Dnscrypt-proxy: Entware DOH resolvers issue

[ankar84]

If I try to use CloudFlare DOH resolver on my Entware 3 router Zyxel Keenetic Ultra I get error:
[ERROR] Get https://dns.cloudflare.com/dns-query?body=yv4BAAABAAAAAAABAAACAAEAACkQAAAAgAAAAA&ct=&dns=yv4BAAABAAAAAAABAAACAAEAACkQAAAAgAAAAA&random_padding=XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX: x509: failed to load system roots and no roots provided
And I see, that no DOH resovers works for me.
doh_servers = true in config file
Package ca-certificates (20170717) installed in root is up to date.
How can I fix it? Where is the problem?

[fantuz]

how about https://dns.cloudflare.com/dns-query?body=yv4BAAABAAAAAAABAAACAAEAACkQAAAAgAAAAA&ct=application/dns-udpwireformat&dns=q80BAAABAAAAAAAAA3d3dwdleGFtcGxlA2NvbQAAAQAB ?

from: https://developers.cloudflare.com/1.1.1.1/dns-over-https/wireformat/

[jedisct1]

Hi @ankar84

I've never stumbled upon this, but a Google search for this exact message [returns many results].(https://www.google.fr/search?q=x509%3A+failed+to+load+system+roots+and+no+roots+provided&ie=utf-8&oe=utf-8&client=firefox-b-ab&gfe_rd=cr&dcr=0&ei=IhPFWrWPB-vS8Ae8hYmQAg).

Apparently, either the ca-certificates package is incomplete, or some files has to be present.

Do you have a /etc/ssl/certs/ca-certificates.crt file?

[ankar84]

Hi, @fantuz
That query was made by dnscrypt-proxy 2.0.8 and I can't change it,
Hello, @jedisct1
Yes, I googled before open issue and I understood that problem is about Entware root certificates and that's why I wrote that Package ca-certificates is installed on device.
Answering your question, no I don't have '/opt/etc/ssl/certs/ca-certificates.crt' file. I did try to reinstall ca-certificates with no luck.
@ryzhovau, can you help us with that?

[zyxmon]

# opkg install ca-certificates
Package ca-certificates (20170717) installed in root is up to date.
# opkg files ca-certificates
Package ca-certificates (20170717) is installed on root and has the following files:
/opt/etc/ssl/certs/2c11d503.0
/opt/etc/ssl/certs/9d520b32.0
/opt/etc/ssl/certs/d957f522.0
/opt/etc/ssl/certs/Hongkong_Post_Root_CA_1.crt
.....
l# ls /opt/etc/ssl/certs/
02265526.0
03179a64.0
034868d6.0
062cdee6.0
064e0aa9.0
080911ac.0
09789157.0
......

[ankar84]

Hi, @zyxmon
Yes, I get same results - installed ca-certificates (20170717) package and lots of Root CA certificates and *.0 files in /opt/etc/ssl/certs/
But there is no /opt/etc/ssl/certs/ca-certificates.crt file, and maybe dnscrypt-proxy 2.0.8 need it to work correctly with DoH resolvers.
What can I do to get updated ca-certificates.crt file in right place?
UPD.
I installed ca-bundle and now I have /opt/etc/ssl/certs/ca-certificates.crt file in place. But get same x509: failed to load system roots and no roots provided error. Maybe related to Entware etc path (/opt/etc/ but not /etc/)

[zyxmon]

opkg install ca-bundle

[zyxmon]

@ankar84 - please try this http://bin.entware.net/mipselsf-k3.4/test/dnscrypt-proxy2_2.0.8-1_mipsel-3.4.ipk
We have patched go libs to include entware paths.
Please start an Issue here in case of problems - https://github.com/Entware/Entware/issues

[ankar84]

@zyxmon thanks a lot! I will try it, but could you plese tell me how to install that ipk package to my Entware?
Now I installing and update dnscrypt-proxy v2 manually (download new version and replace old one)
And I know how to install packages using opkg install, but how to that ipk file?
Thanks!

[zyxmon]

opkg install URL