#834724 curl: (35) gnutls_handshake() failed: Public key signature verification has failed.

Package:
curl
Source:
curl
Description:
command line tool for transferring data with URL syntax
Submitter:
Igor Bogomazov
Date:
2024-07-09 14:03:03 UTC
Severity:
important
#834724#5
Date:
2016-08-18 10:10:09 UTC
From:
To:
Public key verification fails on many legitimate URLs, one example:

{{{

$ curl -I https://duckduckgo.com
curl: (35) gnutls_handshake() failed: Public key signature verification has failed.

$ curl --version
curl 7.50.1 (x86_64-pc-linux-gnu) libcurl/7.50.1 GnuTLS/3.5.3 zlib/1.2.8 libidn/1.33 libssh2/1.7.0 nghttp2/1.13.0 librtmp/2.3
Protocols: dict file ftp ftps gopher http https imap imaps ldap ldaps pop3 pop3s rtmp rtsp scp sftp smb smbs smtp smtps telnet tftp
Features: AsynchDNS IDN IPv6 Largefile GSS-API Kerberos SPNEGO NTLM
NTLM_WB SSL libz TLS-SRP HTTP2 UnixSockets

}}}

it works perfect if downgraded to 7.38.0-4+deb8u3:

{{{

$ curl -I https://duckduckgo.com
HTTP/1.1 200 OK
Server: nginx
Date: Thu, 18 Aug 2016 10:03:59 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 5009
Connection: keep-alive
ETag: "57b56e74-1391"
Expires: Thu, 18 Aug 2016 10:03:58 GMT
Cache-Control: no-cache
Strict-Transport-Security: max-age=31536000
Accept-Ranges: bytes

$ curl --version
curl 7.38.0 (x86_64-pc-linux-gnu) libcurl/7.38.0 OpenSSL/1.0.1t zlib/1.2.8 libidn/1.33 libssh2/1.4.3 librtmp/2.3
Protocols: dict file ftp ftps gopher http https imap imaps ldap ldaps pop3 pop3s rtmp rtsp scp sftp smtp smtps telnet tftp
Features: AsynchDNS IDN IPv6 Largefile GSS-API SPNEGO NTLM NTLM_WB SSL
libz TLS-SRP

}}}
#834724#10
Date:
2016-09-28 10:14:33 UTC
From:
To:
I'm seeing all https accesses failing with curl.  Connecting to the same
sites with gnutls-cli works OK.

tim@ermintrude:~$ curl-config --ca
/etc/ssl/certs/ca-certificates.crt

tim@ermintrude:~$ curl -V
curl 7.50.1 (x86_64-pc-linux-gnu) libcurl/7.50.1 GnuTLS/3.5.4 zlib/1.2.8 libidn/1.33 libssh2/1.7.0 nghttp2/1.14.1 librtmp/2.3
Protocols: dict file ftp ftps gopher http https imap imaps ldap ldaps pop3 pop3s rtmp rtsp scp sftp smb smbs smtp smtps telnet tftp
Features: AsynchDNS IDN IPv6 Largefile GSS-API Kerberos SPNEGO NTLM NTLM_WB SSL libz TLS-SRP HTTP2 UnixSockets

tim@ermintrude:~$ curl -vv https://packages.debian.org/
*   Trying 128.31.0.51...
* Connected to packages.debian.org (128.31.0.51) port 443 (#0)
* found 175 certificates in /etc/ssl/certs/ca-certificates.crt
* found 702 certificates in /etc/ssl/certs
* ALPN, offering h2
* ALPN, offering http/1.1
* gnutls_handshake() failed: Public key signature verification has failed.
* Closing connection 0
curl: (35) gnutls_handshake() failed: Public key signature verification has failed.



tim@ermintrude:~$ gnutls-cli --x509cafile=/etc/ssl/certs/ca-certificates.crt -V packages.debian.org  443
Processed 175 CA certificate(s).
Resolving 'packages.debian.org:443'...
Connecting to '5.153.231.3:443'...
- Certificate type: X.509
- Got a certificate list of 2 certificates.
- Certificate[0] info:
 - X.509 Certificate Information:
        Version: 3
        Serial Number (hex): 03347b1421ebf70305b161317e6d2a634bab
        Issuer: C=US,O=Let's Encrypt,CN=Let's Encrypt Authority X3
        Validity:
                Not Before: Fri Sep 16 00:36:00 UTC 2016
                Not After: Thu Dec 15 00:36:00 UTC 2016
        Subject: CN=packages.debian.org
        Subject Public Key Algorithm: RSA
        Algorithm Security Level: High (4096 bits)

[....]

wApIvJSwtmVi4MFU5aMqrSDE6ea73Mj2tcMyo5jMd6jmeWUHK8so/joWUoHOUgwu
X4Po1QYz+3dszkDqMp4fklxBwXRsW10KXzPMTZ+sOPAveyxindmjkW8lGy+QsRlG
PfZ+G6Z6h7mjem0Y+iWlkYcV4PIWL1iwBi8saCbGS5jN2p8M+X+Q7UNKEkROb3N6
KOqkqm57TH2H3eDJAkSnh6/DNFu0Qg==
-----END CERTIFICATE-----

- Status: The certificate is trusted.
- Description: (TLS1.2)-(ECDHE-RSA-SECP256R1)-(AES-256-GCM)
- Session ID: 8E:71:45:94:73:64:AB:50:3B:E7:A7:E8:19:FB:33:2D:4B:E7:21:87:2A:7A:F3:BC:D3:84:FB:A5:FD:3D:31:73
- Ephemeral EC Diffie-Hellman parameters
 - Using curve: SECP256R1
 - Curve size: 256 bits
- Version: TLS1.2
- Key Exchange: ECDHE-RSA
- Server Signature: RSA-SHA256
- Cipher: AES-256-GCM
- MAC: AEAD
- Compression: NULL
- Options: safe renegotiation,
- Channel binding 'tls-unique': 80ae75b45d750a3230320aca
- Handshake was completed

- Simple Client Mode:
#834724#15
Date:
2016-09-28 11:57:49 UTC
From:
To:
I fixed this on a sid install by removing libgnutls-deb0-28 which was
being kept around by an old librtmp1 package version, left over from
Jessie debian-multimedia.  Possibly libcurl should conflict with this
package?
#834724#20
Date:
2016-11-13 01:22:21 UTC
From:
To:
Confirm that Tim Small solution worked for me as well. I am running
Debian Stretch and removing libgnutls-deb0-28 fixed the error.
#834724#25
Date:
2017-01-09 13:53:38 UTC
From:
To:
Dear Maintainer,

As Tim Small said in a previous message, removing libgnutls-deb0-28 solve the problem.

Note: I have installed curl 7.51.0-1 in jessie from stretch package swiching the repos from stable to testing without problem.
#834724#30
Date:
2017-10-16 09:19:17 UTC
From:
To:
Dear Maintainer,


We notice that after upgrading the package libcurl3-gnutls from version 7.38.0-4+deb8u6 to 7.52.1-5+deb9u1 that we get errors when running apt-get update. The errors only occur on repositories that use https.
You can find an example below.

For now we downgraded the packages to version 7.38.0-4+deb8u6 as a workaround, this allows us to keep getting updates from the repositories affected. But for servers running stretch, we couldn't downgrade without changing the repositories from stretch to jessie, which is something that we prefer not to do. Is there a fix available already or do we need to wait?

Example error:
################################################################################
W:Failed to fetch
https://apt.datadoghq.com/dists/stable/main/binary-amd64/Packages
gnutls_handshake() failed: Public key signature verification has failed.
################################################################################

Thank you in advance for your reply.

Best regards,

Jens Van Nieuwenhuyze
Sentia operations team
operations@be.sentia.com
#834724#35
Date:
2020-03-05 04:40:51 UTC
From:
To:
On Wed, 28 Sep 2016 12:57:49 +0100 Tim Small wrote: > Package: curl >
Followup-For: Bug #834724 > > I fixed this on a sid install by removing
libgnutls-deb0-28 which was > being kept around by an old librtmp1 package
version, left over from > Jessie debian-multimedia. Possibly libcurl should
conflict with this > package? > > -- System Information: > Debian Release:
stretch/sid > APT prefers unstable-debug > APT policy: (500,
'unstable-debug'), (500, 'unstable') > Architecture: amd64 (x86_64) >
Foreign Architectures: i386 > > Kernel: Linux 4.7.0-1-amd64 (SMP w/1 CPU
core) > Locale: LANG
#834724#40
Date:
2020-03-31 07:47:20 UTC
From:
To:
Roxanna Gabriela Quintanilla Cantu te envió un correo electrónico con el modo confidencial de Gmail:

[image: Logotipo de Gmail]Re: curl: (35) gnutls_handshake() failed: Public key signature verification has failed. <https://confidential-mail.google.com/msg/AA12eCh0Ye_7UjIjbubwpqFtK2MsHZZBjkkYcfx-9QEbNGpB0hLWFVbnWqrrB7PLRpkzWzdXaF07DpT5caxNopXiUaGYjdhnCjcijDY2KU86Rwu4OCC11fu9yMtCMuuq1y2YT31dfIbAzHsJptkgLvA1Br1vYJ9dybr2K2aCdjlwogeI>

Este mensaje se envió el 31 mar. 2020 a las 00:47:32 GMT-7
Puedes abrir el mensaje con el siguiente vínculo, que solo funcionará para 834724@bugs.debian.org.

Ver correo electrónico <https://confidential-mail.google.com/msg/AA12eCh0Ye_7UjIjbubwpqFtK2MsHZZBjkkYcfx-9QEbNGpB0hLWFVbnWqrrB7PLRpkzWzdXaF07DpT5caxNopXiUaGYjdhnCjcijDY2KU86Rwu4OCC11fu9yMtCMuuq1y2YT31dfIbAzHsJptkgLvA1Br1vYJ9dybr2K2aCdjlwogeI>

El Modo confidencial de Gmail te da más control sobre los mensajes que envías. Es posible que el remitente haya elegido establecer una fecha de vencimiento, inhabilitar la impresión o el reenvío, o dar seguimiento al acceso a este mensaje. Más información <https://support.google.com/mail/answer/7674059>
Gmail, el correo electrónico de Google
El uso está sujeto a la Política de Privacidad de Google <https://myaccount.google.com/privacypolicy?hl=es-419>
Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, EE.UU.
Recibiste este mensaje porque alguien te envió un correo electrónico con el modo confidencial de Gmail.
[image: Logotipo de Google]
#834724#45
Date:
2020-04-21 20:30:37 UTC
From:
To:
#834724#50
Date:
2020-07-22 04:39:31 UTC
From:
To:
R my phone still hacked
#834724#55
Date:
2020-10-07 00:45:28 UTC
From:
To:
#834724#60
Date:
2020-10-25 12:27:11 UTC
From:
To:
#834724#65
Date:
2020-10-25 12:34:26 UTC
From:
To:
در تاریخ یکشنبه ۲۵ اکتبر ۲۰۲۰،‏ ۱۶:۰۳ Debian Bug Tracking System <
owner@bugs.debian.org> نوشت:
#834724#70
Date:
2020-11-04 21:20:22 UTC
From:
To:
maris
#834724#75
Date:
2021-06-27 19:22:54 UTC
From:
To:
Sarim.love.mak.7
#834724#80
Date:
2021-07-14 14:26:07 UTC
From:
To:
#834724#85
Date:
2021-08-09 21:23:49 UTC
From:
To:
#834724#90
Date:
2021-10-20 22:11:13 UTC
From:
To:
#834724#95
Date:
2021-11-15 05:59:18 UTC
From:
To:
#834724#100
Date:
2021-11-15 06:00:06 UTC
From:
To:
#834724#105
Date:
2021-11-15 10:25:08 UTC
From:
To:
#834724#110
Date:
2021-11-17 12:32:30 UTC
From:
To:
#834724#115
Date:
2021-12-12 09:38:20 UTC
From:
To:
variable-length subnet mask (VLSM) for android. http://Gaak.co/ab3ufx

Stáhnout Outlook pro Android<https://aka.ms/AAb9ysg>
#834724#120
Date:
2021-12-14 18:46:56 UTC
From:
To:

Mehdi khanpor
#834724#125
Date:
2021-12-27 04:43:27 UTC
From:
To:
#834724#130
Date:
2021-12-30 03:59:12 UTC
From:
To:
#834724#135
Date:
2021-12-31 13:26:56 UTC
From:
To:
#834724#140
Date:
2022-01-11 17:59:52 UTC
From:
To:
#834724#145
Date:
2022-01-23 16:07:00 UTC
From:
To:
#834724#150
Date:
2022-02-07 09:39:48 UTC
From:
To:
#834724#155
Date:
2022-04-28 13:54:44 UTC
From:
To:
Enviado do meu smartphone Samsung Galaxy.
#834724#160
Date:
2022-04-28 13:55:51 UTC
From:
To:
#834724#165
Date:
2022-05-01 09:04:14 UTC
From:
To:
#834724#170
Date:
2022-05-17 15:55:41 UTC
From:
To:
#834724#175
Date:
2022-06-25 01:34:19 UTC
From:
To:
Redmi/cannong_eea/cannong:11/RP1A.200720.011/V12.5.10.0.RJEEUVF:user/release-keys
#834724#180
Date:
2022-07-05 22:27:53 UTC
From:
To:
1000261835642

Get Outlook for Android<https://aka.ms/AAb9ysg>
#834724#185
Date:
2022-07-19 15:54:18 UTC
From:
To:
#834724#190
Date:
2022-08-01 07:29:54 UTC
From:
To:
7.38.0-4+deb8u6 to 7.52.1-5+deb9u1 that we get errors when running apt-get
update. The errors only occur on repositories that use https.
workaround, this allows us to keep getting updates from the repositories
affected. But for servers running stretch, we couldn't downgrade without
changing the repositories from stretch to jessie, which is something that
we prefer not to do. Is there a fix available already or do we need to wait?
################################################################################
################################################################################
(charmap=ANSI_X3.4-1968)
#834724#195
Date:
2022-09-02 17:19:40 UTC
From:
To:
#834724#200
Date:
2022-09-24 16:12:50 UTC
From:
To:
My: Name is Asad Shadali
My gmail is dsayidomar@gmail.com
My.NO.:+251915003598
#834724#205
Date:
2022-09-26 19:25:49 UTC
From:
To:
#834724#210
Date:
2022-09-26 19:27:19 UTC
From:
To:
#834724#215
Date:
2022-09-30 03:05:10 UTC
From:
To:
#834724#220
Date:
2022-09-30 03:28:23 UTC
From:
To:
#834724#225
Date:
2022-09-30 19:03:09 UTC
From:
To:
Sent from Yahoo Mail on Android
#834724#230
Date:
2022-10-01 23:52:43 UTC
From:
To:
Get Outlook for Android<https://aka.ms/AAb9ysg>
#834724#235
Date:
2022-10-01 23:52:49 UTC
From:
To:
#834724#240
Date:
2022-10-01 23:53:03 UTC
From:
To:
Sent from Yahoo Mail on Android
#834724#245
Date:
2022-10-02 20:59:59 UTC
From:
To:
#834724#250
Date:
2022-11-14 05:55:18 UTC
From:
To:
#834724#255
Date:
2022-11-15 22:28:42 UTC
From:
To:
#834724#260
Date:
2022-11-26 12:28:41 UTC
From:
To:
Google





Rafal Franczak


Rafal Franczak

Udostępniam Ci swój profil






Zobacz w Mapach Google




Google

© 2018 Google LLC 1600 Amphitheatre Parkway, Mountain View, CA 94043

Wysłane przez: Rafal Franczak w Mapach Google
#834724#265
Date:
2024-07-09 14:00:34 UTC
From:
To:
On Mon, 1 Aug 2022 02:29:54 -0500 Flor Canales <canalesflor853@gmail.com> wrote:
wait?
################################################################################
################################################################################