ssl - 在 Archlinux 中删除 DST_Root_CA_X3

Question

2021-09-30 the Lets Encrypt certificate DST_ROOT_CA_X3 expired .我有一个较旧的 Archlinux 版本，现在无法通过对 Lets Encrypt 域的基本 https 请求。
例如:curl -sv https://serverfault.com产量:

* Rebuilt URL to: https://serverfault.com/
*   Trying 151.101.193.69...
* TCP_NODELAY set
* Connected to serverfault.com (151.101.193.69) port 443 (#0)
* ALPN, offering http/1.1
* Cipher selection: ALL:!EXPORT:!EXPORT40:!EXPORT56:!aNULL:!LOW:!RC4:@STRENGTH
* successfully set certificate verify locations:
*   CAfile: /etc/ssl/certs/ca-certificates.crt
  CApath: none
* TLSv1.2 (OUT), TLS header, Certificate Status (22):
} [5 bytes data]
* TLSv1.2 (OUT), TLS handshake, Client hello (1):
} [512 bytes data]
* TLSv1.2 (IN), TLS handshake, Server hello (2):
{ [108 bytes data]
* TLSv1.2 (IN), TLS handshake, Certificate (11):
{ [4487 bytes data]
* TLSv1.2 (OUT), TLS alert, Server hello (2):
} [2 bytes data]
* SSL certificate problem: certificate rejected
* Curl_http_done: called premature == 1
* Closing connection 0
} [5 bytes data]
* TLSv1.2 (OUT), TLS alert, Client hello (1):
} [2 bytes data]

I have found other posts that describe how to remove this certificate on Ubuntu based builds .我对 Archlinux 不熟悉——你如何去做同样的事情？

Answer 1

有一个ca-certificates很可能只需要更新的软件包。

sudo pacman -Sy ca-certificates

或者只是更新您的整个系统

sudo pacman -Syu