[NETBEANS-2475] TSL Certificate on netbeans-vm.apache.org expired

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Not A Bug
• Affects Version/s: 11.0
• Labels: certificate plugin pull-request-available tls
• Assignee: Unassigned
• Reporter: Jan Drees
• Created: 27/Apr/19 17:34
• Updated: 03/Nov/20 15:49
• Resolved: 25/Jun/19 13:31

Description

When trying to install the PHP plugin collection in Netbeans 11.0, the install fails with the following error:

Networking problem in https://netbeans.apache.org/nb/updates/11.0/php/org-netbeans-modules-php-api-framework.nbm

Check your proxy settings or try again later. The server may be unavailable at the moment. You may also want to make sure that your firewall is not blocking network traffic. Your cache may be out of date. Please click Check for Updates to refresh content.

Upon trying to visit the mentioned domain https:// netbeans-vm.apache.org/ in Firefox, I discovered that the TLS certificate for that domain has expired, preventing any HTTPS-based connections.

$ gnutls-cli --print-cert netbeans-vm.apache.org
Processed 154 CA certificate(s).
Resolving 'netbeans-vm.apache.org:443'...
Connecting to '52.6.211.55:443'...

• Certificate type: X.509
• Got a certificate list of 2 certificates.
• Certificate[0] info:
   - subject `CN=netbeans-vm.apache.org', issuer `CN=Let's Encrypt Authority X3,O=Let's Encrypt,C=US', serial 0x0360dba212877b97d97be8f9b8dced4a1406, RSA key 2048 bits, signed using RSA-SHA256, activated `2019-01-20 09:35:33 UTC', expires `2019-04-20 09:35:33 UTC', pin-sha256="TZ+iqbD3DYo3aZFiHdlIwqQxL10gl8CLPoKnCHyizd8="
          Public Key ID:
                  sha1:de32a1adfe21fa09592be85d88ffcb274df76176
                  sha256:4d9fa2a9b0f70d8a376991621dd948c2a4312f5d2097c08b3e82a7087ca2cddf
          Public Key PIN:
                  pin-sha256:TZ+iqbD3DYo3aZFiHdlIwqQxL10gl8CLPoKnCHyizd8=

----BEGIN CERTIFICATE----
MIIFdzCCBF+gAwIBAgISA2DbohKHe5fZe+j5uNztShQGMA0GCSqGSIb3DQEBCwUA
MEoxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNyeXB0MSMwIQYDVQQD
ExpMZXQncyBFbmNyeXB0IEF1dGhvcml0eSBYMzAeFw0xOTAxMjAwOTM1MzNaFw0x
OTA0MjAwOTM1MzNaMCExHzAdBgNVBAMTFm5ldGJlYW5zLXZtLmFwYWNoZS5vcmcw
ggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCqr/C+cqeu7qAW0zOlfnh7
7jaRyPxnth3e/cvA+S2140n3rLXiqVYpfBmfxJScYeFow7PHQo4NaYpp1IV4Yr7q
PNpF+GdUWDllPVbZHgarZj/cgT2D1B7+tOqvvs7wO4BOc3qjD3IT5VkltqBtkgQo
AZeIldP+4auO7MCHoZXV/+8LMDGJFQzZm20FnEYs6w4fPg0rzMml6nlTMD+5JXbl
OyYC4M9ijyDtRoFfakc5bvmSkqOjeTViliHB5dFTEy9loxIr1DZQrfGiKjXWqhoY
x61uGXAcT4UAWb1Bul4qJrnKb8BiWfsz3YqwbuA0Ww/QX7PYtZj1Z5UI1M2vIfVX
AgMBAAGjggJ+MIICejAOBgNVHQ8BAf8EBAMCBaAwHQYDVR0lBBYwFAYIKwYBBQUH
AwEGCCsGAQUFBwMCMAwGA1UdEwEB/wQCMAAwHQYDVR0OBBYEFLh4PfsbtvnJB47e
PCxj2Vwrya/cMB8GA1UdIwQYMBaAFKhKamMEfd265tE5t6ZFZe/zqOyhMG8GCCsG
AQUFBwEBBGMwYTAuBggrBgEFBQcwAYYiaHR0cDovL29jc3AuaW50LXgzLmxldHNl
bmNyeXB0Lm9yZzAvBggrBgEFBQcwAoYjaHR0cDovL2NlcnQuaW50LXgzLmxldHNl
bmNyeXB0Lm9yZy8wNAYDVR0RBC0wK4IRYml0cy5uZXRiZWFucy5vcmeCFm5ldGJl
YW5zLXZtLmFwYWNoZS5vcmcwTAYDVR0gBEUwQzAIBgZngQwBAgEwNwYLKwYBBAGC
3xMBAQEwKDAmBggrBgEFBQcCARYaaHR0cDovL2Nwcy5sZXRzZW5jcnlwdC5vcmcw
ggEEBgorBgEEAdZ5AgQCBIH1BIHyAPAAdgDiaUuuJujpQAnohhu2O4PUPuf+dIj7
pI8okwGd3fHb/gAAAWhq1G2pAAAEAwBHMEUCIBA6EO8bsCaBWGh2mwcy4hxd5AK0
gud3WhFU8fUmp2YFAiEAvoJDbtVyKP+280fS+KKOto5KepdofVrQVygiX/7RE/kA
dgBj8tvN6DvMLM8LcoQnV2szpI1hd4+9daY4scdoVEvYjQAAAWhq1G2oAAAEAwBH
MEUCIQCQrmnBH8DPixK8/H2uPLZGIfts40P1yZ08qqy4doQX7QIgTO11cEr/2HFD
Yoh8CK2o7frTOKV8/rnWNtoG+bh4r3cwDQYJKoZIhvcNAQELBQADggEBADwPFwMg
5MzVQDjpnLD9fn+CVt90DxJ86lDdhMrrpJ45af6i+2g+UsopZUDZtQPA996odRkv
oRrtsI/frzHqTuJMKxM00JuuEp8cSbrUvT/Ypa7XjXTPVjWmp2iUPFso+JRGgX7Z
wcQDCb7TVd4SXIuCVWN2BiN+LQveKue/kxRUwbGuVc+u3gdE1cfZbXL7iGWSJFEu
02Nrf8VFvjg9hhDePAh2IIx7/vCEEIa4LSNRITf7kj5FbhoDhlY0DRe8TAuLrxwM
OPqHtfCgxUJM+yH+IN4T5+eg8Pkiqy5OroTq9HrT6xXReTPXt/JfrX0HsXiufdHn
Ul86u5LsaI5eYSU=
----END CERTIFICATE----

• Certificate[1] info:
   - subject `CN=Let's Encrypt Authority X3,O=Let's Encrypt,C=US', issuer `CN=DST Root CA X3,O=Digital Signature Trust Co.', serial 0x0a0141420000015385736a0b85eca708, RSA key 2048 bits, signed using RSA-SHA256, activated `2016-03-17 16:40:46 UTC', expires `2021-03-17 16:40:46 UTC', pin-sha256="YLh1dUR9y6Kja30RrAn7JKnbQG/uEtLMkBgFF2Fuihg="

----BEGIN CERTIFICATE----
MIIEkjCCA3qgAwIBAgIQCgFBQgAAAVOFc2oLheynCDANBgkqhkiG9w0BAQsFADA/
MSQwIgYDVQQKExtEaWdpdGFsIFNpZ25hdHVyZSBUcnVzdCBDby4xFzAVBgNVBAMT
DkRTVCBSb290IENBIFgzMB4XDTE2MDMxNzE2NDA0NloXDTIxMDMxNzE2NDA0Nlow
SjELMAkGA1UEBhMCVVMxFjAUBgNVBAoTDUxldCdzIEVuY3J5cHQxIzAhBgNVBAMT
GkxldCdzIEVuY3J5cHQgQXV0aG9yaXR5IFgzMIIBIjANBgkqhkiG9w0BAQEFAAOC
AQ8AMIIBCgKCAQEAnNMM8FrlLke3cl03g7NoYzDq1zUmGSXhvb418XCSL7e4S0EF
q6meNQhY7LEqxGiHC6PjdeTm86dicbp5gWAf15Gan/PQeGdxyGkOlZHP/uaZ6WA8
SMx+yk13EiSdRxta67nsHjcAHJyse6cF6s5K671B5TaYucv9bTyWaN8jKkKQDIZ0
Z8h/pZq4UmEUEz9l6YKHy9v6Dlb2honzhT+Xhq+w3Brvaw2VFn3EK6BlspkENnWA
a6xK8xuQSXgvopZPKiAlKQTGdMDQMc2PMTiVFrqoM7hD8bEfwzB/onkxEz0tNvjj
/PIzark5McWvxI0NHWQWM6r6hCm21AvA2H3DkwIDAQABo4IBfTCCAXkwEgYDVR0T
AQH/BAgwBgEB/wIBADAOBgNVHQ8BAf8EBAMCAYYwfwYIKwYBBQUHAQEEczBxMDIG
CCsGAQUFBzABhiZodHRwOi8vaXNyZy50cnVzdGlkLm9jc3AuaWRlbnRydXN0LmNv
bTA7BggrBgEFBQcwAoYvaHR0cDovL2FwcHMuaWRlbnRydXN0LmNvbS9yb290cy9k
c3Ryb290Y2F4My5wN2MwHwYDVR0jBBgwFoAUxKexpHsscfrb4UuQdf/EFWCFiRAw
VAYDVR0gBE0wSzAIBgZngQwBAgEwPwYLKwYBBAGC3xMBAQEwMDAuBggrBgEFBQcC
ARYiaHR0cDovL2Nwcy5yb290LXgxLmxldHNlbmNyeXB0Lm9yZzA8BgNVHR8ENTAz
MDGgL6AthitodHRwOi8vY3JsLmlkZW50cnVzdC5jb20vRFNUUk9PVENBWDNDUkwu
Y3JsMB0GA1UdDgQWBBSoSmpjBH3duubRObemRWXv86jsoTANBgkqhkiG9w0BAQsF
AAOCAQEA3TPXEfNjWDjdGBX7CVW+dla5cEilaUcne8IkCJLxWh9KEik3JHRRHGJo
uM2VcGfl96S8TihRzZvoroed6ti6WqEBmtzw3Wodatg+VyOeph4EYpr/1wXKtx8/
wApIvJSwtmVi4MFU5aMqrSDE6ea73Mj2tcMyo5jMd6jmeWUHK8so/joWUoHOUgwu
X4Po1QYz+3dszkDqMp4fklxBwXRsW10KXzPMTZ+sOPAveyxindmjkW8lGy+QsRlG
PfZ+G6Z6h7mjem0Y+iWlkYcV4PIWL1iwBi8saCbGS5jN2p8M+X+Q7UNKEkROb3N6
KOqkqm57TH2H3eDJAkSnh6/DNFu0Qg==
----END CERTIFICATE----

• Status: The certificate is NOT trusted. The certificate chain uses expired certificate.
  • • PKI verification of server certificate failed...
    • Fatal error: Error in the certificate.

This means that currently, no plugins may be installed that are served on that domain.

Additionally, meta-packages such as PHP are affected as well. There is no way to skip the installation of one of the contained packages.

This is only resolvable by the administrators of netbeans-vm.apache.org.