authentication errors on 'make fetchindex' in /usr/ports

[Sean C. Farley]

On Thu, 3 Dec 2020, Bob Willcox wrote:

> I am trying to upgrade a 12.1-stable system installed back in July to 
> 12.2-stable.  I downloaded the new ports hierarchy and now when I 
> attempt to run 'make fetchindex'
> I get these errors:
>
> /usr/bin/env  fetch -am -o /usr/ports/INDEX-12.bz2 https://www.FreeBSD.org/ports/INDEX-12.bz2
> Certificate verification failed for /C=US/O=Let's Encrypt/CN=Let's Encrypt Authority X3
> 546533376:error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed:/usr/src/crypto/openssl/ssl/statem/statem_clnt.c:1915:
> fetch: https://www.FreeBSD.org/ports/INDEX-12.bz2: Authentication error
> Certificate verification failed for /C=US/O=Let's Encrypt/CN=Let's Encrypt Authority X3
> 546533376:error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed:/usr/src/crypto/openssl/ssl/statem/statem_clnt.c:1915:
>
> Can someone help?
>
> Thanks,
> Bob

That looks like you need to run certctl(8):  certctl rehash.

This is the commit that brought it into 11-STABLE and 12-STABLE: 
https://svnweb.freebsd.org/base?view=revision&revision=357082

However, I recommend reading the man page for it first in case you have 
cert hashes already in a place like /etc/ssl/certs.  It took me a bit by 
surprise because my hashes that were linked from a separate directory 
were removed.

Sean
-- 
scf at FreeBSD.org