<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
It was a problem on my system (RHEL8 upgrade from 7). Installing the system from scratch has resolved the issue. </div>
<div id="signature_bookmark"></div>
<div id="appendonsend"></div>
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)" class="elementToProof">
I managed to install shibboleth sp 3.3.0 from repo, however i noticed warning about deprecated mod_shib. This seems to be resolved in 3.3.1. How can i install this version ?</div>
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)" class="elementToProof">
<br>
</div>
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)" class="elementToProof">
Thanks.</div>
<hr tabindex="-1" style="display:inline-block; width:98%">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" color="#000000" style="font-size:11pt"><b>De :</b> users <users-bounces@shibboleth.net> de la part de Peter Schober via users <users@shibboleth.net><br>
<b>Envoyé :</b> vendredi 5 août 2022 20:44<br>
<b>À :</b> users@shibboleth.net <users@shibboleth.net><br>
<b>Cc :</b> Peter Schober <peter.schober@univie.ac.at><br>
<b>Objet :</b> Re: rpm repo sp</font>
<div> </div>
</div>
<div class="BodyFragment"><font size="2"><span style="font-size:11pt">
<div class="PlainText">* Rachid MONIR via users <users@shibboleth.net> [2022-08-05 18:46]:<br>
> Errors during downloading metadata for repository 'shibboleth':<br>
> - Curl error (60): SSL peer certificate or SSH remote key was not<br>
> OK for <a href="https://shibboleth.net/cgi-bin/mirrorlist.cgi/CentOS_8" data-auth="NotApplicable">
https://shibboleth.net/cgi-bin/mirrorlist.cgi/CentOS_8</a> [SSL<br>
> certificate problem: unable to get local issuer certificate]<br>
<br>
That's weird because downloading the repo signing key from that same<br>
machine seems go have worked?<br>
<br>
> I've downloded repomd.xml.key<br>
> wget <a href="https://shibboleth.net/downloads/service-provider/RPMS/repomd.xml.key" data-auth="NotApplicable">
https://shibboleth.net/downloads/service-provider/RPMS/repomd.xml.key</a><br>
<br>
(The difference being wget vs. [lib]curl?)<br>
<br>
FWIW, I don't see any server-side TLS problems on shibboleth.net,<br>
neither with curl (v4, v6) nor openssl's s_client, at least not from<br>
an OS released in the last 5 years. (Tried Debian versions 11 to 9. No RHEL here.)<br>
<br>
$ curl -4 -sSo /dev/null -I <a href="https://shibboleth.net/cgi-bin/mirrorlist.cgi/CentOS_8" data-auth="NotApplicable">
https://shibboleth.net/cgi-bin/mirrorlist.cgi/CentOS_8</a><br>
<br>
$ curl -6 -sSo /dev/null -I <a href="https://shibboleth.net/cgi-bin/mirrorlist.cgi/CentOS_8" data-auth="NotApplicable">
https://shibboleth.net/cgi-bin/mirrorlist.cgi/CentOS_8</a><br>
<br>
$ openssl s_client -connect shibboleth.net:443 < /dev/null 2>&1 < /dev/null | fgrep -A7 chain<br>
Certificate chain<br>
0 s:CN = shibboleth.net<br>
i:C = US, O = Let's Encrypt, CN = R3<br>
1 s:C = US, O = Let's Encrypt, CN = R3<br>
i:C = US, O = Internet Security Research Group, CN = ISRG Root X1<br>
2 s:C = US, O = Internet Security Research Group, CN = ISRG Root X1<br>
i:O = Digital Signature Trust Co., CN = DST Root CA X3<br>
---<br>
<br>
Maybe the cert chain on the server is not optimal for some client OSs<br>
(there might be several different ones, though not even SSL Labs<br>
doesn't anything wrong) or it's a local problem on the OS you're<br>
trying to run yum on.<br>
<br>
-peter<br>
-- <br>
For Consortium Member technical support, see <a href="https://shibboleth.atlassian.net/wiki/x/ZYEpPw" data-auth="NotApplicable">
https://shibboleth.atlassian.net/wiki/x/ZYEpPw</a><br>
To unsubscribe from this list send an email to users-unsubscribe@shibboleth.net<br>
</div>
</span></font></div>
</body>
</html>