SSL peer certificate or SSH remote key was not OK

Help
1

Since around 2 weeks ago, when running nix flake update --commit-lock-file (or nix build when a connection to GitHub is required), I get this error:

warning: unable to download 'https://api.github.com/repos/nix-community/dns.nix/commits/HEAD': SSL peer certificate or SSH remote key was not OK (60) SSL: no alternative certificate subject name matches target hostname 'api.github.com'; retrying in 305 ms (attempt 1/5)
warning: unable to download 'https://api.github.com/repos/nix-community/dns.nix/commits/HEAD': SSL peer certificate or SSH remote key was not OK (60) SSL: no alternative certificate subject name matches target hostname 'api.github.com'; retrying in 698 ms (attempt 2/5)
warning: unable to download 'https://api.github.com/repos/nix-community/dns.nix/commits/HEAD': SSL peer certificate or SSH remote key was not OK (60) SSL: no alternative certificate subject name matches target hostname 'api.github.com'; retrying in 1004 ms (attempt 3/5)
warning: unable to download 'https://api.github.com/repos/nix-community/dns.nix/commits/HEAD': SSL peer certificate or SSH remote key was not OK (60) SSL: no alternative certificate subject name matches target hostname 'api.github.com'; retrying in 2326 ms (attempt 4/5)
error:
       … while updating the lock file of flake 'git+file:///etc/nixos'

       … while updating the flake input 'dns'

       … while fetching the input 'github:nix-community/dns.nix'

       error: unable to download 'https://api.github.com/repos/nix-community/dns.nix/commits/HEAD': SSL peer certificate or SSH remote key was not OK (60) SSL: no alternative certificate subject name matches target hostname 'api.github.com'

My NixOS configuration is available here, “rotkehlchen” is my only host affected by this.

I don’t have any proxy configured, there are no custom TLS certificates, no SSL-related environment variables are set and my system time is correct. Firefox and curl from the command line have no issues connecting to api.github.com.

Since only one device and only the connection to GitHub is affected, I am rather confused. Does anyone know how to debug this?

2

I know this might seem unusual, however could you tell me the result of running this command?

host -v -N 3 -t AAAA api.github.com
3 
Trying "api.github.com.fritz.box"
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 47021
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;api.github.com.fritz.box.	IN	AAAA

;; ANSWER SECTION:
api.github.com.fritz.box. 3600	IN	AAAA	fd00:90::1eed:6fff:fe98:ee7e

Received 70 bytes from 127.0.0.53#53 in 4 ms

My /etc/resolv.conf looks like this (without the comment):

nameserver 127.0.0.53
options edns0 trust-ad
search fritz.box

Since there is no ndots, I wouldn’t assume this to be the issue. However, removing the search path does fix it. Strange.

1 Like
4

It’s an issue with curl, glibc and/or RFC1123 3780733

1 Like
5

I can’t access that HackerOne link, but I assume that means this is a known bug.

6

Sorry, it’s disclosure is pending. I’m new to hackerone and thought it had already been disclosed.