Great, it looks like whatever they changed in Chrome no longer trusts Kitten’s¹ local certificate authority (installed and trusted by the system trust store, as you’d do in a spit enterprise).
Applies to previously trusted and working certificates too.
(The directly related module is Auto Encrypt Localhost²)
Going to look into it today and see if I can’t find a workaround.
Right, well, first the good news: It doesn’t look like anything has changed in how Chrom(ium) handles certificates installed in the system trust store.
Now the bad news: I have no idea why the certificate authority that was previously trusted on my main development machine is now showing up as untrusted. Could a Fedora Silverblue update have broken it? Will keep looking into it.
@jan Yeah, same issue in both. Very odd. But I feel the real issue is with the trust command not returning the cert. Going to look into it further. Thanks for talking it through with me :)
So I figured out what the problem is: #Homebrew. Looks like at some point I installed something with brew that installed @python3.11 and @openssl – that installed ca-certificates and p11-kit via #brew and those messed up my system trust store. Similar to the issue I had with systemd as it looks like brew installed systemd for something as well.
(Remember, I’m on #FedoraSilverblue – an immutable OS, so I was trying out Brew as an account-level package manager. Turn out, not a great idea.)
@aral I’m not on Fedora Silverblue (but on another Linux distro), but I’ve since long come to the conclusion that I think brew on Linux does too many things. There’s already a working package manager for system level packages (like ca-certificates etc), and if, or rather when, I want/need to use different Python versions, I find that pyenv works well, especially with the pyenv-virtualenv plugin.
For most other language version shenanigans, I use asdf-vm.
@aral you can try #nix as an account level package manager. Yes, I know, nix is kind of a love or hate it thing, but it will never install anything system wide, everything is contained in the nix store and easy to get rid of if you figure you don't like it.
Add comment