"tls: failed to verify certificate: x509: certificate is valid" when using certain resolvers #2801
Comments
|
Try installing and trusting http://i.pki.goog/wr2.crt and see if that fixes. dnscrypt-proxy uses the crypto/tls package for handling SSL/TLS connections. This package uses the system's certificate store on Windows. The google ca cert was created on Dec 13 09:00:00 2023 GMT so Windows 7 wouldn't know about it since it doesn't get updates or security updates. It also can't run recent versions of Firefox or Chrome, so, watch out for malware. |
|
Already tried. Without effect. I also tried various tricks with updating the full set of root certificates - without effect :( Under a very old linux in VirtualBox there are no problems :/ On smartphones with an old android, too everything is OK :/ |
|
Ah, bummer. I didn't look closely enough at the verification error message either. tls: failed to verify certificate: x509: certificate is valid for 8.8.8.8, 8.8.4.4, 2001:4860:4860::8888, 2001:4860:4860::8844, 2001:4860:4860::6464, 2001:4860:4860::64, not 8.8.4.4 The apparent server IP is included in the list of subject alt names but the ssl verification routine doesn't seem to be matching on it properly 🤔 |
|
On Win10 22H2, at least yandex is working on my side. The error message is puzzling. |
KB4474419? Or what other patches? KB4474419 I installed. No effect :( |
|
Maybe some antivirus or spyware hijacking HTTPS traffic? |
|
I don't use Win7 any more. You check it out: Got a summary by asking DeepSeek: What are the https features missing on Windows 7 SP1 compared to Windows 10? https://github.com/XTLS/go-win7/blob/build/README-eng.md#go-121 recommends KB4490628. More details: |
Output of the following commands:
./dnscrypt-proxy -version
2.1.7
./dnscrypt-proxy -check
./dnscrypt-proxy -resolve example.com
What is affected by this bug?
DNS resolving does not work when using certain resolvers
When does this occur?
When using certain resolvers. Google, Cloudflare, Yandex.
There are no problems with most of the resolvers :
Where does it happen?
Windows 7 X64 SP1, dnscrypt 2.1.7 (patched with golang - patcher) and 2.15 (the same story)
How do we replicate the issue?
The problem is reproduced on the newly installed Windows 7 X64 SP1 on Virtualbox and on the host system
Set in the settings
Expected behavior (i.e. solution)
Resolving through resolvers bypassing x509 error
The text was updated successfully, but these errors were encountered: