<!DOCTYPE html>
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<p>Hi,</p>
<p>I have just added CA to ca-certificates and updated them using
/usr/sbin/update-ca-certificates<br>
</p>
<p><font color="#4e9a06">root@nsd-sdproxy1:~# ls -l
/usr/local/share/ca-certificates/<br>
total 4<br>
-rw-r--r-- 1 root root 1238 Mar 11 13:01 dc1_CA.crt<br>
root@nsd-sdproxy1:~# </font><br>
<br>
</p>
<p>I still can't connect to server <br>
</p>
<p><font color="#4e9a06">root@nsd-sdproxy1:~#
/usr/bin/openssl.original-from-debian s_client -connect
192.168.92.95:636 -CAfile /etc/ssl/certs/ca-certificates.crt<br>
CONNECTED(00000003)<br>
write:errno=104<br>
---<br>
no peer certificate available<br>
---<br>
No client certificate CA names sent<br>
---<br>
SSL handshake has read 0 bytes and written 297 bytes<br>
Verification: OK<br>
---<br>
New, (NONE), Cipher is (NONE)<br>
Secure Renegotiation IS NOT supported<br>
Compression: NONE<br>
Expansion: NONE<br>
No ALPN negotiated<br>
Early data was not sent<br>
Verify return code: 0 (ok)<br>
---<br>
root@nsd-sdproxy1:~# </font><br>
</p>
<p>The certificate validation looks like ok. <font color="#4e9a06"><br>
</font></p>
<p><font color="#4e9a06">root@nsd-sdproxy1:~#
openssl.original-from-debian verify -purpose sslserver -CAfile
/etc/ssl/certs/ca-certificates.crt /tmp/nsd-ad.pem<br>
/tmp/nsd-ad.pem: OK<br>
root@nsd-sdproxy1:~# </font><br>
<br>
</p>
<pre class="moz-signature" cols="72">Pozdrawiam serdecznie
Maciej Bogucki</pre>
<div class="moz-cite-prefix">On 4.03.2024 12:54, Kurt Roeckx wrote:<br>
</div>
<blockquote type="cite"
cite="mid:6E6B7087-D4E1-45C9-84E7-60BE6E639FBA@roeckx.be">
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
<div dir="auto">Hi,<br>
<br>
It's unclear to me what you're reporting as error. The
connection seems to be working. The verification of the
certificate seems to fail. It seems you have your own CA, but
the CA is not trusted because it's not in the certificate store.<br>
<br>
Kurt</div>
</blockquote>
</body>
</html>