Well, it still has cert issues "Peer's Certificate has expired.". Too bad.
I use it and E-S (always nice to have a backup).

minxmin's certificate is from Let's Encrypt and refers to
fleegle.mixmin.net if that's of any value. Wonder if I should visit Let's
Encrypt and install something from them...

On 7/24/21 10:49 PM, max schnell wrote:
> Wonder if I should visit Let's Encrypt and install something from them.

You should not need to.

--
Grant. . . .
unix || die

On Sat, 24 Jul 2021 22:49:42 -0600, max schnell wrote:

> Well, it still has cert issues "Peer's Certificate has expired.". Too
> bad.
> I use it and E-S (always nice to have a backup).
>
> minxmin's certificate is from Let's Encrypt and refers to
> fleegle.mixmin.net if that's of any value. Wonder if I should visit
> Let's Encrypt and install something from them...

No, they just use certbot to update and its well knows for constant
failures.

moved to acme.sh several years ago and have not had to intervene in any
of my lets encrypt certs since, i guess debian provides certbot and they
use the debian package, debian people are strange like that, they have
little idea about sources :)

On Sat, 24 Jul 2021 22:49:42 -0600, max schnell wrote in
Message-Id: <sdiqh4$at3$2@dont-email.me>:

>
> Well, it still has cert issues "Peer's Certificate has expired.". Too bad.
> I use it and E-S (always nice to have a backup).
>
> minxmin's certificate is from Let's Encrypt and refers to
> fleegle.mixmin.net if that's of any value. Wonder if I should visit Let's
> Encrypt and install something from them...

Hi Max,

Please can you try it again now? Getting LetsEncrypt to play nicely
with INN and nnrpd is a bit of a mission. I've tested it myself and
it's verifying successfully with:
openssl s_client -showcerts news.mixmin.net:563

--
And with glasses high we raised a cry for freedom had arrived

Il 26/07/21 15:40, Steve Crook ha scritto:
> Please can you try it again now? Getting LetsEncrypt to play nicely
> with INN and nnrpd is a bit of a mission.

$ ls /etc/news/ssl/ -l
totale 248
-r-------- 1 news news 215509 gen 24 2021 ca-cert.pem
-r-------- 1 news news 1858 lug 20 17:51 cert.pem
-r-------- 1 news news 3750 lug 20 17:52 chain.pem
-r-------- 1 news news 5608 lug 20 17:52 fullchain.pem
-r-------- 1 news news 1939 gen 24 2021 isrgrootx1.pem
-r-------- 1 news news 790 gen 24 2021 isrg-root-x2.pem
-r-------- 1 news news 1021 gen 24 2021 lets-encrypt-e1.pem
-r-------- 1 news news 1826 gen 24 2021 lets-encrypt-r3.pem
-r-------- 1 news news 1708 lug 20 17:52 privkey.pem

Steve Crook wrote:
> On Sat, 24 Jul 2021 22:49:42 -0600, max schnell wrote in
> Message-Id: <sdiqh4$at3$2@dont-email.me>:
>
>> Well, it still has cert issues "Peer's Certificate has expired.". Too bad.
>> I use it and E-S (always nice to have a backup).
>>
>> minxmin's certificate is from Let's Encrypt and refers to
>> fleegle.mixmin.net if that's of any value. Wonder if I should visit Let's
>> Encrypt and install something from them...
>
> Hi Max,
>
> Please can you try it again now? Getting LetsEncrypt to play nicely
> with INN and nnrpd is a bit of a mission. I've tested it myself and
> it's verifying successfully with:
> openssl s_client -showcerts news.mixmin.net:563
>

Working here.

https://i.postimg.cc/Bn5ccSSB/mixmin-563-working.gif

Paul

In article <BLlMI.91881$Vv6.25066@fx45.iad>
=?UTF-8?B?8J+YiSBHb29kIEd1eSDwn5iJ?= <Hello.World@example.onion>
wrote:
>
> Content-Type: text/plain; charset=utf-8; format=flowed
> Content-Transfer-Encoding: 7bit
>
> On 26/07/2021 14:40, Steve Crook wrote:
> >
> > Getting LetsEncrypt to play nicely
> > with INN and nnrpd is a bit of a mission.
>
>
> Can you not use CloudFlare free service? CloudFlare gives you free SSL
> by default and it is renewed automatically.

CloudFlare sucks dick. You probably do too for suggesting it.

> In article <BLlMI.91881$Vv6.25066@fx45.iad>
> =?UTF-8?B?8J+YiSBHb29kIEd1eSDwn5iJ?= <Hello.World@example.onion>
> wrote:
>>
>> Content-Type: text/plain; charset=utf-8; format=flowed
>> Content-Transfer-Encoding: 7bit
>>
>> On 26/07/2021 14:40, Steve Crook wrote:
>> >
>> > Getting LetsEncrypt to play nicely with INN and nnrpd is a bit of a
>> > mission.
>>
>>
>> Can you not use CloudFlare free service? CloudFlare gives you free SSL
>> by default and it is renewed automatically.
>
> CloudFlare sucks dick. You probably do too for suggesting it.

I did not see the original post so replying to that poster here,
probabvly becasue its the html crusader so its posts are discarded here,
anyway...

why use cloudfare free certs when LE free certs works fine and are more
widely in use, the certs renew fine, we use acme.sh to handle it, certbot
the debian preferred updater which wont even install on slackware or
gentoo is fucked, it gives too many problems has done for years, thos e
have moved to what we use - acme.sh have not had to touch it since in
many years, but maybe inn has quirks which means any cert will be a
problem with renewal.

never understood why someon wul;d use ssl on newsgroups anyway, makes no
sense, unless you want to beat youre tiny chest trying to be the kool kid
on hte block.

On 8/1/21 6:57 AM, noel wrote:
> never understood why someon wul;d use ssl on newsgroups anyway,
Metadata. External 3rd parties can knowing that I'm connecting to a
newsgroup server but they don't have visibility into which newsgroups or
articles I'm reading or what I'm sending.

The argument of "Usenet is public" doesn't hold water when it's used for
private NNTP networks.

Last, but not least, is creating more TLS noise that would be big
brother needs to wade through to find signal for people they care about.
(Eliding filtering.) There by helping people hide that have a
legitimate reason for doing so.

But mostly to thwart metadata collection for groups I subscribe to and
messages that I read.

--
Grant. . . .
unix || die

Grant Taylor <gtaylor@tnetconsulting.net> wrote:
>On 8/1/21 6:57 AM, noel wrote:

>>never understood why someon wul;d use ssl on newsgroups anyway, Metadata. External 3rd parties can knowing that I'm connecting to a newsgroup server but they don't have visibility into which newsgroups or articles I'm reading or what I'm sending.

>The argument of "Usenet is public" doesn't hold water when it's used for
>private NNTP networks.

That's a reasonable definition, that not all newsgroups are Useet. Public
newsgroups are part of Usenet. Private newsgroups are not.

>. . .

On Sun, 01 Aug 2021 11:39:31 -0600, Grant Taylor wrote:

> On 8/1/21 6:57 AM, noel wrote:
>> never understood why someon wul;d use ssl on newsgroups anyway,
> Metadata. External 3rd parties can knowing that I'm connecting to a
> newsgroup server but they don't have visibility into which newsgroups or
> articles I'm reading or what I'm sending.
>
> The argument of "Usenet is public" doesn't hold water when it's used for
> private NNTP networks.
>
> Last, but not least, is creating more TLS noise that would be big
> brother needs to wade through to find signal for people they care about.
> (Eliding filtering.) There by helping people hide that have a
> legitimate reason for doing so.
>
> But mostly to thwart metadata collection for groups I subscribe to and
> messages that I read.

I get ya, I suppose some 3 letter angencies sniffing your traffic might
add it to your file :)

At least govt wise, no chance here by logs, we have metadata retention
laws, but they explicitly exclude web traffic, ftp traffic, dns, usenet,
irc... very funny, our ever so clever politicians in Australia think
terrorists only use email and sms to discuss their devious plots :)

So we log SFA, oh if you post to usenet yes we log that, so we know who
to castrate for spamming, but thats about it.

As for email a US based friend and I plotted to periodically email each
other, with encrypted emails with junk random dev null :) we did this
about half dozen times a day for weeks, a couple years back just to piss
off a certain US 3 letter agency when it was revealed sencrypted
messages set off their red flags hehehe

On Sun, 01 Aug 2021 21:15:59 +0000, Adam H. Kerman wrote:

> Grant Taylor <gtaylor@tnetconsulting.net> wrote:
>>On 8/1/21 6:57 AM, noel wrote:
>
>>>never understood why someon wul;d use ssl on newsgroups anyway,
>>>Metadata. External 3rd parties can knowing that I'm connecting to a
>>>newsgroup server but they don't have visibility into which newsgroups
>>>or articles I'm reading or what I'm sending.
>
>>The argument of "Usenet is public" doesn't hold water when it's used for
>>private NNTP networks.
>
> That's a reasonable definition, that not all newsgroups are Useet.
> Public newsgroups are part of Usenet. Private newsgroups are not.
>
>>. . .

its all usenet, no matter if its public or private

On 8/2/21 8:27 AM, noel wrote:
> I get ya, I suppose some 3 letter angencies sniffing your traffic might
> add it to your file:)

It's not so much the three letter agencies that I'm worried about. It's
more someone else on path that I want to thwart.

The TLAs will get court orders to have servers in their jurisdiction
turn things over.

I'm more interested in making their life more difficult (but not
impossible) and thwarting annoyances like people running FireSheet or
trying to sniff my news server password to cancel articles on servers.

--
Grant. . . .
unix || die

On Mon, 02 Aug 2021 09:31:10 -0600, Grant Taylor wrote:

>
>
> trying to sniff my news server password to cancel articles on servers.

I'm very surprised if any server actually honors those, its been abused
to death, my servers here and at my employers at the time, haven't since
the mid 90's, they are completely discarded, no notifications no logging,
nudda.

On 8/3/21 8:56 PM, noel wrote:
> I'm very surprised if any server actually honors those
GRC's news server does. They also do so in a special way.

--
Grant. . . .
unix || die

On Tue, 03 Aug 2021 22:00:31 -0600, Grant Taylor wrote:

> On 8/3/21 8:56 PM, noel wrote:
>> I'm very surprised if any server actually honors those
> GRC's news server does. They also do so in a special way.

scary :)

Grant Taylor <gtaylor@tnetconsulting.net> wrote:

> On 8/3/21 8:56 PM, noel wrote:
> > I'm very surprised if any server actually honors those
>
> GRC's news server does. They also do so in a special way.

ITYF that GRC's news is not part of public Usenet and GRC groups
are only available via GRC's private news server (or web server).

<https://www.grc.com/discussions.htm>

--
^Ï^ <https://youtu.be/_kqytf31a8E>

My pet rock Gordon just is.

Steve Crook wrote:
> On Sat, 24 Jul 2021 22:49:42 -0600, max schnell wrote in
> Message-Id: <sdiqh4$at3$2@dont-email.me>:
>
>>
>> Well, it still has cert issues "Peer's Certificate has expired.". Too bad.
>> I use it and E-S (always nice to have a backup).
>>
>> minxmin's certificate is from Let's Encrypt and refers to
>> fleegle.mixmin.net if that's of any value. Wonder if I should visit Let's
>> Encrypt and install something from them...
>
> Hi Max,
>
> Please can you try it again now? Getting LetsEncrypt to play nicely
> with INN and nnrpd is a bit of a mission. I've tested it myself and
> it's verifying successfully with:
> openssl s_client -showcerts news.mixmin.net:563

Sorry for the slow response, all is working now. Thanks!