Menu
▾
▴
#5507 download.webmin.com HTTP server config insecure
The download.webmin.com HTTP servers are not configured with modern security features.
jamie.cloud.virtualmin.com:
- RC4 ist enabled
- SSLv3 is enabled
- TLS 1.0 is enabled
- TLS 1.1 is enabled
- Does not support PFS with modern browsers
- Has insecure Ciphers enabled
104.207.151.13.vultr.com:
- Does not support PFS with some browsers
See https://www.ssllabs.com/ssltest/analyze.html?d=download.webmin.com for details.
It is even worse. Some of my CentOS7 servers started yesterday to be unable to download the yum metadata.
I then checked DNS and tested both servers with local /etc/hosts entries.
download.webmin.com. 50114 IN A 104.207.151.13
download.webmin.com. 50114 IN A 108.60.199.109
jamie.cloud.virtualmin.com works OK when adding to /etc/hosts:
108.60.199.109 download.webmin.com
but 104.207.151.13.vultr.com causes trouble:
Could not retrieve mirrorlist https://download.webmin.com/download/yum/mirrorlist error was
14: curl#60 - "Peer's Certificate issuer is not recognized."
One of the configured repositories failed (Unknown),
and yum doesn't have enough cached data to continue. At this point the only
safe thing yum can do is fail. There are a few ways to work "fix" this:
For now, I pin 108.60.199.109 download.webmin.com in /etc/hosts on the affected servers.
Last edit: Robert Oschwald 2021-09-28
"Peer's Certificate issuer is not recognized" seems like the blocking issue, rather than those other SSL warnings. What's the issuer the
curloropensslcommand shows for the 104.207.151.13 address for you?