">Best regards,</font></p>
<p><font face="Helvetica, Arial, sans-serif">Marc</font><br>
</p>
<div class="moz-cite-prefix">On 25.10.22 08:01, David Kalnischkies
wrote:<br>
</div>
<blockquote type="cite"
cite="mid:20221025060157.mu3nkc7okrqvdu2p@crossbow">
<pre class="moz-quote-pre" wrap="">On Sun, Oct 23, 2022 at 11:03:19PM +0200, Julian Andres Klode wrote:
</pre>
<blockquote type="cite">
<pre class="moz-quote-pre" wrap="">apt just calls gnutls_certificate_set_x509_system_trust() and
gnutls_set_default_priority() so this should not be our issue.
</pre>
</blockquote>
<pre class="moz-quote-pre" wrap="">
Also, on a side note, I have a custom CA (without an immediate) and apt
and co are happy with it. The other difference to my setup is that
I place my certificate in /usr/local/share/ca-certificates/ which avoids
further configuration as update-ca-certificates will pick them up
directly from there (see its manpage).
It might help if you can check if the chaining is part of the problem
or what else might be specific to your setup. Perhaps its the algorithms
used and e.g. gnutls not implementing the EC curves you used (or
something like that or not at all – its just something I ran into in
the past, although not with gnutls, that worked back then…).
Best regards
David Kalnischkies
</pre>
</blockquote>
<pre class="moz-signature" cols="72">--
aiticon GmbH
Stephanstraße 1
60313 Frankfurt am Main
t. +49 69 795 83 83-0
f. +49 69 795 83 83-28
Geschäftsführer: Matthias Herlitzius
Amtsgericht Frankfurt am Main · HRB 79310
USt.-ID-Nr.: DE 218319776</pre>
</body>
</html>