/dev/chat - 2020-10-25

« first day (3669 days earlier) ← previous day next day → last day (1268 days later) »

9:16 AM

@Tim It's generally unnecessary to post U&L questions in U&L chat. They appear in the feed.

And they create pointless clutter. Imagine if everyone did that.

2 hours later…

10:56 AM

@FaheemMitha it's at software engineering (still spam though)

11:54 AM

@AndrasDeak Do you mean the "spam" defined in systematically discriminating policy?

This is a politically charged era

12:40 PM

@Tim no, I meant the more traditional meaning of "unsolicited advertisement with no mutual benefit". Otherwise I'd have flagged.

1:38 PM

@AndrasDeak as "unsolicited advertisement with no mutual benefit" as in chat.stackexchange.com/transcript/message/55788084#55788084 ?

and more

1:50 PM

Yes, I absolutely posted that to fish for upvotes or get an answer to my problem, rather than just taking part in a discussion with a regular here :)

So I was "fishing" and "spamming". What was yours?

@FaheemMitha I forgot to tell you that two weeks ago I had to compile my beamer slides with lualatex. I wanted to typeset IPA characters and I needed lualatex's unicode support.

It was still pretty painful due to font issues

I was just about to include a screenshot from wikipedia when it started to work :)

2:06 PM

@Tim he removed 48 messages because local news is off-topic.

2 hours later…

3:48 PM

@AndrasDeak Oh, my mistake. Though that's an odd place to post it. Actually, U&L would be an odd place too. SO might be on topic. Though I would expect something like that to already have been covered there. Assuming it needed asking in the first place.

@AndrasDeak TeX SE is pretty helpful. Just FYI.

Font issues are frequently a pain. I think it's still a work in progress. With LuaTeX, at least. They've just transitioned to Harfbuzz recently.

With that change, LuaTeX is probably going to become the dominant TeX engine. At least David Carlisle thought so, when the subject came up some time ago.

But font issues are likely to be around for a long time, if not forever. It's a moving target.

@AndrasDeak I don't understand what Wikipedia has to do with it.

1 hour later…

5:15 PM

@FaheemMitha yeah, it could go on SO but it's opinionated and partly answered, and most importantly he's suspended there.

@FaheemMitha I know :) I got some help in chat

@FaheemMitha only that the IPA I wanted to include in my slide came from wikipedia, so it would've been a straightforward source for a screenshot

sorry for being confusing

@AndrasDeak I see.

@AndrasDeak Mostly it's David that answers. At least to me. Otherwise the other denizens mostly scorn me, alas.

@FaheemMitha that's not nice. Are you certain that's the case?

5:36 PM

Does anyone have experience trying to connect to local host?

I'm using Fedora, and created a server using openssl like this:

$ openssl s_server -key privkey.pem -cert certificate.pem -accept 5000 -WWW

But when I try to connect to localhost port 5000 using wget --no-check-certificate https://localhost:5000 I get the following error:

Read error at byte 231 (The TLS connection was non-properly terminated.).Retrying

Curl is also not connecting to localhost:

curl --cacert certificate.pem "https://localhost:5000"

Error opening ''
139816815204160:error:02001002:system library:fopen:No such file or directory:crypto/bio/bss_file.c:69:fopen('','r')
139816815204160:error:2006D080:BIO routines:BIO_new_file:no such file:crypto/bio/bss_file.c:76:

6:07 PM

@AndrasDeak Mostly, yes. But it's ok. They're not obliged to answer.

Sometimes Phylepe answers if he's around. He's cool.

@BlackPanther Check what you have in /etc/hosts. It might be relevant.

@FaheemMitha Thanks. This is what is in /etc/hosts:

$ cat /etc/hosts
127.0.0.1   localhost localhost.localdomain localhost4 localhost4.localdomain4
::1         localhost localhost.localdomain localhost6 localhost6.localdomain6

@BlackPanther Looks like that should be ok. I suppose you can ping localhost?

And is 5000 accepting connections?

I'm not sure what configuration would be necessary, if any.

@FaheemMitha these are the tutorials I followed describing how to add a self trusted certificate on Fedora:
* https://www.devdungeon.com/content/how-add-trusted-ca-certificate-centosfedora
* https://www.devdungeon.com/content/creating-self-signed-ssl-certificates-openssl

@FaheemMitha How do I ping localhost?

@BlackPanther Something like ping -c 5 localhost to start with.

Actually, judging from your error message, connecting per se is unlikely to be the problem.

Trying to go to localhost on chrome shows the error/warning:

Your connection is not private
Attackers might be trying to steal your information from localhost (for example, passwords, messages or credit cards). Learn more
NET::ERR_CERT_AUTHORITY_INVALID

Help improve security on the web for everyone by sending URLs of some pages that you visit, limited system information, and some page content to Google. Privacy policy

:55942135 $ ping -c 5 localhost
PING localhost(localhost (::1)) 56 data bytes
64 bytes from localhost (::1): icmp_seq=1 ttl=64 time=0.058 ms
64 bytes from localhost (::1): icmp_seq=2 ttl=64 time=0.032 ms
64 bytes from localhost (::1): icmp_seq=3 ttl=64 time=0.036 ms
64 bytes from localhost (::1): icmp_seq=4 ttl=64 time=0.035 ms
64 bytes from localhost (::1): icmp_seq=5 ttl=64 time=0.035 ms

--- localhost ping statistics ---
5 packets transmitted, 5 received, 0% packet loss, time 4109ms
rtt min/avg/max/mdev = 0.032/0.039/0.058/0.009 ms

6:21 PM

@BlackPanther Go how? Did try ping first?

@FaheemMitha See previous message :). What does the output of ping mean?

@BlackPanther You sent some bytes to the destination, and got them echoed back. That's normal behavior.

@BlackPanther And this error message corresponds to what command?

One imagines the command identified in the previous message ending with a colon

Does openssl s_client manage to connect?

@FaheemMitha Going to the URL https://localhost:5000/ using chrome.

@MichaelHomer Unfortunately no, see the output below:

$ openssl s_client
140363267090240:error:0200206F:system library:connect:Connection refused:crypto/bio/b_sock2.c:110:
140363267090240:error:2008A067:BIO routines:BIO_connect:connect error:crypto/bio/b_sock2.c:111:
140363267090240:error:0200206F:system library:connect:Connection refused:crypto/bio/b_sock2.c:110:
140363267090240:error:2008A067:BIO routines:BIO_connect:connect error:crypto/bio/b_sock2.c:111:
connect:errno=111

This is what the command that is running an HTTPS server using openssl now looks like:

$ openssl s_server -key privkey.pem -cert certificate.pem -accept 5000 -WWW
Using default temp DH parameters
ACCEPT
139816815204160:error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown:ssl/record/rec_layer_s3.c:1543:SSL alert number 46
139816815204160:error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown:ssl/record/rec_layer_s3.c:1543:SSL alert number 46
139816815204160:error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown:ssl/record/rec_layer_s3.c:1543:SSL alert number 46

@FaheemMitha Cool, that must be what pinging is.

@BlackPanther Oh. Right.

@BlackPanther Yes, that's what pinging means.

@BlackPanther I'd guess your certificate isn't quite right.

Trying doing searches for your error messages. Sometimes that can help.

6:37 PM

openssl s_client -host localhost -port 5000 connects successfully to me, and I'm able to get an HTTP response

@MichaelHomer How did you set up the server?

Did you do it like this $ openssl s_server -key privkey.pem -cert certificate.pem -accept 5000 -WWW?

openssl req -newkey rsa:2048 -nodes -keyout key.pem -x509 -days 365 -out certificate.pem & openssl s_server -key key.pem -cert certificate.pem -accept 5000 -WWW

@MichaelHomer I get an error message too.

faheem@orwell:~$ openssl s_client -host localhost -port 5000
139822599434496:error:0200206F:system library:connect:Connection refused:../crypto/bio/b_sock2.c:110:
139822599434496:error:2008A067:BIO routines:BIO_connect:connect error:../crypto/bio/b_sock2.c:111:
139822599434496:error:0200206F:system library:connect:Connection refused:../crypto/bio/b_sock2.c:110:
139822599434496:error:2008A067:BIO routines:BIO_connect:connect error:../crypto/bio/b_sock2.c:111:
connect:errno=111

Of course, I haven't set up anything.

s_client validates if I give it -CAfile too

Also works in Firefox (if I manually accept the certificate)

We're making some progress, I am now getting this when I run the following command provided by @MichaelHomer :

$ openssl s_client -host localhost -port 5000
CONNECTED(00000003)
...
...
 Start Time: 1603651208
    Timeout   : 7200 (sec)
    Verify return code: 0 (ok)
    Extended master secret: no
    Max Early Data: 0
---
read R BLOCK

The two ... in the above are many lines of output that I am skipping

6:44 PM

Right, so now you type GET / HTTP/1.0

GET / HTTP/1.0
HTTP/1.0 200 ok
Content-type: text/plain

@MichaelHomer Do you mean type it into standard input of openssl s_client?

yes

It's not actually validating your certificate unless you use -CAfile certificate.pem/add it to your trust store, but if it got to that point the connection & negotiation succeeded

Thanks, this is what happens when I type GET /HTTP/1.0

GET /HTTP/1.0
HTTP/1.0 200 ok
Content-type: text/plain

'HTTP/1.0
' is an invalid file name
read:errno=0

try typing what I said instead

@MichaelHomer Typing what, sorry?

6:48 PM

4 mins ago, by Michael Homer

Right, so now you type GET / HTTP/1.0

I've tried it, here it is:

GET /HTTP/1.0
HTTP/1.0 200 ok
Content-type: text/plain

'HTTP/1.0
' is an invalid file name
read:errno=0

@MichaelHomer I've already added the cerificate.pem to Fedora's trust store by copying it to /etc/pki/ca-trust/source/anchors/ and then running sudo update-ca-trust.

@FaheemMitha Are you on fedora?

@BlackPanther No, Debian.

1) look closer; 2) here is something for you to copy and paste in: GET /certificate.pem HTTP/1.0

@MichaelHomer Thanks, I missed the subtle warning. Now this is exactly what I get after typing GET /certificate.pem HTTP/1.0 (I hope there's no sensitive information here):

GET /certificate.pem HTTP/1.0
HTTP/1.0 200 ok
Content-type: text/plain

-----BEGIN CERTIFICATE-----
MIIDlzCCAn8CFENS8BrWOsFLm+UnWUSTDUL55fuEMA0GCSqGSIb3DQEBCwUAMIGH
MQswCQYDVQQGEwJHQjEPMA0GA1UECAwGTG9uZG9uMQ4wDAYDVQQHDAVFYXJ0aDEU
MBIGA1UECgwLQ29tcGFueU5hbWUxCzAJBgNVBAsMAklUMRIwEAYDVQQDDAlsb2Nh
bGhvc3QxIDAeBgkqhkiG9w0BCQEWEWVtYWlsQGV4YW1wbGUuY29tMB4XDTIwMTAy
NTE2MjkyMVoXDTIxMTAyNTE2MjkyMVowgYcxCzAJBgNVBAYTAkdCMQ8wDQYDVQQI
DAZMb25kb24xDjAMBgNVBAcMBUVhcnRoMRQwEgYDVQQKDAtDb21wYW55TmFtZTEL
MAkGA1UECwwCSVQxEjAQBgNVBAMMCWxvY2FsaG9zdDEgMB4GCSqGSIb3DQEJARYR

@MichaelHomer does everything look okay?

7:04 PM

yes, that is an HTTP response

localhost:5000/certificate.pem

@MichaelHomer Thanks for confirming it works

Sorry, chrome keeps crashing. Had to switch to Firefox.

@MichaelHomer Going to localhost:5000/certificate.pem on chrome shows the following page:

user image

And now my terminal session has crashed too. Gotta think about getting tmux soon.

Yes, that's saying it's a self-signed certificate (but connected successfully otherwise)

@MichaelHomer Hmm, how come it's not connected successfully?

it's a self-signed certificate

You can continue with the connection under "advanced"

7:24 PM

I think I understand this error NET::ERR_CERT_COMMON_NAME_INVALID.

The common name I provided was localhost, so not sure why chrome says it's invalid.

It will happily show you the certificate details, so you can check

Okay, selected "Proceed to localhost (unsafe)".

In any case, though, this is the point where it's time to move on to what you're actually trying to do; s_server has done its job and it doesn't get any better

Chrome is still saying that localhost:5000/certificate.pem is not secure.

Even after creating a self signed certificate and trusting it using update-ca-trust?

It may not use the system trust store. I don't think Firefox does at all

7:31 PM

Silly question: can Let's Encrypt certify localhost?

no

Figures...

If what you want is an HTTPS-capable web server for localhost, I understand that Caddy automatically installs its certificate everywhere it needs to be

I haven't used it for that

@MichaelHomer This is what I found for chromium. I'm using chrome so not sure it applies, and that web page might be old/not updated:

chromium.googlesource.com/chromium/src/+/refs/heads/lkgr/docs/…

I don't know, maybe ask on the site

7:38 PM

If I may ask, what is openssl command used for here?

When you develop a web application, is TSL/SSL hidden from you, and you only need to tell the web server (where the application is deployed) to use TSL/SSL?

If I remember correctly, in .NET Core, it is like that. So I didn't get to learn about openssl

@MichaelHomer Okay thanks.

@Tim I'm actually using .NET core on Fedora for a web app, and ran into that untrusted certificate problem on chrome.

@Tim My idea is to use configure Kestrel to use a self-signed certificate to enable HTTPS locally.

@MichaelHomer Thanks for the recommendation, I'll keep an eye out for Caddy. For now though I think I need to use Kestrel for .NET Core.

@MichaelHomer Curl seems to be working:

$ curl -v localhost:5000/certificate.pem
*   Trying ::1:5000...
* TCP_NODELAY set
* Connected to localhost (::1) port 5000 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* successfully set certificate verify locations:
*   CAfile: /etc/pki/tls/certs/ca-bundle.crt
  CApath: none
* TLSv1.3 (OUT), TLS handshake, Client hello (1):

@BlackPanther Thanks. Do you have some relevant documents for reading?

@Tim No problem :). One of the docs I'm using is this microsoft blog post: devblogs.microsoft.com/aspnet/…

caddy reverse-proxy --to localhost:5000

7:54 PM

@Tim It skips the part about trusting the self-signed certificate, but says it is optional. If I can't get chrome to stop warning me about using a self-signed certificate, I think I'll move on like @MichaelHomer suggested. Have to know when to.

@MichaelHomer I don't have caddy installed. Will try to find it in a repo. Does that command create a server just like openssl s_server?

@BlackPanther Yes, you'd probably want to get the latest version (statically-linked) from the website though

I assume you can tell Kestrel to use the certificate you already made, though

If the only issue is that it isn't in the browsers' trust store... put it in the trust store

2 hours later…

10:14 PM

@MichaelHomer How do I do that?

This article also doesn't solve the problem with the browser warning about an invalid certificate authority as shown in the following screenshot:
https://andrewlock.net/creating-and-trusting-a-self-signed-certificate-on-linux-for-use-in-kestrel-and-asp-net-core/

Probably something to ask on the site, though it may already be there

I don't know how Fedora configures things

Chrome:

user image

@MichaelHomer Thanks a lot for helping. I'm gonna call it a day. Will continue by trying to add the certificate(s) to chromes trust store.

@MichaelHomer Okay :). It's too bad this is harder than it needs to be. On MacOS and Windows a simple command is all that is needed to do what I've been trying to get done.

See ya later.

I suspect a single command (or two) is also what you need here; I just don't know what it is

Aah of course, maybe so. I'll switch to the trusted store approach. Thanks

o/

« first day (3669 days earlier) ← previous day next day → last day (1268 days later) »

Transcript for

Oct '2025

/dev/chat

General discussion for unix.stackexchange.com. If you have a q...

join this room
about this room

00:00

06:00

12:00

18:00

all times are UTC

site design / logo © 2024 Stack Exchange Inc; legal

mobile