<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN" "http://www.w3.org/TR/REC-html40/loose.dtd">
<html lang="en">
<head>
<meta content="text/html; charset=US-ASCII" http-equiv="Content-Type">
<title>
GitLab
</title>
<style>img {
max-width: 100%; height: auto;
}
</style>
</head>
<body>
<div class="content">
<p style="color: #777777;">
<a href="https://gitlab.com/dueno">Daiki Ueno</a>
<a href="https://gitlab.com/gnutls/gnutls/-/issues/1285#note_717191369">commented</a>:
</p>
<div style="">
<p dir="auto">"CN=R3,O=Let's Encrypt,C=US" is an <a href="https://letsencrypt.org/2020/09/17/new-root-and-intermediates.html" rel="nofollow noreferrer noopener" target="_blank">intermediate CA</a> and the client needs to retrieve the rest of the certificate chain. In this case, as the server uses the AIA extension for that, you could use the <code>--ca-auto-retrieve</code> option:</p>
<pre class="code highlight js-syntax-highlight language-console" lang="console" v-pre="true"><code><span id="LC1" class="line" lang="console"><span class="go">gnutls-cli --ca-auto-retrieve irc.sekrit.org -p 994</span></span>
<span id="LC2" class="line" lang="console"><span class="c">...</span></span>
<span id="LC3" class="line" lang="console"><span class="go">Connecting to caIssuer server: r3.i.lencr.org...</span></span>
<span id="LC4" class="line" lang="console"><span class="go">Resolving 'r3.i.lencr.org:80'...</span></span>
<span id="LC5" class="line" lang="console"><span class="go">Connecting to '2a02:26f0:4700:185::21cc:80'...</span></span>
<span id="LC6" class="line" lang="console"><span class="go">- Status: The certificate is trusted. </span></span>
<span id="LC7" class="line" lang="console"><span class="go">- Description: (TLS1.3-X.509)-(ECDHE-SECP256R1)-(RSA-PSS-RSAE-SHA256)-(AES-256-GCM)</span></span>
<span id="LC8" class="line" lang="console"><span class="go">- Session ID: 83:F4:C0:C1:38:BC:9D:5F:59:48:83:80:4A:C6:37:9A:B5:C2:AB:28:01:C4:88:BF:99:1D:FA:17:15:A1:3B:59</span></span>
<span id="LC9" class="line" lang="console"><span class="go">- Options:</span></span>
<span id="LC10" class="line" lang="console"><span class="go">- Handshake was completed</span></span></code></pre>
<blockquote dir="auto">
<p>openssl works fine:</p>
</blockquote>
<p dir="auto">Looks like it just continues the handshake ignoring the error (as printed in your log). If you specify <code>-verify_return_error</code> the behavior would be different.</p>
</div>
</div>
<div class="footer" style="margin-top: 10px;">
<p style="font-size: small; color: #666;">
—
<br>
Reply to this email directly or <a href="https://gitlab.com/gnutls/gnutls/-/issues/1285#note_717191369">view it on GitLab</a>.
<br>
You're receiving this email because of your account on gitlab.com.
If you'd like to receive fewer emails, you can
<a href="https://gitlab.com/-/sent_notifications/3427a3145173072ed23eece776868d49/unsubscribe">unsubscribe</a>
from this thread or
adjust your notification settings.
<script type="application/ld+json">{"@context":"http://schema.org","@type":"EmailMessage","action":{"@type":"ViewAction","name":"View Issue","url":"https://gitlab.com/gnutls/gnutls/-/issues/1285#note_717191369"}}</script>
</p>
</div>
</body>
</html>