Package: neomutt
Version: 20201127+dfsg.1-1.2
Severity: normal
At the time of writing, news.gmane.io is offering 4 certificates in it's
TLS bundle, including two separate roots; the older, expired root for
Lets Encrypt certificates, and the newer one:
> $ gnutls-cli --starttls-proto=nntp -p 119 news.gmane.io
> Processed 129 CA certificate(s).
> Resolving 'news.gmane.io:119'...
> Connecting to '116.202.254.214:119'...
> - Certificate type: X.509
> - Got a certificate list of 4 certificates.
> - Certificate[0] info:
> - subject `CN=ciao.gmane.io', issuer `CN=R3,O=Let's Encrypt,C=US', serial
> 0x03c44d2a356cad184ca947cdee4a43c78bcf, RSA key 2048 bits, signed using
> RSA-SHA256, activated `2021-08-27 19:26:46 UTC', expires `2021-11-25 19:26:45
> UTC', pin-sha256="IackeqoJ2tG5yu6CeMwbOFcSTTjOFQdtMxi39o1By3c="
> Public Key ID:
> sha1:5e6c6071d852807c9867eb42a9ce8bc7690f90b6
>
> sha256:21a7247aaa09dad1b9caee8278cc1b3857124d38ce15076d3318b7f68d41cb77
> Public Key PIN:
> pin-sha256:IackeqoJ2tG5yu6CeMwbOFcSTTjOFQdtMxi39o1By3c=
>
> - Certificate[1] info:
> - subject `CN=R3,O=Let's Encrypt,C=US', issuer `CN=ISRG Root X1,O=Internet
> Security Research Group,C=US', serial 0x00912b084acf0c18a753f6d62e25a75f5a,
> RSA key 2048 bits, signed using RSA-SHA256, activated `2020-09-04 00:00:00
> UTC', expires `2025-09-15 16:00:00 UTC',
> pin-sha256="jQJTbIh0grw0/1TkHSumWb+Fs0Ggogr621gT3PvPKG0="
> - Certificate[2] info:
> - subject `CN=ISRG Root X1,O=Internet Security Research Group,C=US', issuer
> `CN=DST Root CA X3,O=Digital Signature Trust Co.', serial
> 0x4001772137d4e942b8ee76aa3c640ab7, RSA key 4096 bits, signed using
> RSA-SHA256, activated `2021-01-20 19:14:03 UTC', expires `2024-09-30 18:14:03
> UTC', pin-sha256="C5+lpZ7tcVwmwQIMcRtPbsQtWLABXhQzejna0wHFr8M="
> - Certificate[3] info:
> - subject `CN=DST Root CA X3,O=Digital Signature Trust Co.', issuer `CN=DST
> Root CA X3,O=Digital Signature Trust Co.', serial
> 0x44afb080d6a327ba893039862ef8406b, RSA key 2048 bits, signed using RSA-SHA1
> (broken!), activated `2000-09-30 21:12:19 UTC', expires `2021-09-30 14:01:15
> UTC', pin-sha256="Vjs8r4z+80wjNcr1YKepWQboSIRi63WsWXhIMN+eWys="
> - Status: The certificate is trusted.
> - Description:
> (TLS1.3-X.509)-(ECDHE-SECP256R1)-(RSA-PSS-RSAE-SHA256)-(AES-256-GCM)
> - Session ID:
> CA:77:1C:EB:16:E2:63:C0:77:19:77:9B:C1:FB:21:65:FC:48:5F:88:27:81:3B:C3:35:4D:90:5F:60:4C:23:79
> - Options:
> - Handshake was completed
>
> - Simple Client Mode:
Note that gnutls-cli non-the-less trusts the certificate. Neomutt,
however, does not, and reports on the expired root:
> neomutt -f news://news.gmane.io/gmane.linux.debian.devel.policy
>
> ...
>
> This certificate belongs to:
>DST Root CA X3
>Digital Signature Trust Co.
>
> This certificate was issued by:
>DST Root CA X3
>Digital Signature Trust Co.
>
> This certificate is valid
>from Sat, 30 Sep 2000 21:12:19 UTC
> to Thu, 30 Sep 2021 14:01:15 UTC
>
> SHA1 Fingerprint: DAC9 024F 54D8 F6DF 9493 5FB1 7326 38CA 6AD7 7C13
> SHA256 Fingerprint: 0687 2603 31A7 2403 D909 F105 E69B CF0D
> 32E1 BD24 93FF C6D9 206D 11BC D677 0739
>
> WARNING: Server certificate has expired
This is annoying because the user must "accept (o)nce" the certificate
on each connection, and there are frequent reconnections in normal use
(every time you change group, after a timeout, etc.)
The relevant expired root is in the ca-certificates bundle. I've tried
removing it, to no avail:
> $ grep '^!' /etc/ca-certificates.conf
> !mozilla/DST_Root_CA_X3.crt
> # update-ca-certificates
> ...
Since gnutls-cli is happy, my tentative conclusion is that neomutt is
doing something wrong.
-- Package-specific info:
NeoMutt 20201127
Copyright (C) 1996-2020 Michael R. Elkins and others.
NeoMutt comes with ABSOLUTELY NO WARRANTY; for details type 'neomutt -vv'.
NeoMutt is free software, and you are welcome to redistribute it
under certain conditions; type 'neomutt -vv' for details.
System: Linux 5.10.0-6-amd64 (x86_64)
ncurses: ncurses 6.2.20201114 (compiled with 6.2.20201114)
libidn: 1.33 (compiled with 1.33)
GPGME: 1.14.0-unknown
GnuTLS: 3.7.1
libnotmuch: 5.3.0
storage: tokyocabinet
Configure options: --build=x86_64-linux-gnu --prefix=/usr
{--includedir=${prefix}/include} {--mandir=${prefix}/share/man}
{--infodir=${prefix}/share/info} --sysconfdir=/etc --localstatedir=/var
--disable-option-checking --disable-silent-rules
{--libdir=${prefix}/lib/x86_64-linux-gnu}
{--libexecdir=${prefix}/lib/x86_64-linux-gnu} --disable-maintainer-mode
--disable-dependency-tracking --mandir=/usr/share/man --libexecdir=/usr/libexec
--with-mailpath=/var/mail --gpgme --lua --notmuch --with-ui --gnutls --gss
--idn --mixmaster --sasl --tokyocabinet --sqlite --autocrypt
Compilation CFLAGS: -g -O2
-ffile-prefix-map=/build/neomutt-aFsTyZ/neomutt-20201127+dfsg.1=.
-fstack-protector-strong -Wformat
