Browser: Android Chrome
No other websites affected, unlikely it's a problem on my end.
#🔒 Cert error on accessing docs.python.org
light vale
lyric depotBOT
Browser: Android Chrome
No other websites affected, unlikely it's a problem on ...
@light vale
Python help channel opened
worldly jay
Likely your end
wheat canyon
Ya, cannot repro
light vale
Likely your end
I checked it on desktop, same issue. Cert is issued for *.fastly.com (etc), so it has wrong cert domain. It's definitely not on my side.
frail blade
I see the cert being issued to www.python.org, *.python.org and python.org
worldly jay
The thing is the website usually operate on a single certificate and won't send a different certificate
So almost something mitm between you and the server
And since everyone here doesn't have the issue
It is certainly closer/related to you
light vale
I see the cert being issued to `www.python.org`, `*.python.org` and `python.org`
Solved. Cert just got updated. It was not on my side.
worldly jay
Certificate issue is almost always on the user side if every other user have no issue on it
light vale
Update: *.fastly.com over ipv6 and *.python.org over ipv4. It's reproducible reliably. Please don't try to convince me it's my fault. Fastly fucked up.
frail blade
@light vale when was the current cert that you see issued? I see March 12 2025
light vale
<@774634352188719104> when was the current cert that you see issued? I see March...
I was wrong. See my update.
frail blade
ok so it was an ipv6 problem
devout dome
could be the AAAA DNS entries (for IPv6) pointing somewhere where they shouldn't for a while or just he IPv6 web hosting at fastly
docs.python.org. has a CNAME DNS entry that points to dualstack.python.map.fastly.net. and then have a set of A records and AAAA records for that domain
worldly jay
Update: *.fastly.com over ipv6 and *.python.org over ipv4. It's reproducible rel...
Do you mean if I force my browser to only receive IPv6 DNS result I should be able to reproduce it?
If so I will try
devout dome
unless it's fixed for IPv6 now 🤷
sounded like it was
worldly jay
* Host docs.python.org:443 was resolved.
* IPv6: 2a04:4e42::223
* IPv4: (none)
* Trying [2a04:4e42::223]:443...
* ALPN: curl offers h2,http/1.1
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* CAfile: /opt/local/share/curl/curl-ca-bundle.crt
* CApath: none
* TLSv1.3 (IN), TLS handshake, Server hello (2):
* TLSv1.3 (IN), TLS change cipher, Change cipher spec (1):
* TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):
* TLSv1.3 (IN), TLS handshake, Certificate (11):
* TLSv1.3 (IN), TLS handshake, CERT verify (15):
* TLSv1.3 (IN), TLS handshake, Finished (20):
* TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):
* TLSv1.3 (OUT), TLS handshake, Finished (20):
* SSL connection using TLSv1.3 / TLS_AES_128_GCM_SHA256 / X25519MLKEM768 / RSASSA-PSS
* ALPN: server accepted h2
* Server certificate:
* subject: CN=www.python.org
* start date: Mar 12 12:55:26 2025 GMT
* expire date: Apr 13 12:55:25 2026 GMT
* subjectAltName: host "docs.python.org" matched cert's "*.python.org"
* issuer: C=BE; O=GlobalSign nv-sa; CN=GlobalSign Atlas R3 DV TLS CA 2025 Q1
* SSL certificate verify ok.
* Certificate level 0: Public key type RSA (2048/112 Bits/secBits), signed using sha256WithRSAEncryption
* Certificate level 1: Public key type RSA (2048/112 Bits/secBits), signed using sha256WithRSAEncryption
* Certificate level 2: Public key type RSA (2048/112 Bits/secBits), signed using sha256WithRSAEncryption
* Connected to docs.python.org (2a04:4e42::223) port 443
* using HTTP/2
* [HTTP/2] [1] OPENED stream for https://docs.python.org/3/
* [HTTP/2] [1] [:method: GET]
* [HTTP/2] [1] [:scheme: https]
* [HTTP/2] [1] [:authority: docs.python.org]
* [HTTP/2] [1] [:path: /3/]
* [HTTP/2] [1] [user-agent: curl/8.13.0]
* [HTTP/2] [1] [accept: */*]
I just cannot reproduce
This is curl https://docs.python.org/ --verbose --ipv6
lyric depotBOT
Python help channel closed for inactivity