Salt-bootstrap: FreeBSD 10.0 - fetch fails due to SSL

[m87carlson]

FreeBSD 10.0's fetch utility has changed from 9.x, it now defaults to check the ssl certificate, so this command fails:

root@fbsd-qa:~ # fetch -o - http://bootstrap.saltstack.org
Certificate verification failed for /C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert High Assurance CA-3
34380826280:error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed:/usr/src/secure/lib/libssl/../../../crypto/openssl/ssl/s3_clnt.c:1168:
fetch: http://bootstrap.saltstack.org: Authentication error

Fetch can either have this flag passed:

fetch --no-verify-peer -o - http://bootstrap.saltstack.org | sh

Or, you can set the environment variable SSL_NO_VERIFY_PEER=1

[s0undt3ch]

Ah! Yes! This makes sense.

[s0undt3ch]

@m87carlson Think I can ask you to edit the bootstrap script locally, rename all of _freebsd_9 occurrences to _freebsd_10 and run the script to see if the minion get's installed?

If's it's all good, let me know, or, you could also create a pull request which could have the *_freebsd_10* just call the *_freebsd_9* functions? This way the credit goes to you, as it should.

[m87carlson]

You bet, I've tested that out and it seems to work just fine (created new
freebsd_10 functions that just call freebsd_9)

I'll create a pull request

On Thu, Jan 30, 2014 at 8:29 PM, Pedro Algarvio [email protected]:

@m87carlson https://github.com/m87carlson Think I can ask you to edit
the bootstrap script locally, rename all of _freebsd_9 occurrences to
_freebsd_10 and run the script to see if the minion get's installed?

If's it's all good, let me know, or, you could also create a pull request
which could have the __freebsd_10_ just call the __freebsd_9_ functions?
This way the credit goes to you, as it should.

Reply to this email directly or view it on GitHubhttps://github.com/saltstack/salt-bootstrap/issues/290#issuecomment-33759053
.

[s0undt3ch]

Awesome!

[amontalban]

Documentation should be updated as well, for example this line:

fetch -o install_salt.sh https://bootstrap.saltstack.com
sudo sh install_salt.sh

Should be:

fetch --no-verify-peer -o install_salt.sh https://bootstrap.saltstack.com
sudo sh install_salt.sh

Thanks!

[deeprave]

Actually a better (and permanent) solution to this is to:

$ pkg install ca_root_nss

then, ln or cp the combined root certificates to /etc/ssl/cert.pem
e.g.
$ ln -s /usr/local/share/certs/ca-root-nss.crt /etc/ssl/cert.pem

which installs the nss root certificates in a place where fetch(1) can find them.

Bypassing security is rarely a good solution.

[ghost]

Many thanks deeprave !

[s0undt3ch]

Thanks! I'll update the docs with this info.

[s0undt3ch]

This information is now on the readme file. Thanks!