From @|mon@urb@nek @end|ng |rom R-project@org  Wed Jun 10 00:50:18 2020
From: @|mon@urb@nek @end|ng |rom R-project@org (Simon Urbanek)
Date: Wed, 10 Jun 2020 10:50:18 +1200
Subject: [Rd] r-project.org SSL certificate issues
In-Reply-To: <CAFDcVCS1+Tu07=JPRUMZbR0=J289Nh_j5+PfrH5LzZddbCbo2A@mail.gmail.com>
References: <CABtg=KmsLkuNCBJq_VfGhG4CTW-5tDS79pSX4NJbo_aCoVhk3g@mail.gmail.com>
 <D17A5556-DA84-4483-9040-437BBA1DE090@gmail.com>
 <CAA-FpKWFM1RKrtzFUZXHwTP2WS1p=2F5g87d21ggQDKzw_X7Dw@mail.gmail.com>
 <CAA-FpKXihTBOLfucwnt7QWhY2UdqUG+ySKBqJV+WTJGJ82t=yw@mail.gmail.com>
 <CAA-FpKXtBMz0jk=boWFeVd-LQ_u=cHyqn9Z-BOaRb3J7R_x2Hg@mail.gmail.com>
 <a96725a1-0e74-164d-4e8c-000b84ca7bc8@gmail.com>
 <CABFfbXvNh2s6KZZ+tAwM8tHDOb0Ob8mFJkbrMb+_E8GPzOA6SA@mail.gmail.com>
 <CABtg=Kk5gNnSqoLPtY-YodzP7rLy+1v4uwP+S87mdUqhkPKZYw@mail.gmail.com>
 <CABtg=KkEX6PLPx4Jtdsc7rtKuEjaUJZjPUJ8MUMzrmzNw85xeg@mail.gmail.com>
 <CABtg=Knbz7SRRHUK1JcbYJekGTcwbcM8=NNaXaO_UdJiF-E0bw@mail.gmail.com>
 <CAFDcVCS1+Tu07=JPRUMZbR0=J289Nh_j5+PfrH5LzZddbCbo2A@mail.gmail.com>
Message-ID: <02BBCA72-BBF4-4AC7-AFB4-7A516BD6A2D3@R-project.org>

To be clear, this not an issue in the libraries nor R, the certificates on the server were simply wrong. So, no, this has nothing to do with R.

Cheers,
Simon


> On Jun 10, 2020, at 10:45 AM, Henrik Bengtsson <henrik.bengtsson at gmail.com> wrote:
> 
> Was this resolved upstream or is this something that R should/could
> fix? If the latter, could this also go into the "emergency release" R
> 4.0.2 that is scheduled for 2020-06-22?
> 
> My $.02
> 
> /Henrik
> 
> 
> On Sun, May 31, 2020 at 8:13 AM G?bor Cs?rdi <csardi.gabor at gmail.com> wrote:
>> 
>> Btw. it would be also possible to create a macOS R installer that
>> embeds a static or dynamic libcurl with Secure Transport, instead of
>> the Apple default LibreSSL.
>> 
>> This might be too late for R 4.0.1, I don't know.
>> 
>> Gabor
>> 
>> On Sun, May 31, 2020 at 4:09 PM G?bor Cs?rdi <csardi.gabor at gmail.com> wrote:
>>> 
>>> On Sat, May 30, 2020 at 11:32 PM G?bor Cs?rdi <csardi.gabor at gmail.com> wrote:
>>> [...]
>>>> Btw. why does this affect openssl? That root cert was published in
>>>> 2010, surely openssl should know about it? Maybe libcurl / openssl
>>>> only uses the chain provided by the server? Without trying to use an
>>>> alternate chain?
>>> 
>>> Yes, indeed it seems that old OpenSSL versions cannot handle
>>> alternative certificate chains. This has been fixed in OpenSSL in
>>> 2015, so modern Linux systems should be fine. However, macOS uses
>>> LibreSSL, and LibreSSL never fixed this issue. E.g.
>>> https://github.com/libressl-portable/portable/issues/595
>>> 
>>> r-project.org can be updated to send the new root certificate, which
>>> will solve most of our problems, but we'll probably have issues with
>>> other web sites that'll update slower or never.
>>> 
>>> FWIW I built macOS binaries for the curl package, using a static
>>> libcurl and macOS Secure Transport, so these binaries does not have
>>> this issue.
>>> 
>>> They are at https://files.r-hub.io/curl-macos-static and they can be
>>> installed with
>>> install.packages("curl", repos =
>>> "https://files.r-hub.io/curl-macos-static", type = "binary")
>>> 
>>> They support R 3.2 and up, including R 4.1, and should work on all
>>> macOS versions that the given R release supports.
>>> 
>>> Gabor
>> 
>> ______________________________________________
>> R-devel at r-project.org mailing list
>> https://stat.ethz.ch/mailman/listinfo/r-devel
> 
> ______________________________________________
> R-devel at r-project.org mailing list
> https://stat.ethz.ch/mailman/listinfo/r-devel
> 



[Rd] r-project.org SSL certificate issues
Simon Urbanek