Ticket 9143 - wget of https://download.schedmd.com/slurm/slurm-20.02.3.tar.bz2 fails with 'expired certificate'
Summary: wget of https://download.schedmd.com/slurm/slurm-20.02.3.tar.bz2 fails with '...
Status: RESOLVED INFOGIVEN
Alias: None
Product: Slurm
Classification: Unclassified
Component: Other (show other tickets)
Version: 20.02.3
Hardware: Linux Linux
: 4 - Minor Issue
Assignee: Tim Wickberg
QA Contact:
URL:
Depends on:
Blocks:
 
Reported: 2020-06-02 10:43 MDT by S Senator
Modified: 2020-06-02 12:55 MDT (History)
0 users

See Also:
Site: LANL
Slinky Site: ---
Alineos Sites: ---
Atos/Eviden Sites: ---
Confidential Site: ---
Coreweave sites: ---
Cray Sites: ---
DS9 clusters: ---
Google sites: ---
HPCnow Sites: ---
HPE Sites: ---
IBM Sites: ---
NOAA SIte: ---
NoveTech Sites: ---
Nvidia HWinf-CS Sites: ---
OCF Sites: ---
Recursion Pharma Sites: ---
SFW Sites: ---
SNIC sites: ---
Tzag Elita Sites: ---
Linux Distro: ---
Machine Name:
CLE Version:
Version Fixed:
Target Release: ---
DevPrio: ---
Emory-Cloud Sites: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this ticket.
Description S Senator 2020-06-02 10:43:48 MDT 
We have an automated Makefile that is performing:
  wget -4 https://download.schedmd.com/slurm/slurm-20.02.3.tar.bz2
which fails, as below. Using the direct in-browser, human-driven web link does not generate this error. This appears to have started happening sometime in the past week.

---
727% wget -4 --no-check-certificate https://download.schedmd.com/slurm/slurm-20.02.3.tar.bz2
--2020-06-02 10:35:40--  https://download.schedmd.com/slurm/slurm-20.02.3.tar.bz2
Resolving download.schedmd.com (download.schedmd.com)... 71.19.154.210
Connecting to download.schedmd.com (download.schedmd.com)|71.19.154.210|:443... connected.
WARNING: The certificate of ‘download.schedmd.com’ is not trusted.
WARNING: The certificate of ‘download.schedmd.com’ has expired.
HTTP request sent, awaiting response... 200 OK
Length: 6330257 (6.0M) [application/x-bzip2]
Saving to: ‘slurm-20.02.3.tar.bz2.1’

slurm-20.02.3.tar.bz2.1         100%[====================================================>]   6.04M  7.43MB/s    in 0.8s    

2020-06-02 10:35:41 (7.43 MB/s) - ‘slurm-20.02.3.tar.bz2.1’ saved [6330257/6330257]

728% wget -4 https://download.schedmd.com/slurm/slurm-20.02.3.tar.bz2
--2020-06-02 10:38:07--  https://download.schedmd.com/slurm/slurm-20.02.3.tar.bz2
Resolving download.schedmd.com (download.schedmd.com)... 71.19.154.210
Connecting to download.schedmd.com (download.schedmd.com)|71.19.154.210|:443... connected.
ERROR: The certificate of ‘download.schedmd.com’ is not trusted.
ERROR: The certificate of ‘download.schedmd.com’ has expired.
729% date
Tue 02 Jun 2020 10:38:19 AM MDT
---
Comment 2 Tim Wickberg 2020-06-02 12:54:26 MDT 
Sorry about that, part of the intermediate certificate chain had expired on May 30th. (https://support.sectigo.com/articles/Knowledge/Sectigo-AddTrust-External-CA-Root-Expiring-May-30-2020)

Most web browsers don't rely on the intermediate chain we present, but instead resolved the chain through a different path. So downloading through the browser wouldn't throw an error, while wget - which was using the presented intermediate chain - did.

I've updated our intermediate bundles with a revised chain, and we should have no issues until our own certificate expires next February. (Which is a date we track internally, and will break both wget and everyone's web browser if we overlook. :) )

Thanks for letting us know.

cheers,
- Tim
Comment 3 S Senator 2020-06-02 12:55:51 MDT 
Thank you for the quick resolution. Happy June.