mirrors.fedoraproject.orgを使用したCentOS6.7のEPELリポジトリでの証明書エラー
EPELリポジトリーが構成されているCentOS 6.7システムを更新できません。
[epel]
name=Extra Packages for Enterprise Linux 6 - $basearch
mirrorlist=https://mirrors.fedoraproject.org/mirrorlist?repo=epel-6&Arch=$basearch
enabled=1
gpgcheck=1
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-EPEL-6
failovermethod=priority
Mirrors.fedoraproject.orgに接続すると証明書エラーが発生します。 urlグラバーを有効にしてyumコマンドを実行しましたが、mirrors.fedoraproject.orgからの証明書を検証するためのCAがシステムにないことがわかりました。
$ URLGRABBER_DEBUG=1 yum check-update
2015-12-17 14:05:00,510 attempt 1/10: https://mirrors.fedoraproject.org/mirrorlist?repo=epel-6&Arch=x86_64
INFO:urlgrabber:attempt 1/10: https://mirrors.fedoraproject.org/mirrorlist?repo=epel-6&Arch=x86_64
* About to connect() to mirrors.fedoraproject.org port 443 (#0)
* Trying 140.211.169.206... * connected
* Connected to mirrors.fedoraproject.org (140.211.169.206) port 443 (#0)
* Initializing NSS with certpath: sql:/etc/pki/nssdb
* CAfile: /etc/pki/tls/certs/ca-bundle.crt
CApath: none
* Peer's certificate issuer is not recognized: 'CN=DigiCert SHA2 High Assurance Server CA,OU=www.digicert.com,O=DigiCert Inc,C=US'
* NSS error -8179
* Closing connection #0
* Peer certificate cannot be authenticated with known CA certificates
2015-12-17 14:05:00,767 exception: [Errno 14] Peer cert cannot be verified or peer cert invalid
INFO:urlgrabber:exception: [Errno 14] Peer cert cannot be verified or peer cert invalid
2015-12-17 14:05:00,774 retrycode (14) not in list [-1, 2, 4, 5, 6, 7], re-raising
INFO:urlgrabber:retrycode (14) not in list [-1, 2, 4, 5, 6, 7], re-raising
Could not retrieve mirrorlist https://mirrors.fedoraproject.org/mirrorlist?repo=epel-6&Arch=x86_64 error was
14: Peer cert cannot be verified or peer cert invalid
Error: Cannot find a valid baseurl for repo: epel
Ca-certificateパッケージの更新はありません
$ yum update ca-certificates --disablerepo epel
Loaded plugins: fastestmirror
Setting up Update Process
Loading mirror speeds from cached hostfile
* base: mirrors.kernel.org
* extras: mirror.solarvps.com
* updates: ftp.linux.ncsu.edu
No Packages marked for Update
これがca-certificatesパッケージの現在のバージョンです
Name : ca-certificates
Arch : noarch
Version : 2015.2.4
Release : 65.0.1.el6_6
Size : 3.2 M
Repo : installed
From repo : updates
Summary : The Mozilla CA root certificate bundle
URL : http://www.mozilla.org/
License : Public Domain
Description : This package contains the set of CA certificates chosen by the
: Mozilla Foundation for use with the Internet PKI.
Iwaseantenbyagrueが指摘したように、openssl s_clientで提供される証明書を確認できます。問題は、サーバー（mirrors.fedoraproject.org）が中間証明書を提供しないことです。
issuer=/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert SHA2 High Assurance Server CA
そしてあなたはあなたのCAバンドルに証明書を持っていません。
私の意見で最も良いことは、中間証明書がmirrors.fedoraproject.orgに追加された場合ですが、それはあなたや私がこれでできることではないので、caバンドルパッケージを更新するか、またはダウンロードすることができます DigiCert Root Caダウンロードページ から自分で中間証明書を取得します。このようなopensslでx509に変換できます（証明書のみが必要な場合は-textを省略します）。
openssl x509 -inform der -in DigiCertSHA2HighAssuranceServerCA.crt -text
Certificate:
Data:
Version: 3 (0x2)
Serial Number:
04:e1:e7:a4:dc:5c:f2:f3:6d:c0:2b:42:b8:5d:15:9f
Signature Algorithm: sha256WithRSAEncryption
Issuer: C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert High Assurance EV Root CA
Validity
Not Before: Oct 22 12:00:00 2013 GMT
Not After : Oct 22 12:00:00 2028 GMT
Subject: C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert SHA2 High Assurance Server CA
Subject Public Key Info:
Public Key Algorithm: rsaEncryption
Public-Key: (2048 bit)
Modulus:
00:b6:e0:2f:c2:24:06:c8:6d:04:5f:d7:ef:0a:64:
06:b2:7d:22:26:65:16:ae:42:40:9b:ce:dc:9f:9f:
76:07:3e:c3:30:55:87:19:b9:4f:94:0e:5a:94:1f:
55:56:b4:c2:02:2a:af:d0:98:ee:0b:40:d7:c4:d0:
3b:72:c8:14:9e:ef:90:b1:11:a9:ae:d2:c8:b8:43:
3a:d9:0b:0b:d5:d5:95:f5:40:af:c8:1d:ed:4d:9c:
5f:57:b7:86:50:68:99:f5:8a:da:d2:c7:05:1f:a8:
97:c9:dc:a4:b1:82:84:2d:c6:ad:a5:9c:c7:19:82:
a6:85:0f:5e:44:58:2a:37:8f:fd:35:f1:0b:08:27:
32:5a:f5:bb:8b:9e:a4:bd:51:d0:27:e2:dd:3b:42:
33:a3:05:28:c4:bb:28:cc:9a:ac:2b:23:0d:78:c6:
7b:e6:5e:71:b7:4a:3e:08:fb:81:b7:16:16:a1:9d:
23:12:4d:e5:d7:92:08:ac:75:a4:9c:ba:cd:17:b2:
1e:44:35:65:7f:53:25:39:d1:1c:0a:9a:63:1b:19:
92:74:68:0a:37:c2:c2:52:48:cb:39:5a:a2:b6:e1:
5d:c1:dd:a0:20:b8:21:a2:93:26:6f:14:4a:21:41:
c7:ed:6d:9b:f2:48:2f:f3:03:f5:a2:68:92:53:2f:
5e:e3
Exponent: 65537 (0x10001)
X509v3 extensions:
X509v3 Basic Constraints: critical
CA:TRUE, pathlen:0
X509v3 Key Usage: critical
Digital Signature, Certificate Sign, CRL Sign
X509v3 Extended Key Usage:
TLS Web Server Authentication, TLS Web Client Authentication
Authority Information Access:
OCSP - URI:http://ocsp.digicert.com
X509v3 CRL Distribution Points:
Full Name:
URI:http://crl4.digicert.com/DigiCertHighAssuranceEVRootCA.crl
X509v3 Certificate Policies:
Policy: X509v3 Any Policy
CPS: https://www.digicert.com/CPS
X509v3 Subject Key Identifier:
51:68:FF:90:AF:02:07:75:3C:CC:D9:65:64:62:A2:12:B8:59:72:3B
X509v3 Authority Key Identifier:
keyid:B1:3E:C3:69:03:F8:BF:47:01:D4:98:26:1A:08:02:EF:63:64:2B:C3
Signature Algorithm: sha256WithRSAEncryption
18:8a:95:89:03:e6:6d:df:5c:fc:1d:68:ea:4a:8f:83:d6:51:
2f:8d:6b:44:16:9e:ac:63:f5:d2:6e:6c:84:99:8b:aa:81:71:
84:5b:ed:34:4e:b0:b7:79:92:29:cc:2d:80:6a:f0:8e:20:e1:
79:a4:fe:03:47:13:ea:f5:86:ca:59:71:7d:f4:04:96:6b:d3:
59:58:3d:fe:d3:31:25:5c:18:38:84:a3:e6:9f:82:fd:8c:5b:
98:31:4e:cd:78:9e:1a:fd:85:cb:49:aa:f2:27:8b:99:72:fc:
3e:aa:d5:41:0b:da:d5:36:a1:bf:1c:6e:47:49:7f:5e:d9:48:
7c:03:d9:fd:8b:49:a0:98:26:42:40:eb:d6:92:11:a4:64:0a:
57:54:c4:f5:1d:d6:02:5e:6b:ac:ee:c4:80:9a:12:72:fa:56:
93:d7:ff:bf:30:85:06:30:bf:0b:7f:4e:ff:57:05:9d:24:ed:
85:c3:2b:fb:a6:75:a8:ac:2d:16:ef:7d:79:27:b2:eb:c2:9d:
0b:07:ea:aa:85:d3:01:a3:20:28:41:59:43:28:d2:81:e3:aa:
f6:ec:7b:3b:77:b6:40:62:80:05:41:45:01:ef:17:06:3e:de:
c0:33:9b:67:d3:61:2e:72:87:e4:69:fc:12:00:57:40:1e:70:
f5:1e:c9:b4
-----BEGIN CERTIFICATE-----
MIIEsTCCA5mgAwIBAgIQBOHnpNxc8vNtwCtCuF0VnzANBgkqhkiG9w0BAQsFADBs
MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3
d3cuZGlnaWNlcnQuY29tMSswKQYDVQQDEyJEaWdpQ2VydCBIaWdoIEFzc3VyYW5j
ZSBFViBSb290IENBMB4XDTEzMTAyMjEyMDAwMFoXDTI4MTAyMjEyMDAwMFowcDEL
MAkGA1UEBhMCVVMxFTATBgNVBAoTDERpZ2lDZXJ0IEluYzEZMBcGA1UECxMQd3d3
LmRpZ2ljZXJ0LmNvbTEvMC0GA1UEAxMmRGlnaUNlcnQgU0hBMiBIaWdoIEFzc3Vy
YW5jZSBTZXJ2ZXIgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC2
4C/CJAbIbQRf1+8KZAayfSImZRauQkCbztyfn3YHPsMwVYcZuU+UDlqUH1VWtMIC
Kq/QmO4LQNfE0DtyyBSe75CxEamu0si4QzrZCwvV1ZX1QK/IHe1NnF9Xt4ZQaJn1
itrSxwUfqJfJ3KSxgoQtxq2lnMcZgqaFD15EWCo3j/018QsIJzJa9buLnqS9UdAn
4t07QjOjBSjEuyjMmqwrIw14xnvmXnG3Sj4I+4G3FhahnSMSTeXXkgisdaScus0X
sh5ENWV/UyU50RwKmmMbGZJ0aAo3wsJSSMs5WqK24V3B3aAguCGikyZvFEohQcft
bZvySC/zA/WiaJJTL17jAgMBAAGjggFJMIIBRTASBgNVHRMBAf8ECDAGAQH/AgEA
MA4GA1UdDwEB/wQEAwIBhjAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIw
NAYIKwYBBQUHAQEEKDAmMCQGCCsGAQUFBzABhhhodHRwOi8vb2NzcC5kaWdpY2Vy
dC5jb20wSwYDVR0fBEQwQjBAoD6gPIY6aHR0cDovL2NybDQuZGlnaWNlcnQuY29t
L0RpZ2lDZXJ0SGlnaEFzc3VyYW5jZUVWUm9vdENBLmNybDA9BgNVHSAENjA0MDIG
BFUdIAAwKjAoBggrBgEFBQcCARYcaHR0cHM6Ly93d3cuZGlnaWNlcnQuY29tL0NQ
UzAdBgNVHQ4EFgQUUWj/kK8CB3U8zNllZGKiErhZcjswHwYDVR0jBBgwFoAUsT7D
aQP4v0cB1JgmGggC72NkK8MwDQYJKoZIhvcNAQELBQADggEBABiKlYkD5m3fXPwd
aOpKj4PWUS+Na0QWnqxj9dJubISZi6qBcYRb7TROsLd5kinMLYBq8I4g4Xmk/gNH
E+r1hspZcX30BJZr01lYPf7TMSVcGDiEo+afgv2MW5gxTs14nhr9hctJqvIni5ly
/D6q1UEL2tU2ob8cbkdJf17ZSHwD2f2LSaCYJkJA69aSEaRkCldUxPUd1gJea6zu
xICaEnL6VpPX/78whQYwvwt/Tv9XBZ0k7YXDK/umdaisLRbvfXknsuvCnQsH6qqF
0wGjIChBWUMo0oHjqvbsezt3tkBigAVBRQHvFwY+3sAzm2fTYS5yh+Rp/BIAV0Ae
cPUeybQ=
-----END CERTIFICATE-----
CentOSでそれがどのように行われるかは覚えていませんが、pemファイルを/ etc/pki/ca-trust/source/anchors /に入れてupdate-ca-trustこの証明書をトラストストアに追加します。
Opensslを使用して、ca-certificatesに問題がないことを再確認できます。
> openssl s_client -connect 140.211.169.206:443 -servername mirrors.fedoraproject.org
CONNECTED(00000003)
depth=2 C = US, O = DigiCert Inc, OU = www.digicert.com, CN = DigiCert High Assurance EV Root CA
verify return:1
depth=1 C = US, O = DigiCert Inc, OU = www.digicert.com, CN = DigiCert SHA2 High Assurance Server CA
verify return:1
depth=0 C = US, ST = North Carolina, L = Raleigh, O = Red Hat Inc., CN = *.fedoraproject.org
verify return:1
---
Certificate chain
0 s:/C=US/ST=North Carolina/L=Raleigh/O=Red Hat Inc./CN=*.fedoraproject.org
i:/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert SHA2 High Assurance Server CA
1 s:/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert SHA2 High Assurance Server CA
i:/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert High Assurance EV Root CA
それも失敗する場合は、Sudo update-ca-trustを実行することをお勧めします。
また、確認する価値があるのは、caバンドルが実際にどこから来ているかです。
Sudo rpm -q --whatprovides /etc/pki/tls/certs/ca-bundle.crt
shouldはca-certificatesパッケージからのものですが、そうでない場合は、再インストールしてみてください。