#1 2022-01-07 10:44:10
- YanMingHao
- 会员
- 注册时间： 2022-01-07
- 帖子： 7
通过yay命令安装软件失败，提示git clone失败，更换为手机热点后，提示https下载失败
用公司网络下载wechat提示
yay wechat
提示
fatal: 无法访问 'https://aur.tuna.tsinghua.edu.cn/wechat-uos.git/'：SSL certificate problem: unable to get local issuer certificate
context: exit status 128
翻阅相关资料有人说更换网络解决
更换手机网络后不提示此错误
出现新的错误
curl: (60) SSL certificate problem: unable to get local issuer certificate
More details here: https://curl.se/docs/sslcerts.html
curl failed to verify the legitimacy of the server and therefore could not
establish a secure connection to it. To learn more about this situation and
how to fix it, please visit the web page mentioned above.
==> 错误： 无法下载 https://home-store-packages.uniontech.c … _amd64.deb
正在放弃...
-> 生成时出错: wechat-uos
实在是找不到原因了，希望有大佬帮助解决一下
离线
#2 2022-01-07 11:02:43
- 依云
- 会员
- 所在地： a.k.a. 百合仙子
- 注册时间： 2011-08-21
- 帖子： 8,961
- 个人网站
Re: 通过yay命令安装软件失败，提示git clone失败，更换为手机热点后，提示https下载失败
curl -v https://aur.tuna.tsinghua.edu.cn
curl --version
离线
#3 2022-01-07 11:27:19
- YanMingHao
- 会员
- 注册时间： 2022-01-07
- 帖子： 7
Re: 通过yay命令安装软件失败，提示git clone失败，更换为手机热点后，提示https下载失败
> curl -v https://aur.tuna.tsinghua.edu.cn
* Trying 101.6.15.130:443...
* Connected to aur.tuna.tsinghua.edu.cn (101.6.15.130) port 443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* CAfile: /etc/ssl/certs/ca-certificates.crt
* CApath: none
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* TLSv1.3 (IN), TLS handshake, Server hello (2):
* TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):
* TLSv1.3 (IN), TLS handshake, Certificate (11):
* TLSv1.3 (OUT), TLS alert, unknown CA (560):
* SSL certificate problem: unable to get local issuer certificate
* Closing connection 0
curl: (60) SSL certificate problem: unable to get local issuer certificate
More details here: https://curl.se/docs/sslcerts.html
curl failed to verify the legitimacy of the server and therefore could not
establish a secure connection to it. To learn more about this situation and
how to fix it, please visit the web page mentioned above.
curl --version
curl 7.80.0 (x86_64-pc-linux-gnu) libcurl/7.80.0 OpenSSL/1.1.1m zlib/1.2.11 brotli/1.0.9 zstd/1.5.1 libidn2/2.3.2 libpsl/0.21.1 (+libidn2/2.3.0) libssh2/1.10.0 nghttp2/1.46.0
Release-Date: 2021-11-10
Protocols: dict file ftp ftps gopher gophers http https imap imaps mqtt pop3 pop3s rtsp scp sftp smb smbs smtp smtps telnet tftp
Features: alt-svc AsynchDNS brotli GSS-API HSTS HTTP2 HTTPS-proxy IDN IPv6 Kerberos Largefile libz NTLM NTLM_WB PSL SPNEGO SSL TLS-SRP UnixSockets zstd
看到了同样的问题
curl: (60) SSL certificate problem: unable to get local issuer certificate
More details here: https://curl.se/docs/sslcerts.html
离线
#4 2022-01-07 11:39:43
- YanMingHao
- 会员
- 注册时间： 2022-01-07
- 帖子： 7
Re: 通过yay命令安装软件失败，提示git clone失败，更换为手机热点后，提示https下载失败
curl -v https://aur.tuna.tsinghua.edu.cn
curl --version
> curl -v https://aur.tuna.tsinghua.edu.cn
* Trying 101.6.15.130:443...
* Connected to aur.tuna.tsinghua.edu.cn (101.6.15.130) port 443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* CAfile: /etc/ssl/certs/ca-certificates.crt
* CApath: none
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* TLSv1.3 (IN), TLS handshake, Server hello (2):
* TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):
* TLSv1.3 (IN), TLS handshake, Certificate (11):
* TLSv1.3 (OUT), TLS alert, unknown CA (560):
* SSL certificate problem: unable to get local issuer certificate
* Closing connection 0
curl: (60) SSL certificate problem: unable to get local issuer certificate
More details here: https://curl.se/docs/sslcerts.html
curl failed to verify the legitimacy of the server and therefore could not
establish a secure connection to it. To learn more about this situation and
how to fix it, please visit the web page mentioned above.
curl --version
curl 7.80.0 (x86_64-pc-linux-gnu) libcurl/7.80.0 OpenSSL/1.1.1m zlib/1.2.11 brotli/1.0.9 zstd/1.5.1 libidn2/2.3.2 libpsl/0.21.1 (+libidn2/2.3.0) libssh2/1.10.0 nghttp2/1.46.0
Release-Date: 2021-11-10
Protocols: dict file ftp ftps gopher gophers http https imap imaps mqtt pop3 pop3s rtsp scp sftp smb smbs smtp smtps telnet tftp
Features: alt-svc AsynchDNS brotli GSS-API HSTS HTTP2 HTTPS-proxy IDN IPv6 Kerberos Largefile libz NTLM NTLM_WB PSL SPNEGO SSL TLS-SRP UnixSockets zstd
看到了同样的问题
curl: (60) SSL certificate problem: unable to get local issuer certificate
More details here: https://curl.se/docs/sslcerts.html
离线
#5 2022-01-07 12:27:54
- 依云
- 会员
- 所在地： a.k.a. 百合仙子
- 注册时间： 2011-08-21
- 帖子： 8,961
- 个人网站
Re: 通过yay命令安装软件失败，提示git clone失败，更换为手机热点后，提示https下载失败
ls -lL /etc/ssl/certs/ca-certificates.crt
看看本地证书文件正常不？
另外你的 curl 有些旧啊。
离线
#6 2022-01-07 12:54:31
- YanMingHao
- 会员
- 注册时间： 2022-01-07
- 帖子： 7
Re: 通过yay命令安装软件失败，提示git clone失败，更换为手机热点后，提示https下载失败
ls -lL /etc/ssl/certs/ca-certificates.crt
看看本地证书文件正常不？
另外你的 curl 有些旧啊。
> ls -lL /etc/ssl/certs/ca-certificates.crt
-r--r--r-- 1 root root 208919 1月 7 09:48 /etc/ssl/certs/ca-certificates.crt
我之前看资料，下载过crt文件
放在curlssl内，然后添加环境变量
> cd curlssl
> ls
aur.archlinux.org-key.pem aur.archlinux.org.pem cacert-2021-10-26.crt cacert.pem
/etc/profile 增加环境变量
export CURL_CA_BUNDLE=/home/yanminghao/curlssl/cacert.pem
还需要看什么排查下，感谢回复了
离线
#7 2022-01-07 13:34:21
- 依云
- 会员
- 所在地： a.k.a. 百合仙子
- 注册时间： 2011-08-21
- 帖子： 8,961
- 个人网站
Re: 通过yay命令安装软件失败，提示git clone失败，更换为手机热点后，提示https下载失败
啥？你不要乱下根证书列表啊。
看看这个命令的输出：
openssl s_client -connect aur.tuna.tsinghua.edu.cn:443 -servername aur.tuna.tsinghua.edu.cn
（输出不动了之后按 Ctrl-C 或者 Ctrl-D 结束）
离线
#8 2022-01-07 13:42:35
- YanMingHao
- 会员
- 注册时间： 2022-01-07
- 帖子： 7
Re: 通过yay命令安装软件失败，提示git clone失败，更换为手机热点后，提示https下载失败
啥？你不要乱下根证书列表啊。
看看这个命令的输出：
openssl s_client -connect aur.tuna.tsinghua.edu.cn:443 -servername aur.tuna.tsinghua.edu.cn
（输出不动了之后按 Ctrl-C 或者 Ctrl-D 结束）
再次万分感谢你的回复
> openssl s_client -connect aur.tuna.tsinghua.edu.cn:443 -servername aur.tuna.tsinghua.edu.cn
CONNECTED(00000003)
depth=0 CN = tuna.tsinghua.edu.cn
verify error:num=20:unable to get local issuer certificate
verify return:1
depth=0 CN = tuna.tsinghua.edu.cn
verify error:num=21:unable to verify the first certificate
verify return:1
depth=0 CN = tuna.tsinghua.edu.cn
verify return:1
---
Certificate chain
0 s:CN = tuna.tsinghua.edu.cn
i:C = EN, CN = UniKNetRootSSLCert 2
---
Server certificate
-----BEGIN CERTIFICATE-----
MIICujCCAaKgAwIBAgIRANJpqWMo2w0ZCgi9xgYkukowDQYJKoZIhvcNAQELBQAw
LDELMAkGA1UEBhMCRU4xHTAbBgNVBAMMFFVuaUtOZXRSb290U1NMQ2VydCAyMB4X
DTIxMTIxNTAyNDIzMloXDTIyMDMxNTAyNDIzMVowHzEdMBsGA1UEAxMUdHVuYS50
c2luZ2h1YS5lZHUuY24wgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBANnp/sxJ
cXJ6v3DpVGkiwcq3Gnybc+IdRBLYncNEJH52jKd+dBZ63NdpUQLHyqmzrQODWBpV
wpQdkLAYwRRoXMB7eanY8rgA09AgDOisombuCFhFkJVxI69ZxR8wyfIfD6pi5wvp
UtXYOVY2mg7hOj5XoVwe9F8FtKIF4U3Oo2TrAgMBAAGjaDBmMDcGA1UdEQQwMC6C
FioudHVuYS50c2luZ2h1YS5lZHUuY26CFHR1bmEudHNpbmdodWEuZWR1LmNuMAwG
A1UdEwEB/wQCMAAwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMA0GCSqG
SIb3DQEBCwUAA4IBAQCi8rRds1370PGwJtk4HOBZilSUVDQLgLCKImhWgIBeOGVR
GnjF6zBj39tOcaDvhoWqPiH5dn5cMEYks4+LNbGYrrgnBOccXMU/IH9ndpnTECvT
wp6PezsB7Xz+0mA2egQEeiiZQU3Fg7bIQKT0s89usNwdEhyksiBjbx0s7B46M+IA
26sV1oNwZYHLxCxsYty2OMUV7ljP9JqNmYtS11zsDeZjjCCeGhF1+xyPU23FeEAH
/d0tuPEosaTgs1/H20GNtI4Ca3jGlCLDUB9nLQ5Fd2OFm9xjcC9uG/uQVNn29M4I
U4mjVnvzKItyx9IJwmTtMuxeBOijVk2FKGSmlUIi
-----END CERTIFICATE-----
subject=CN = tuna.tsinghua.edu.cn
issuer=C = EN, CN = UniKNetRootSSLCert 2
---
No client certificate CA names sent
Peer signing digest: SHA256
Peer signature type: RSA-PSS
Server Temp Key: X25519, 253 bits
---
SSL handshake has read 1130 bytes and written 406 bytes
Verification error: unable to verify the first certificate
---
New, TLSv1.3, Cipher is TLS_AES_256_GCM_SHA384
Server public key is 1024 bit
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
Early data was not sent
Verify return code: 21 (unable to verify the first certificate)
---
---
Post-Handshake New Session Ticket arrived:
SSL-Session:
Protocol : TLSv1.3
Cipher : TLS_AES_256_GCM_SHA384
Session-ID: E2D6EBD0964945A565E0036EC884B4D369F8434957A88CA2786A95F236FC1538
Session-ID-ctx:
Resumption PSK: E4C94A9895A02A3356935B5DFDC876C7333663D6B5C0671B9D64DBCE81F864E5B36E4D351E387ADF3F885591B11043B5
PSK identity: None
PSK identity hint: None
SRP username: None
TLS session ticket lifetime hint: 7200 (seconds)
TLS session ticket:
0000 - ca ed 67 23 e2 5d 7b d9-15 69 f1 a1 a1 0b 93 54 ..g#.]{..i.....T
0010 - ad e4 33 b8 1d 97 4e d9-1d b4 67 5e 63 16 a7 1d ..3...N...g^c...
0020 - 34 05 5e ad dd 23 71 e3-52 30 d3 7b 9d f1 e9 b8 4.^..#q.R0.{....
0030 - fe 1c 13 36 b9 b2 da 85-56 42 27 33 bd 4b 01 16 ...6....VB'3.K..
0040 - b5 9d 26 ab e6 4a 95 d9-77 64 36 c5 70 cc 20 28 ..&..J..wd6.p. (
0050 - f9 84 01 29 8d 98 96 04-15 f0 b2 aa 3c fa eb c4 ...)........<...
0060 - 33 46 49 4e ce cd 2f c1-26 99 56 f0 67 e2 ce 8a 3FIN../.&.V.g...
0070 - d1 cc 93 56 7e f5 88 91-cf 23 34 0e 82 62 e9 41 ...V~....#4..b.A
0080 - a9 b4 3c 25 5b 2b 5a 63-90 4f 8f 2a a2 5d e5 f3 ..<%[+Zc.O.*.]..
0090 - 27 c0 07 6a 4b 3c bb 75-83 c5 47 21 73 83 c6 0b '..jK<.u..G!s...
00a0 - f8 f7 e9 4b c5 4a a4 4a-3d 56 d0 77 1c 01 2c f7 ...K.J.J=V.w..,.
00b0 - ab da 6f 09 4e 42 7b 9d-e8 f5 03 91 39 6d 12 57 ..o.NB{.....9m.W
Start Time: 1641534096
Timeout : 7200 (sec)
Verify return code: 21 (unable to verify the first certificate)
Extended master secret: no
Max Early Data: 0
---
read R BLOCK
---
Post-Handshake New Session Ticket arrived:
SSL-Session:
Protocol : TLSv1.3
Cipher : TLS_AES_256_GCM_SHA384
Session-ID: 334F93AB4C8B297B7A18724340937FFFDCC3EF13D75DB84247746C0C3FA3FE6D
Session-ID-ctx:
Resumption PSK: 75C9E0785F0B7C23E7A485872AF68B8CC28F716E211F08E412E8150AC1B3553B6E3C963C24DED7DA394F0C8ADFD4584F
PSK identity: None
PSK identity hint: None
SRP username: None
TLS session ticket lifetime hint: 7200 (seconds)
TLS session ticket:
0000 - ca ed 67 23 e2 5d 7b d9-15 69 f1 a1 a1 0b 93 54 ..g#.]{..i.....T
0010 - f7 db 2e e9 b9 9d 63 6d-c3 28 ee 9c 0f 69 81 e3 ......cm.(...i..
0020 - a5 68 f1 11 2d 81 ef 03-4d af c3 5b be 3d 06 bd .h..-...M..[.=..
0030 - 64 59 75 c2 fe e0 3c 9f-18 fd 23 67 27 3f 0f 44 dYu...<...#g'?.D
0040 - df 83 90 c1 4e 02 a8 1b-be 13 a4 8b 23 29 27 20 ....N.......#)'
0050 - 8b 45 39 12 71 91 ae 52-d0 6f f5 7e b2 e2 88 ad .E9.q..R.o.~....
0060 - 34 40 a0 55 e8 75 54 09-f7 02 3a 81 69 e5 5b 5a 4@.U.uT...:.i.[Z
0070 - 0d 46 d0 38 41 47 41 fd-c2 bf ed 1e 7e a0 96 88 .F.8AGA.....~...
0080 - 00 3c 9c 92 55 88 c2 82-28 24 e6 6c d2 26 77 b1 .<..U...($.l.&w.
0090 - 90 d4 5e a8 22 88 d8 25-3e 05 cb 60 66 1f 8b cd ..^."..%>..`f...
00a0 - 8a 78 be 9d c1 8f 8a 7f-e7 a7 46 ab 6b 02 c2 ef .x........F.k...
00b0 - 3d 7b 00 64 25 c2 4f 99-75 88 68 cd ee 9c 22 d3 ={.d%.O.u.h...".
Start Time: 1641534096
Timeout : 7200 (sec)
Verify return code: 21 (unable to verify the first certificate)
Extended master secret: no
Max Early Data: 0
---
read R BLOCK
这是输出结果，我在普通用户下输出
离线
#9 2022-01-07 14:08:37
- 依云
- 会员
- 所在地： a.k.a. 百合仙子
- 注册时间： 2011-08-21
- 帖子： 8,961
- 个人网站
Re: 通过yay命令安装软件失败，提示git clone失败，更换为手机热点后，提示https下载失败
UniKNetRootSSLCert 2 这是谁啊。你的网络上有中间人，替换了 TLS 证书。
离线
#10 2022-01-07 14:14:58
- YanMingHao
- 会员
- 注册时间： 2022-01-07
- 帖子： 7
Re: 通过yay命令安装软件失败，提示git clone失败，更换为手机热点后，提示https下载失败
UniKNetRootSSLCert 2 这是谁啊。你的网络上有中间人，替换了 TLS 证书。
实在抱歉这个我不是很懂， 我知道的只有我目前系统上存在v2ray代理不知道跟这个有没有关系， UniKNetRootSSLCert这个有什么办法查看吗或者怎么消除它
离线
#11 2022-01-07 15:53:02
- 依云
- 会员
- 所在地： a.k.a. 百合仙子
- 注册时间： 2011-08-21
- 帖子： 8,961
- 个人网站
Re: 通过yay命令安装软件失败，提示git clone失败，更换为手机热点后，提示https下载失败
v2ray 不会给你乱喂证书啊。
UniKNetRootSSLCert 这个名字在网络上完全搜不到。
你是不是你所在的组织或者 ISP 啥的干的？
离线
#12 2022-01-07 16:05:06
- YanMingHao
- 会员
- 注册时间： 2022-01-07
- 帖子： 7
Re: 通过yay命令安装软件失败，提示git clone失败，更换为手机热点后，提示https下载失败
v2ray 不会给你乱喂证书啊。
UniKNetRootSSLCert 这个名字在网络上完全搜不到。
你是不是你所在的组织或者 ISP 啥的干的？
这个稍后我去问问我们的it部门， 如果是公司内部搞的， 那我用热点之类的应该会绕过吧？
离线
#13 2022-01-07 16:17:16
- 依云
- 会员
- 所在地： a.k.a. 百合仙子
- 注册时间： 2011-08-21
- 帖子： 8,961
- 个人网站
Re: 通过yay命令安装软件失败，提示git clone失败，更换为手机热点后，提示https下载失败
嗯。不过你得先确定公司允许你这么搞。请不要违反公司规定。
离线