From pi@f10.opsec.eu  Sat May 17 10:52:25 2014
Return-Path: <pi@f10.opsec.eu>
Received: from mx1.freebsd.org (mx1.freebsd.org [8.8.178.115])
	(using TLSv1 with cipher ADH-AES256-SHA (256/256 bits))
	(No client certificate requested)
	by hub.freebsd.org (Postfix) with ESMTPS id 14680CD0
	for <FreeBSD-gnats-submit@freebsd.org>; Sat, 17 May 2014 10:52:25 +0000 (UTC)
Received: from f10.opsec.eu (f10.opsec.eu [IPv6:2001:14f8:200:4::2])
	(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
	(Client did not present a certificate)
	by mx1.freebsd.org (Postfix) with ESMTPS id C0DD425B5
	for <FreeBSD-gnats-submit@freebsd.org>; Sat, 17 May 2014 10:52:24 +0000 (UTC)
Received: from pi by f10.opsec.eu with local (Exim 4.82 (FreeBSD))
	(envelope-from <pi@f10.opsec.eu>)
	id 1WlcE0-000Mzw-UO
	for FreeBSD-gnats-submit@freebsd.org; Sat, 17 May 2014 12:52:20 +0200
Message-Id: <E1WlcE0-000Mzw-UO@f10.opsec.eu>
Date: Sat, 17 May 2014 12:52:20 +0200
From: Kurt Jaeger <pi@FreeBSD.org>
Reply-To: Kurt Jaeger <pi@FreeBSD.org>
To: FreeBSD-gnats-submit@freebsd.org
Cc:
Subject: fetch -no-verify-peer no longer disables SSL verification
X-Send-Pr-Version: 3.114
X-GNATS-Notify:

>Number:         189882
>Category:       bin
>Synopsis:       fetch -no-verify-peer no longer disables SSL verification
>Confidential:   no
>Severity:       non-critical
>Priority:       low
>Responsible:    freebsd-bugs
>State:          open
>Quarter:
>Keywords:
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Sat May 17 11:00:04 UTC 2014
>Closed-Date:
>Last-Modified:
>Originator:     Kurt Jaeger
>Release:        FreeBSD 10.0-RELEASE-p3 amd64
>Organization:
-
>Environment:
System: FreeBSD f10.opsec.eu 10.0-RELEASE-p3 FreeBSD 10.0-RELEASE-p3 #0: Tue May 13 18:31:10 UTC 2014 root@amd64-builder.daemonology.net:/usr/obj/usr/src/sys/GENERIC amd64


>Description:
	fetch -no-verify-peer allows to fetch from https even if the
	remote site can not be verified. It no longer works.

---------
f10# fetch -v -no-verify-peer https://gist.githubusercontent.com/anonymous/eb379038510a6f15c0cb/raw/cc836df6365e975fd19b49f9eedee5f1ebfa4e46/mnemosyne-2.3.diff
looking up gist.githubusercontent.com
connecting to gist.githubusercontent.com:443
SSL options: 81004bff
Peer verification enabled
Using CA cert file: /etc/ssl/cert.pem
Certificate verification failed for /C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert SHA2 High Assurance Server CA
34380826280:error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed:/usr/src/secure/lib/libssl/../../../crypto/openssl/ssl/s3_clnt.c:1168:
fetch: https://gist.githubusercontent.com/anonymous/eb379038510a6f15c0cb/raw/cc836df6365e975fd19b49f9eedee5f1ebfa4e46/mnemosyne-2.3.diff: Authentication error
---------

The cause seems to be that the system-ssl-lib no longer supports disabling
the verification via

	setenv("SSL_NO_VERIFY_PEER", "", 1);

which it did in the past ? (/usr/src/usr.bin/fetch/fetch.c, line 1034)

>How-To-Repeat:

	see above

>Fix:

	TODO: Find a fix.

>Release-Note:
>Audit-Trail:
>Unformatted:
