Cannot verify review.coreboot.org's certificate, issued by ‘/C=US/O=Let's Encrypt/CN=R3’

[Mike Banon]

Good day! I just found out that my wgets at
http://dangerousprototypes.com/docs/Lenovo_G505S_hacking scripts (for
restoring & configuring the AMD opensource AGESA boards at modern
coreboot) - are failing because of this certificate error. To
reproduce this easily you do not have to run the whole csb_patcher.sh
or restore_agesa.sh - doing just a simple wget is more than enough,
i.e.:

wget "https://review.coreboot.org/changes/79838/revisions/2/patch?zip"

--2024-01-16 **:**:**--
https://review.coreboot.org/changes/79838/revisions/2/patch?zip
Resolving review.coreboot.org (review.coreboot.org)... **.**.***.***
Connecting to review.coreboot.org
(review.coreboot.org)|**.**.***.***|:443... connected.
ERROR: cannot verify review.coreboot.org's certificate, issued by
‘/C=US/O=Let's Encrypt/CN=R3’:
  Issued certificate has expired.
To connect to review.coreboot.org insecurely, use `--no-check-certificate'.

Please resolve this error

[Martin Roth]

Hey Mike,
Are you still seeing this issue? I ran the command you listed without an issue.

Here's what I'm seeing for the certificate:

Common Name (CN)	review.coreboot.org
Organization (O)	<Not Part Of Certificate>
Organizational Unit (OU)	<Not Part Of Certificate>
Common Name (CN)	R3
Organization (O)	Let's Encrypt
Organizational Unit (OU)	<Not Part Of Certificate>
Issued On	Thursday, December 21, 2023 at 4:07:50 PM
Expires On	Wednesday, March 20, 2024 at 5:07:49 PM

Martin
Jan 16, 2024, 06:16 by [e-mail]:
> Good day! I just found out that my wgets at
> http://dangerousprototypes.com/docs/Lenovo_G505S_hacking scripts (for
> restoring & configuring the AMD opensource AGESA boards at modern
> coreboot) - are failing because of this certificate error. To
> reproduce this easily you do not have to run the whole csb_patcher.sh
> or restore_agesa.sh - doing just a simple wget is more than enough,
> i.e.:
>
> wget "https://review.coreboot.org/changes/79838/revisions/2/patch?zip"
>
> --2024-01-16 **:**:**--
> https://review.coreboot.org/changes/79838/revisions/2/patch?zip
> Resolving review.coreboot.org (review.coreboot.org)... **.**.***.***
> Connecting to review.coreboot.org
> (review.coreboot.org)|**.**.***.***|:443... connected.
> ERROR: cannot verify review.coreboot.org's certificate, issued by
> ‘/C=US/O=Let's Encrypt/CN=R3’:
>  Issued certificate has expired.
> To connect to review.coreboot.org insecurely, use `--no-check-certificate'.
>
> Please resolve this error

[Patrick Georgi]

16. Januar 2024 14:15, "Mike Banon"  schrieb:
> Good day! I just found out that my wgets at
> http://dangerousprototypes.com/docs/Lenovo_G505S_hacking scripts (for
> restoring & configuring the AMD opensource AGESA boards at modern
> coreboot) - are failing because of this certificate error. To
> reproduce this easily you do not have to run the whole csb_patcher.sh
> or restore_agesa.sh - doing just a simple wget is more than enough,
> i.e.:
>
> wget "https://review.coreboot.org/changes/79838/revisions/2/patch?zip"

Works here.
> Issued certificate has expired.

The current cert is valid from 2023-12-22 to 2024-03-21. I wonder if your system clock is _way_ off.
For certificate issues, it helps if you check a third party first to see if they agree with your assessment that something is wrong with the cert - for example: https://www.ssllabs.com/ssltest/analyze.html?d=review.coreboot.org

Patrick

[Mike Banon]

Martin and Patrick, thank you very much for your replies! When I had
this problem I double-checked that my date & time were OK - so not
sure what really happened (hopefully not some MITM attempt etc) - but
a few hours later everything works fine now. I will follow your debug
suggestions in case this issue returns

On Tue, Jan 16, 2024 at 5:26 PM Patrick Georgi  wrote:
> Januar 2024 14:15, "Mike Banon"  schrieb:
> > Good day! I just found out that my wgets at
> > http://dangerousprototypes.com/docs/Lenovo_G505S_hacking scripts (for
> > restoring & configuring the AMD opensource AGESA boards at modern
> > coreboot) - are failing because of this certificate error. To
> > reproduce this easily you do not have to run the whole csb_patcher.sh
> > or restore_agesa.sh - doing just a simple wget is more than enough,
> > i.e.:
> >
> > wget "https://review.coreboot.org/changes/79838/revisions/2/patch?zip"
>
> Works here.
> > Issued certificate has expired.
>
> The current cert is valid from 2023-12-22 to 2024-03-21. I wonder if your system clock is _way_ off.
> For certificate issues, it helps if you check a third party first to see if they agree with your assessment that something is wrong with the cert - for example: https://www.ssllabs.com/ssltest/analyze.html?d=review.coreboot.org
>
> Patrick