RISOLTO lynx non apre alcuni siti

[gino62]

cat /etc/debian_version
10.7
------------------------------------------------------
Non riesco a capire come mai lynx non apra alcuni siti, ad esempio:
lynx -dump https://www.ecomstation.it/pido2/home/mentore/wget/wget.html

Ricerca in corso di www.ecomstation.it
Creazione della connessione HTTPS a www.ecomstation.it in corso
lynx: impossibile accedere al file di avvio https://www.ecomstation.it/pido2/home/mentore/wget/wget.html

se apro linx e con google faccio una ricerca, lo stesso sito selezionato mi dà come risposta:
Errore SSL: The certificate is NOT trusted. The certificate iss.... Continuare? (n)

non capisco se è un problema di certificati

curl -v https://www.ecomstation.it/pido2/home/mentore/wget/wget.html
curl: (60) SSL certificate problem: unable to get local issuer certificate
More details here: https://curl.haxx.se/docs/sslcerts.html

curl failed to verify the legitimacy of the server and therefore could not
establish a secure connection to it. To learn more about this situation and
how to fix it, please visit the web page mentioned above.

 

[gino62]

Probabilmente non ci sono i certificati:

Spoiler

openssl s_client -connect ecomstation.it:443 -CApath /etc/ssl/certs
CONNECTED(00000003)
depth=0 CN = www.ecomstation.it
verify error:num=20:unable to get local issuer certificate
verify return:1
depth=0 CN = www.ecomstation.it
verify error:num=21:unable to verify the first certificate
verify return:1
---
Certificate chain
0 s:CN = www.ecomstation.it
i:C = US, O = Let's Encrypt, CN = R3
1 s:C = US, O = Let's Encrypt, CN = Let's Encrypt Authority X3
i:O = Digital Signature Trust Co., CN = DST Root CA X3
---
Server certificate
-----BEGIN CERTIFICATE-----
MIIFKzCCBBOgAwIBAgISBOWLUfG6gi4w0qV6fl4c+50hMA0GCSqGSIb3DQEBCwUA
MDIxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNyeXB0MQswCQYDVQQD
EwJSMzAeFw0yMTAyMDIxOTE1MTRaFw0yMTA1MDMxOTE1MTRaMB0xGzAZBgNVBAMT
End3dy5lY29tc3RhdGlvbi5pdDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoC
ggEBAKuB7R2dV1nugNdHFbOu6PSqziYf3t7BL4XIeG7+G21vF2/ZHJdRJC7Dh0Yv
AalULY87xQ52BlGxRwIRZWmtrrv6UqjfcgrSzIynCuVdMd4PwQ3zDhfPLz3MSkDX
zzBtyLsuFNrayaRbT42NWr4Xw6U2xUwRgHB2NgORtZEgV+mYOU/KAkSj3omB4k4r
HIG74/jPc/O6Kyn+N7VjyZzRNLoeDMaEQLrha8ZvEvzIIU/LgJmHaGHgsYYc+XvB
jNvGauN42nkLtwcoPAV9kbSAw9K5PfrDEno0NqClbriNycFtI0BZ7utNwd+agyTu
OQ786iVVGiqJ2xzqSh/rqD+L3SkCAwEAAaOCAk4wggJKMA4GA1UdDwEB/wQEAwIF
oDAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwDAYDVR0TAQH/BAIwADAd
BgNVHQ4EFgQUlkzlE//vr9oDfB1h/asozaOjEgQwHwYDVR0jBBgwFoAUFC6zF7dY
VsuuUAlA5h+vnYsUwsYwVQYIKwYBBQUHAQEESTBHMCEGCCsGAQUFBzABhhVodHRw
Oi8vcjMuby5sZW5jci5vcmcwIgYIKwYBBQUHMAKGFmh0dHA6Ly9yMy5pLmxlbmNy
Lm9yZy8wHQYDVR0RBBYwFIISd3d3LmVjb21zdGF0aW9uLml0MEwGA1UdIARFMEMw
CAYGZ4EMAQIBMDcGCysGAQQBgt8TAQEBMCgwJgYIKwYBBQUHAgEWGmh0dHA6Ly9j
cHMubGV0c2VuY3J5cHQub3JnMIIBBQYKKwYBBAHWeQIEAgSB9gSB8wDxAHYA9lyU
L9F3MCIUVBgIMJRWjuNNExkzv98MLyALzE7xZOMAAAF3ZGKFawAABAMARzBFAiEA
+74mbunKTiiRFIkst2C2CPSoQsWyUUlQz67pZO3xVxkCIG03g8Tk8xTBc9NE60qZ
iaIxmRgfGb0+R23/WMA2E8xGAHcAb1N2rDHwMRnYmQCkURX/dxUcEdkCwQApBo2y
CJo32RMAAAF3ZGKFoQAABAMASDBGAiEA5fS0hyc7ywA8RmOrZm29A5slTUTq3D8g
INaOKYiOyqkCIQDH0EjA8S+WfqIXhsqOCUYNlY6/gabbr2IyncMYH4YenzANBgkq
hkiG9w0BAQsFAAOCAQEAbXRqIugaz5HD9dBMfCI907MzkRBeBpKZ8xzJrCqFdddY
O0xGoVTvHNdxwpu4X7CPIuUh1CvX3EV7QbNCeHUa9Ax3UWUSo74pUX7pbfEtAEu/
p4miCIDO6aMe6mhYvHO39WnLFrZzvlyQtBY+PKCbsKxaQ8fbjolmthrSBSl1nxIC
Oo/4f/+9Soci2icIGmz+n6vO/yO80EMAwnmnEbBrTJ/7qgpkpQGWKZ8oyku1sO5d
mH1cU3lL/X5igC1UkABE/B7AKCGWhb+fb4OuO8lwyWdgn/5rKDbA0YffU2xl4eyq
Vhq1O6wwFVO1X6A591lGUGABGMs7k17KauHCJa8BOQ==
-----END CERTIFICATE-----
subject=CN = www.ecomstation.it

issuer=C = US, O = Let's Encrypt, CN = R3

---
No client certificate CA names sent
Peer signing digest: SHA512
Peer signature type: RSA
Server Temp Key: ECDH, P-256, 256 bits
---
SSL handshake has read 3210 bytes and written 432 bytes
Verification error: unable to verify the first certificate
---
New, TLSv1.2, Cipher is ECDHE-RSA-AES256-GCM-SHA384
Server public key is 2048 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
Protocol : TLSv1.2
Cipher : ECDHE-RSA-AES256-GCM-SHA384
Session-ID: 82370BBD9FE4F79776DDEBF9A27627B1309ECF5CDC13288D50CE1948EA1B4F06
Session-ID-ctx:
Master-Key: C291F34F4FA9AC02C6ACEF10A8D7DACA0C639DA6A1A81897FC39B0399EA4F837184FCA7BACFEAC2A6A0EEEED46FDD5F0
PSK identity: None
PSK identity hint: None
SRP username: None
TLS session ticket lifetime hint: 300 (seconds)
TLS session ticket:
0000 - 5a e4 6e 87 59 9b 5d 70-d8 3c 5c fb c0 88 5e 3e Z.n.Y.]p.<\...^>
0010 - c0 fc a5 ed f9 75 a5 fb-8a 3f 06 5a 4f b9 87 52 .....u...?.ZO..R
0020 - 48 a8 54 9c 77 99 1b cd-64 33 27 ce 9c 37 4d c4 H.T.w...d3'..7M.
0030 - 0c 85 6c 1b d6 04 65 5d-72 8d 87 f1 bc 06 15 79 ..l...e]r......y
0040 - 9b e9 55 1e 9a 08 c7 8d-9b 62 bd d0 82 12 62 7e ..U......b....b~
0050 - c6 67 3d ed 16 03 d6 b0-1d 0f c2 81 31 37 9b 82 .g=.........17..
0060 - e9 76 87 c6 34 9d 45 8f-f7 35 b9 35 87 b9 3c 07 .v..4.E..5.5..<.
0070 - 64 d6 9a 16 62 ba ed 3a-5a 6a db 91 d7 94 2d 3f d...b..:Zj....-?
0080 - df dd 06 56 d3 22 59 8b-8f 90 3b b7 0c fc 24 62 ...V."Y...;...$b
0090 - d5 cd cc b7 84 da f8 93-48 22 2c a9 d9 03 90 fc ........H",.....
00a0 - fc 3c d7 97 ea 04 c1 c5-4b 18 60 0f 2c df 31 45 .<......K.`.,.1E
00b0 - 64 35 d2 73 fb df 59 c4-dc 92 c3 6b fb 95 8f cc d5.s..Y....k....
00c0 - 86 89 2f dc c2 d8 d4 93-74 c8 14 a1 b0 39 22 93 ../.....t....9".

Start Time: 1612902527
Timeout : 7200 (sec)
Verify return code: 21 (unable to verify the first certificate)
Extended master secret: no
---
closed

Ma come mai con Firefox ESR li apro?

 

[gino62]

Non sono riuscito ad aggiungere i certificati con openssl.
Ho optato per la modifica del file /etc/lynx/lynx.cfg
posto
FORCE_SSL_PROMPT:YES (Se FORCE_SSL_PROMPT è impostato su "sì", le condizioni discutibili, come i certificati autofirmati, verranno ignorate.)