Solidot 的 WoTrus 证书不被信任

从 2020-10-16 开始，Solidot 似乎更换了 WoTrus (沃通) 签发的 HTTPS 证书，curl, requests 和 cloudflare 都不信任这个证书。

$ curl -v https://www.solidot.org/
* About to connect() to www.solidot.org port 443 (#0)
*   Trying 106.75.14.181...
* Connected to www.solidot.org (106.75.14.181) port 443 (#0)
* Initializing NSS with certpath: sql:/etc/pki/nssdb
*   CAfile: /etc/pki/tls/certs/ca-bundle.crt
  CApath: none
* Server certificate:
* 	subject: CN=*.solidot.org,OU=PositiveSSL Multi-Domain,OU=Domain Control Validated
* 	start date: 10 月 16 00:00:00 2019 GMT
* 	expire date: 10 月 15 23:59:59 2021 GMT
* 	common name: *.solidot.org
* 	issuer: CN=WoTrus DV Server CA,OU=Controlled by Sectigo exclusively for WoTrus CA Limited,O=WoTrus CA Limited,L=Shenzhen,ST=Guangdong,C=CN
* NSS error -8179 (SEC_ERROR_UNKNOWN_ISSUER)
* Peer's Certificate issuer is not recognized.
* Closing connection 0
curl: (60) Peer's Certificate issuer is not recognized.

requests.exceptions.SSLError: HTTPSConnectionPool(host='www.solidot.org', port=443): Max retries exceeded with url: /index.rss (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1076)')))

Xusually

2020-10-19 22:52:19 +08:00

curl -v https://www.solidot.org/
* Trying 106.75.14.181...
* TCP_NODELAY set
* Connected to www.solidot.org (106.75.14.181) port 443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* successfully set certificate verify locations:
* CAfile: /etc/ssl/cert.pem
CApath: none
* TLSv1.2 (OUT), TLS handshake, Client hello (1):
* TLSv1.2 (IN), TLS handshake, Server hello (2):
* TLSv1.2 (IN), TLS handshake, Certificate (11):
* TLSv1.2 (IN), TLS handshake, Server key exchange (12):
* TLSv1.2 (IN), TLS handshake, Server finished (14):
* TLSv1.2 (OUT), TLS handshake, Client key exchange (16):
* TLSv1.2 (OUT), TLS change cipher, Change cipher spec (1):
* TLSv1.2 (OUT), TLS handshake, Finished (20):
* TLSv1.2 (IN), TLS change cipher, Change cipher spec (1):
* TLSv1.2 (IN), TLS handshake, Finished (20):
* SSL connection using TLSv1.2 / ECDHE-RSA-AES128-GCM-SHA256
* ALPN, server accepted to use http/1.1
* Server certificate:
* subject: OU=Domain Control Validated; OU=PositiveSSL Multi-Domain; CN=*.solidot.org
* start date: Oct 16 00:00:00 2019 GMT
* expire date: Oct 15 23:59:59 2021 GMT
* subjectAltName: host "www.solidot.org" matched cert's "*.solidot.org"
* issuer: C=CN; ST=Guangdong; L=Shenzhen; O=WoTrus CA Limited; OU=Controlled by Sectigo exclusively for WoTrus CA Limited; CN=WoTrus DV Server CA
* SSL certificate verify ok.
> GET / HTTP/1.1
> Host: www.solidot.org
> User-Agent: curl/7.64.1
> Accept: */*
>
< HTTP/1.1 403 Forbidden
< Server: nginx
< Date: Mon, 19 Oct 2020 14:50:53 GMT
< Content-Type: text/html
< Content-Length: 146
< Connection: keep-alive
<
<html>
<head><title>403 Forbidden</title></head>
<body>
<center><h1>403 Forbidden</h1></center>
<hr><center>nginx</center>
</body>
</html>
* Connection #0 to host www.solidot.org left intact
* Closing connection 0

我这里没什么问题

楼主你是不是在沃通上次出事儿的时候，跟风自己删掉了自己本地对沃通的信任？