maindavfs2 - Support: sr #110735, davfs2 stopped trusting server...

 
 

sr #110735: davfs2 stopped trusting server letsencrypt certificate

Submitter:  Markus <markusng>
Submitted:  Mon 03 Oct 2022 09:32:15 AM UTC
   
 
Category:  None Priority:  5 - Normal
Severity:  2 - Minor Status:  None
Privacy:  Public Assigned to:  None
Open/Closed:  Open Operating System:  GNU/Linux
* Mandatory Fields

Add a New Comment Rich Markup
   

Mon 03 Oct 2022 10:36:12 AM UTC, comment #1: 

I noted my raspberry pi client only had one CA-certificate (in /etc/ssl/certs/)

I added CA-certificates using the commands


sudo apt install ca-certificates
sudo dpkg-reconfigure ca-certificates


This resolved the issue.
 
Now mounting works again without a query


$ umount /mnt/dav
/sbin/umount.davfs: waiting for mount.davfs (pid 11034) to terminate gracefully .. OK
$ mount /mnt/dav
$





Markus <markusng>
Mon 03 Oct 2022 09:32:15 AM UTC, original submission:  

Greetings,
I use davfs2 to mount my NextCloud share, which is hosted by a commercial NextCloud provider.
Without a change I am aware of, davfs2 stopped trusting the letsencrypt server certificate and I have to confirm the fingerprint.

What can I do to let davfs2 trust the letsencrypt certificate again?


The rented domain with the certificate is:

km-wolke.de


As client I use a headless Raspberry Pi:

uname -a
Linux zeroW 5.15.61+ #1579 Fri Aug 26 11:08:59 BST 2022 armv6l GNU/Linux


My `/etc/fstab` file contains

https://km-wolke.de/remote.php/webdav/ /mnt/dav davfs _netdev,noauto,user,uid=markus,gid=markus 0 0


I ran this command:

mount /mnt/dav


At first this mounted the share without a query, then it stopped trusting the certificate:

/sbin/mount.davfs: the server certificate is not trusted
  issuer:      Let's Encrypt, US
  subject:     km-wolke.de
  identity:    km-wolke.de
  fingerprint: (((snip)))  (((is it save to share a fingerprint?)))
You only should accept this certificate, if you can
verify the fingerprint! The server might be faked
or there might be a man-in-the-middle-attack.
Accept certificate for this session? [y,N]



For details of the certificate, I run this command:

curl -v https://km-wolke.de/remote.php/webdav/


It produces this output :

*   Trying 2a00:17d8:200::2b1:443...
* Connected to km-wolke.de (2a00:17d8:200::2b1) port 443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* successfully set certificate verify locations:
*  CAfile: /etc/ssl/certs/ca-certificates.crt
*  CApath: /etc/ssl/certs
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* TLSv1.3 (IN), TLS handshake, Server hello (2):
* TLSv1.2 (IN), TLS handshake, Certificate (11):
* TLSv1.2 (IN), TLS handshake, Server key exchange (12):
* TLSv1.2 (IN), TLS handshake, Server finished (14):
* TLSv1.2 (OUT), TLS handshake, Client key exchange (16):
* TLSv1.2 (OUT), TLS change cipher, Change cipher spec (1):
* TLSv1.2 (OUT), TLS handshake, Finished (20):
* TLSv1.2 (IN), TLS handshake, Finished (20):
* SSL connection using TLSv1.2 / ECDHE-RSA-AES256-GCM-SHA384
* ALPN, server accepted to use h2
* Server certificate:
*  subject: CN=km-wolke.de
*  start date: Aug 14 06:24:29 2022 GMT
*  expire date: Nov 12 06:24:28 2022 GMT
*  subjectAltName: host "km-wolke.de" matched cert's "km-wolke.de"
*  issuer: C=US; O=Let's Encrypt; CN=R3
*  SSL certificate verify ok.
* Using HTTP2, server supports multi-use
* Connection state changed (HTTP/2 confirmed)
* Copying HTTP/2 data in stream buffer to connection buffer after upgrade: len=0
* Using Stream ID: 1 (easy handle 0x822b40)
> GET /remote.php/webdav/ HTTP/2
> Host: km-wolke.de
> user-agent: curl/7.74.0
> accept: */*
>
* Connection state changed (MAX_CONCURRENT_STREAMS == 128)!
< HTTP/2 401
< server: nginx
< date: Mon, 03 Oct 2022 09:06:20 GMT
< content-type: application/xml; charset=utf-8
< expires: Thu, 19 Nov 1981 08:52:00 GMT
< cache-control: no-store, no-cache, must-revalidate
< pragma: no-cache
< set-cookie: oc_sessionPassphrase=ird03TvfqjnZmARSowOdnuc%2BNa4gVOZ5sJMO8HNuf7WrOdxcDY4DHB%2BovKwr4pFk2O%2FXaenCKI0GjNk%2BQq4wyfrGZSIqJlzI%2BesyEvGDIkGkqJlEqDfZypyiolcT%2BUQC; path=/; secure; HttpOnly; SameSite=Lax
< set-cookie: ocslt7sf5faa=1804c8c755e5ee70fc3a2945fa58ea9c; path=/; secure; HttpOnly; SameSite=Lax
< set-cookie: __Host-nc_sameSiteCookielax=true; path=/; httponly;secure; expires=Fri, 31-Dec-2100 23:59:59 GMT; SameSite=lax
< set-cookie: __Host-nc_sameSiteCookiestrict=true; path=/; httponly;secure; expires=Fri, 31-Dec-2100 23:59:59 GMT; SameSite=strict
< content-security-policy: default-src 'none';
< www-authenticate: Basic realm="Managed Nextcloud", charset="UTF-8"
< strict-transport-security: max-age=15768000; includeSubDomains;
< referrer-policy: no-referrer
< x-content-type-options: nosniff
< x-download-options: noopen
< x-frame-options: SAMEORIGIN
< x-permitted-cross-domain-policies: none
< x-robots-tag: none
< x-xss-protection: 1; mode=block
<
<?xml version="1.0" encoding="utf-8"?>
<d:error xmlns:d="DAV:" xmlns:s="http://sabredav.org/ns">
  <s:exception>Sabre\DAV\Exception\NotAuthenticated</s:exception>
  <s:message>No 'Authorization: Basic' header found. Either the client didn't send one, or the server is misconfigured, No 'Authorization: Bearer' header found. Either the client didn't send one, or the server is mis-configured</s:message>
</d:error>
* Connection #0 to host km-wolke.de left intact


Markus <markusng>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by markusng (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    No changes have been made to this item

    Back to the top

    Powered by Savane 3.14-79a4.
    Corresponding source code