Codeberg/Community
54
325
Fork
You've already forked Community
12

pages: curl: (60) SSL: no alternative certificate subject name matches target hostname #1982

Closed
opened 2025年06月12日 22:32:43 +02:00 by Crocmagnon · 7 comments

Comment

Hello,
Is Codeberg pages having issues?

I had setup a site with custom domain at doses.augendre.info ; it worked fine and when checking tonight I see TLS issues.

$ dig doses.augendre.info +short
master.doses.crocmagnon.codeberg.page.
217.197.84.141
$ curl -v https://doses.augendre.info
* Host doses.augendre.info:443 was resolved.
* IPv6: 2a0a:4580:103f:c0de::2
* IPv4: 217.197.84.141
* Trying [2a0a:4580:103f:c0de::2]:443...
* ALPN: curl offers h2,http/1.1
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* CAfile: /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem
* CApath: none
* TLSv1.3 (IN), TLS handshake, Server hello (2):
* TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):
* TLSv1.3 (IN), TLS handshake, Certificate (11):
* TLSv1.3 (IN), TLS handshake, CERT verify (15):
* TLSv1.3 (IN), TLS handshake, Finished (20):
* TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):
* TLSv1.3 (OUT), TLS handshake, Finished (20):
* SSL connection using TLSv1.3 / TLS_AES_128_GCM_SHA256 / x25519 / RSASSA-PSS
* ALPN: server accepted h2
* Server certificate:
* subject: CN=*.codeberg.page
* start date: May 11 17:54:35 2025 GMT
* expire date: Aug 9 17:54:34 2025 GMT
* subjectAltName does not match hostname doses.augendre.info
* SSL: no alternative certificate subject name matches target hostname 'doses.augendre.info'
* closing connection #0
curl: (60) SSL: no alternative certificate subject name matches target hostname 'doses.augendre.info'
More details here: https://curl.se/docs/sslcerts.html
curl failed to verify the legitimacy of the server and therefore could not
establish a secure connection to it. To learn more about this situation and
how to fix it, please visit the webpage mentioned above.
### Comment Hello, Is Codeberg pages having issues? I had setup a site with custom domain at `doses.augendre.info` ; it worked fine and when checking tonight I see TLS issues. ```console $ dig doses.augendre.info +short master.doses.crocmagnon.codeberg.page. 217.197.84.141 ``` ```console $ curl -v https://doses.augendre.info * Host doses.augendre.info:443 was resolved. * IPv6: 2a0a:4580:103f:c0de::2 * IPv4: 217.197.84.141 * Trying [2a0a:4580:103f:c0de::2]:443... * ALPN: curl offers h2,http/1.1 * TLSv1.3 (OUT), TLS handshake, Client hello (1): * CAfile: /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem * CApath: none * TLSv1.3 (IN), TLS handshake, Server hello (2): * TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8): * TLSv1.3 (IN), TLS handshake, Certificate (11): * TLSv1.3 (IN), TLS handshake, CERT verify (15): * TLSv1.3 (IN), TLS handshake, Finished (20): * TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1): * TLSv1.3 (OUT), TLS handshake, Finished (20): * SSL connection using TLSv1.3 / TLS_AES_128_GCM_SHA256 / x25519 / RSASSA-PSS * ALPN: server accepted h2 * Server certificate: * subject: CN=*.codeberg.page * start date: May 11 17:54:35 2025 GMT * expire date: Aug 9 17:54:34 2025 GMT * subjectAltName does not match hostname doses.augendre.info * SSL: no alternative certificate subject name matches target hostname 'doses.augendre.info' * closing connection #0 curl: (60) SSL: no alternative certificate subject name matches target hostname 'doses.augendre.info' More details here: https://curl.se/docs/sslcerts.html curl failed to verify the legitimacy of the server and therefore could not establish a secure connection to it. To learn more about this situation and how to fix it, please visit the webpage mentioned above. ```

Hm looks like it's already back online.
It's been like this for ~20 min, if that helps.

Now I'm waiting for my second pages website to come up at go.augendre.info.
Just out of curiosity, is there a way to check whether the certificate and TLS is config is ready before setting up the domain name? It would help reduce downtime when migrating from, say, GitHub pages. Or maybe setting up the domain is required to start the TLS delivery? The docs aren't very clear on this.

Hm looks like it's already back online. It's been like this for ~20 min, if that helps. Now I'm waiting for my second pages website to come up at `go.augendre.info`. Just out of curiosity, is there a way to check whether the certificate and TLS is config is ready before setting up the domain name? It would help reduce downtime when migrating from, say, GitHub pages. Or maybe setting up the domain is required to start the TLS delivery? The docs aren't very clear on this.

I've been getting this error since 22h32 Europe/Paris (20mins ago)

$ curl -v https://go.augendre.info
* Host go.augendre.info:443 was resolved.
* IPv6: 2a0a:4580:103f:c0de::2
* IPv4: 217.197.84.141
* Trying [2a0a:4580:103f:c0de::2]:443...
* ALPN: curl offers h2,http/1.1
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* CAfile: /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem
* CApath: none
* TLSv1.3 (IN), TLS alert, internal error (592):
* TLS connect error: error:0A000438:SSL routines::tlsv1 alert internal error
* closing connection #0
curl: (35) TLS connect error: error:0A000438:SSL routines::tlsv1 alert internal error

Repo: https://codeberg.org/Crocmagnon/go_augendre_info
.domains file: https://codeberg.org/Crocmagnon/go_augendre_info/src/branch/main/.domains

$ dig go.augendre.info +short
master.go_augendre_info.crocmagnon.codeberg.page.
217.197.84.141
I've been getting this error since 22h32 Europe/Paris (20mins ago) ```console $ curl -v https://go.augendre.info * Host go.augendre.info:443 was resolved. * IPv6: 2a0a:4580:103f:c0de::2 * IPv4: 217.197.84.141 * Trying [2a0a:4580:103f:c0de::2]:443... * ALPN: curl offers h2,http/1.1 * TLSv1.3 (OUT), TLS handshake, Client hello (1): * CAfile: /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem * CApath: none * TLSv1.3 (IN), TLS alert, internal error (592): * TLS connect error: error:0A000438:SSL routines::tlsv1 alert internal error * closing connection #0 curl: (35) TLS connect error: error:0A000438:SSL routines::tlsv1 alert internal error ``` Repo: https://codeberg.org/Crocmagnon/go_augendre_info .domains file: https://codeberg.org/Crocmagnon/go_augendre_info/src/branch/main/.domains ```console $ dig go.augendre.info +short master.go_augendre_info.crocmagnon.codeberg.page. 217.197.84.141 ```

Still the same error, I rolled the domain back to github pages pending help.

Still the same error, I rolled the domain back to github pages pending help.

Retried tonight, same error for ~30min, rolled back domain again.

Retried tonight, same error for ~30min, rolled back domain again.

It currently seems to work for me?

dig doses.augendre.info +short
master.doses.crocmagnon.codeberg.page.
217.197.84.141
curl -v doses.augendre.info 
* Host doses.augendre.info:80 was resolved.
* IPv6: 2a0a:4580:103f:c0de::2
* IPv4: 217.197.84.141
* Trying [2a0a:4580:103f:c0de::2]:80...
* Immediate connect fail for 2a0a:4580:103f:c0de::2: Network is unreachable
* Trying 217.197.84.141:80...
* Connected to doses.augendre.info (217.197.84.141) port 80
* using HTTP/1.x
> GET / HTTP/1.1
> Host: doses.augendre.info
> User-Agent: curl/8.14.1
> Accept: */*
> 
* Request completely sent off
< HTTP/1.1 302 Found
< content-length: 0
< location: https://doses.augendre.info/
< cache-control: no-cache
< 
* Connection #0 to host doses.augendre.info left intact
It currently seems to work for me? ``` dig doses.augendre.info +short master.doses.crocmagnon.codeberg.page. 217.197.84.141 ``` ``` curl -v doses.augendre.info * Host doses.augendre.info:80 was resolved. * IPv6: 2a0a:4580:103f:c0de::2 * IPv4: 217.197.84.141 * Trying [2a0a:4580:103f:c0de::2]:80... * Immediate connect fail for 2a0a:4580:103f:c0de::2: Network is unreachable * Trying 217.197.84.141:80... * Connected to doses.augendre.info (217.197.84.141) port 80 * using HTTP/1.x > GET / HTTP/1.1 > Host: doses.augendre.info > User-Agent: curl/8.14.1 > Accept: */* > * Request completely sent off < HTTP/1.1 302 Found < content-length: 0 < location: https://doses.augendre.info/ < cache-control: no-cache < * Connection #0 to host doses.augendre.info left intact ```

@Gusted doses.augendre.info works, but I’ve been unable to make go.augendre.info work.

See #1982 (comment) and following.

@Gusted doses.augendre.info works, but I’ve been unable to make go.augendre.info work. See https://codeberg.org/Codeberg/Community/issues/1982#issuecomment-5109339 and following.

I've managed to get it working by deleting the repo and recreating it without the domain file, moving the DNS record, then adding the domains file.
I suspect a few things:
The repo initially had dots in place of underscores, I renamed it before trying to enable pages but it may have leaked somehow
The repo doesn't have a master branch, it has a main branch. I did not document it here, but I tried with and without the branch name in the DNS record. Maybe there was some kind of memory here as well.

Anyway, it works fine now :)

I've managed to get it working by deleting the repo and recreating it without the domain file, moving the DNS record, then adding the domains file. I suspect a few things: The repo initially had dots in place of underscores, I renamed it before trying to enable pages but it may have leaked somehow The repo doesn't have a master branch, it has a main branch. I did not document it here, but I tried with and without the branch name in the DNS record. Maybe there was some kind of memory here as well. Anyway, it works fine now :)
Sign in to join this conversation.
No Branch/Tag specified
main
No results found.
Labels
Clear labels
accessibility

Reduces accessibility and is thus a "bug" for certain user groups on Codeberg.
bug

Something is not working the way it should. Does not concern outages.
bug
infrastructure

Errors evidently caused by infrastructure malfunctions or outages
Codeberg

This issue involves Codeberg's downstream modifications and settings and/or Codeberg's structures.
contributions welcome

Please join the discussion and consider contributing a PR!
docs

No bug, but an improvement to the docs or UI description will help
duplicate

This issue or pull request already exists
enhancement

New feature
infrastructure

Involves changes to the server setups, use `bug/infrastructure` for infrastructure-related user errors.
legal

An issue directly involving legal compliance
licence / ToS

involving questions about the ToS, especially licencing compliance
please chill
we are volunteers

Please consider editing your posts and remember that there is a human on the other side. We get that you are frustrated, but it's harder for us to help you this way.
public relations

Things related to Codeberg's external communication
question

More information is needed
question
user support

This issue contains a clearly stated problem. However, it is not clear whether we have to fix anything on Codeberg's end, but we're helping them fix it and/or find the cause.
s/Forgejo

Related to Forgejo. Please also check Forgejo's issue tracker.
s/Forgejo/migration

Migration related issues in Forgejo
s/Pages

Issues related to the Codeberg Pages feature
s/Weblate

Issue is related to the Weblate instance at https://translate.codeberg.org
s/Woodpecker

Woodpecker CI related issue
security

involves improvements to the sites security
service

Add a new service to the Codeberg ecosystem (instead of implementing into Gitea)
upstream

An open issue or pull request to an upstream repository to fix this issue (partially or completely) exists (i.e. Gitea, Forgejo, etc.)
wontfix

Codeberg's current set of contributors are not planning to spend time on delegating this issue.
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
2 participants
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
Codeberg/Community#1982
Reference in a new issue
Codeberg/Community
No description provided.
Delete branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?