TlsException on Windows

[wismill]

Hi, I tried stack on Windows 7 64 bits and I got the following error: TlsException (HandshakeFailed (Error_Protocol ("certificate has unknown CA",True,UnknownCa))).

To reproduce this:

1. Download the zip file containing stack.exe and unzip it in a directory.
2. Open Powershell and go to the directory containing the previous file.
3. cabal init (assuming cabal is already installed).
4. stack build

Edit 1: I am using minghc 7.10.1 64 bits.

[3noch]

To whom it may concern, the tls package did not work on Windows 64-bit until crypto-random was fixed in version 0.0.9. However, I think stack is built as 32-bit for Windows.

[3noch]

For what it's worth, I'm running Windows 8 64-bit and I'm not getting any errors.

[chrisdone]

I believe I've seen this issue elsewhere for the tls package and windows before. Let me see if I can find it.

[chrisdone]

@snoyberg We had this exception with fpco-api in the past; do you remember anything from that can be helpful here?

[snoyberg]

@wismill Can you follow the TLS debugging instructions at:

https://github.com/vincenthz/hs-tls#common-issues

Also, can you test out from a regular command prompt instead of powershell? I don't think that's important, but it's good to rule out other factors.

[wismill]

I am testing now with Windows 8 64 bits (as admin): same error.
Using the shell cmd.exe does not solve the issue.
I have installed tls-debug but I do not know what host to test. Could you indicate me the complete commands to run?

[snoyberg]

I can't tell without more of the output from your process, can you copy in everything from calling stack till that exception?

[wismill]

I got only this single line as output.

Adding option --verbosity debug gave me this:

2015-06-09 20:40:47.8047871: [debug] Checking for project config at: C:\Users\Administrateur\Downloads\test-stack\stack.yaml @(stack-0.0.1:Stack.Config src/Stack\Config.hs:345:9)
2015-06-09 20:40:47.8047871: [debug] Checking for project config at: C:\Users\Administrateur\Downloads\stack.yaml @(stack-0.0.1:Stack.Config src/Stack\Config.hs:345:9)
2015-06-09 20:40:47.8047871: [debug] Checking for project config at: C:\Users\Administrateur\stack.yaml @(stack-0.0.1:Stack.Config src/Stack\Config.hs:345:9)
2015-06-09 20:40:47.8047871: [debug] Checking for project config at: C:\Users\stack.yaml @(stack-0.0.1:Stack.Config src/Stack\Config.hs:345:9)
2015-06-09 20:40:47.8047871: [debug] Checking for project config at: C:\stack.yaml @(stack-0.0.1:Stack.Config src/Stack\Config.hs:345:9)
2015-06-09 20:40:47.8047871: [debug] No project config file found, using defaults. @(stack-0.0.1:Stack.Config src/Stack\Config.hs:370:13)
TlsException (HandshakeFailed (Error_Protocol ("certificate has unknown CA",True,UnknownCa)))

[snoyberg]

It's probably failing when trying to download the snapshot info, can you try with the URL:

https://www.stackage.org/download/snapshots.json

[wismill]

(Back with Windows 7)
So I tried: tls-retrievecertificate -d https://www.stackage.org/download/snapshots.json -v -c and I got errors about options -d,-v and -c not being recognized.

I tried tls-retrievecertificate https://www.stackage.org/download/snapshots.json and it gave me the help menu of tls-retrievecertificate.

I finally tried tls-simpleclient -d -v https://www.stackage.org/download/snapshots.json and I got the following:

sending query:
GET / HTTP/1.0



tls-simpleclient: getHostByName: does not exist (no such host entry)

I tried these commands at home (win 8) and at work (win 7) with the same result.

[snoyberg]

The arguments are supposed to be the host, not the full URL

tls-simpleclient -d -v <www.myserver.com>

For example, I was able to run:

stack exec -- tls-simpleclient -d -v www.stackage.org 443

Though you'll likely want to leave off the stack exec -- bit.

[wismill]

Ok. So running tls-simpleclient -d -v www.stackage.org 443 I got:

sending query:
GET / HTTP/1.0



debug: >> Handshake [ClientHello TLS12 (ClientRandom "\235\236 .\180\STXn\246\\\163\143|\128\204S\201\155\130\195\170\135\196\161\198qN\175\195\234\DC1\176I") (Session Nothing) [107,103,57,51,56,50,47,53,4,5,10] [0] [(0,"\NUL\DC3\NUL\NUL\DLEwww.stackage.org"),(65281,"\NUL"),(13,"\NUL\f\ACK\SOH\ENQ\SOH\EOT\SOH\ETX\SOH\STX\SOH\STX\STX")] Nothing]
debug: << Handshake [ServerHello TLS12 (ServerRandom "\165B\160fI\191\131\188\188\220\138\SYN\156\239]\SUB%\ETXlX\242\241\&5\180\154\DLE\159\174\v\254\202\164") (Session (Just "g\224\148_?\219*\253\ETBZ\191\198\195_\222#\160\DC3\169\162IW\165\148\209(D\DC2\142\253?\142")) 47 0 [(65281,"\NUL")]]
debug: << Handshake [Certificates (CertificateChain [SignedExact {getSigned = Signed {signedObject = Certificate {certVersion = 2, certSerial = 2066557212085112, certSignatureAlg = SignatureALG HashSHA256 PubKeyALG_RSA, certIssuerDN = DistinguishedName {getDistinguishedElements = [([2,5,4,6],ASN1CharacterString {characterEncoding = Printable, getCharacterStringRawData = "IL"}),([2,5,4,10],ASN1CharacterString {characterEncoding = Printable, getCharacterStringRawData = "StartCom Ltd."}),([2,5,4,11],ASN1CharacterString {characterEncoding = Printable, getCharacterStringRawData = "Secure Digital Certificate Signing"}),([2,5,4,3],ASN1CharacterString {characterEncoding = Printable, getCharacterStringRawData = "StartCom Class 2 Primary Intermediate Server CA"})]}, certValidity = (DateTime {dtDate = Date {dateYear = 2015, dateMonth = May, dateDay = 21}, dtTime = TimeOfDay {todHour = 14h, todMin = 27m, todSec = 39s, todNSec = 0ns}},DateTime {dtDate = Date {dateYear = 2017, dateMonth = May, dateDay = 21}, dtTime = TimeOfDay {todHour = 8h, todMin = 9m, todSec = 16s, todNSec = 0ns}}), certSubjectDN = DistinguishedName {getDistinguishedElements = [([2,5,4,6],ASN1CharacterString {characterEncoding = Printable, getCharacterStringRawData = "US"}),([2,5,4,8],ASN1CharacterString {characterEncoding = Printable, getCharacterStringRawData = "California"}),([2,5,4,7],ASN1CharacterString {characterEncoding = Printable, getCharacterStringRawData = "San Diego"}),([2,5,4,10],ASN1CharacterString {characterEncoding = Printable, getCharacterStringRawData = "FP Complete, Corporation"}),([2,5,4,3],ASN1CharacterString {characterEncoding = T61, getCharacterStringRawData = "*.stackage.org"}),([1,2,840,113549,1,9,1],ASN1CharacterString {characterEncoding = IA5, getCharacterStringRawData = "7919dd9d0359fa12883565991dc1bc19-1899042@contact.gandi.net"})]}, certPubKey = PubKeyRSA (PublicKey {public_size = 256, public_n = 25688638528071928977982672903406319494245264284006971221090434689540622315012014283934423087805977694284530424213657767982546429829831545871767314691050820652741191124619109602519836368558207169846017016167537220724450264458708627661361066070320974028826960899382278313108391070207300230319679222879161907268972805155073891921758843569110538786877773444324629946594216294581755529345874738733873854855528726062782097922405624899881822932038831864888748719309324476339611458318961042506204670957364937285033083703148147997542966639446930524350755656025191426921924223486929091133280218614386522736379240351169321291691, public_e = 65537}), certExtensions = Extensions (Just [ExtensionRaw {extRawOID = [2,5,29,19], extRawCritical = False, extRawASN1 = [Start Sequence,End Sequence]},ExtensionRaw {extRawOID = [2,5,29,15], extRawCritical = False, extRawASN1 = [BitString (BitArray 5 "\168")]},ExtensionRaw {extRawOID = [2,5,29,37], extRawCritical = False, extRawASN1 = [Start Sequence,OID [1,3,6,1,5,5,7,3,2],OID [1,3,6,1,5,5,7,3,1],End Sequence]},ExtensionRaw {extRawOID = [2,5,29,14], extRawCritical = False, extRawASN1 = [OctetString "\135\&3\157\214\FS\135G85\141\230p\187\206\221\174\EM\192:J"]},ExtensionRaw {extRawOID = [2,5,29,35], extRawCritical = False, extRawASN1 = [Start Sequence,Other Context 0 "\DC1\219#E\253T\204jqo\132\138\ETX\215\190\247\SOH/&\134",End Sequence]},ExtensionRaw {extRawOID = [2,5,29,17], extRawCritical = False, extRawASN1 = [Start Sequence,Other Context 2 "*.stackage.org",Other Context 2 "stackage.org",End Sequence]},ExtensionRaw {extRawOID = [2,5,29,32], extRawCritical = False, extRawASN1 = [Start Sequence,Start Sequence,OID [2,23,140,1,2,2],End Sequence,Start Sequence,OID [1,3,6,1,4,1,23223,1,2,3],Start Sequence,Start Sequence,OID [1,3,6,1,5,5,7,2,1],ASN1String (ASN1CharacterString {characterEncoding = IA5, getCharacterStringRawData = "http://www.startssl.com/policy.pdf"}),End Sequence,Start Sequence,OID [1,3,6,1,5,5,7,2,2],Start Sequence,Start Sequence,ASN1String (ASN1CharacterString {characterEncoding = IA5, getCharacterStringRawData = "StartCom Certification Authority"}),Start Sequence,IntVal 1,End Sequence,End Sequence,ASN1String (ASN1CharacterString {characterEncoding = Visible, getCharacterStringRawData = "This certificate was issued according to the Class 2 Validation requirements of the StartCom CA policy, reliance only for the intended purpose in compliance of the relying party obligations."}),End Sequence,End Sequence,End Sequence,End Sequence,End Sequence]},ExtensionRaw {extRawOID = [2,5,29,31], extRawCritical = False, extRawASN1 = [Start Sequence,Start Sequence,Start (Container Context 0),Start (Container Context 0),Other Context 6 "http://crl.startssl.com/crt2-crl.crl",End (Container Context 0),End (Container Context 0),End Sequence,End Sequence]},ExtensionRaw {extRawOID = [1,3,6,1,5,5,7,1,1], extRawCritical = False, extRawASN1 = [Start Sequence,Start Sequence,OID [1,3,6,1,5,5,7,48,1],Other Context 6 "http://ocsp.startssl.com/sub/class2/server/ca",End Sequence,Start Sequence,OID [1,3,6,1,5,5,7,48,2],Other Context 6 "http://aia.startssl.com/certs/sub.class2.server.ca.crt",End Sequence,End Sequence]},ExtensionRaw {extRawOID = [2,5,29,18], extRawCritical = False, extRawASN1 = [Start Sequence,Other Context 6 "http://www.startssl.com/",End Sequence]}])}, signedAlg = SignatureALG HashSHA256 PubKeyALG_RSA, signedSignature = "Ig\148|\154[\ETB\230\149\214Ba\238\FSGt\223m\146G}\253\&9\139E{uO\208\184\133\233\241\244Ng\246\RS\174\211\EM\132\196\231~\DC3m\145}\ENQU@\DLE\227,\190\247#\245TL\242\163\SYN\210\144\234\137\b?22\b\220\209)t\181\134\r\195\179\STX\203\&07Li\ETB6P\147\250J-\249\206\158\194\DC2j\RS\155\173O#\203T\t\225R\201\ACK)\212\&9\GS\SUB\165\215\NAK\135\201\156\NUL\186\133^\239\225\186\196\&5\134vd\232J\168%\175\217C\r\161\223\163\151\161&\182/\US\229\219K\245\223\RS\149Q\183p\250=\133%-\150\232C\193J\162\a!n\ETX\EOT}7\167^\213E7\171\222}\215\141\STX\SOH\186\DLEIZF\ACK\157\167\227 \168T\r\DC3\200@n\145\216x\208\158\CAN\DC3ZS\251\184\NUL\EM3\156\162\166 Q\145\220%\am\218\201&\225\206ipA\SIz1\201\180t\216\187L\183\229\211n\157"}, exactObjectRaw = "0\130\ENQ\161\160\ETX\STX\SOH\STX\STX\a\aW\133\216\136\203x0\r\ACK\t*\134H\134\247\r\SOH\SOH\v\ENQ\NUL0\129\140\&1\v0\t\ACK\ETXU\EOT\ACK\DC3\STXIL1\SYN0\DC4\ACK\ETXU\EOT\n\DC3\rStartCom Ltd.1+0)\ACK\ETXU\EOT\v\DC3\"Secure Digital Certificate Signing1806\ACK\ETXU\EOT\ETX\DC3/StartCom Class 2 Primary Intermediate Server CA0\RS\ETB\r150521142739Z\ETB\r170521080916Z0\129\189\&1\v0\t\ACK\ETXU\EOT\ACK\DC3\STXUS1\DC30\DC1\ACK\ETXU\EOT\b\DC3\nCalifornia1\DC20\DLE\ACK\ETXU\EOT\a\DC3\tSan Diego1!0\US\ACK\ETXU\EOT\n\DC3\CANFP Complete, Corporation1\ETB0\NAK\ACK\ETXU\EOT\ETX\DC4\SO*.stackage.org1I0G\ACK\t*\134H\134\247\r\SOH\t\SOH\SYN:7919dd9d0359fa12883565991dc1bc19-1899042@contact.gandi.net0\130\SOH\"0\r\ACK\t*\134H\134\247\r\SOH\SOH\SOH\ENQ\NUL\ETX\130\SOH\SI\NUL0\130\SOH\n\STX\130\SOH\SOH\NUL\203~CU\215\160\173\225\220\189\135\SOH\161\163\ETX&\157U\SUB\195\130k\241*\248\SI\166A\ACK\179\214\205e};Y\185\231\192U\DC2p\222\238\181\205T\255\251*\217?\200\234\218\184\182\171]\253\218\252\141\150\254\190\165\172_cH\195\213\t\232\218\195\&4_D\215\188{\129\223\FS\SYN\211(/\208\156\195\241vO\ETBY\235\222h9\149w\239\205\195\142.N\172\187\214i\202,\249\&4\242*\244\STX&_x\DEL\132d\ESC]\158\144~\169\200?\242\236z\132\226\SI\218\230&\209\163\214]F\249\150q\234\187o\163\RS7\187\139\&4\215T\144\ETX\203\157\224I\209\&5\SUB\236\251D\175\249\r\166\223VZ\171\168\&1\244F\198\NUL(8)\b$\166\220y\198\r\ETX:G}:\"B\134\DC2\163\129\&3\EM\254_`\DC2\152/\138 \183p \v\212\192D\138'\154\165\163*\237\144\137Z\218\134#\203WI[}\174\rd\245\239\175\235\202\207\171\STX\ETX\SOH\NUL\SOH\163\130\STX\235\&0\130\STX\231\&0\t\ACK\ETXU\GS\DC3\EOT\STX0\NUL0\v\ACK\ETXU\GS\SI\EOT\EOT\ETX\STX\ETX\168\&0\GS\ACK\ETXU\GS%\EOT\SYN0\DC4\ACK\b+\ACK\SOH\ENQ\ENQ\a\ETX\STX\ACK\b+\ACK\SOH\ENQ\ENQ\a\ETX\SOH0\GS\ACK\ETXU\GS\SO\EOT\SYN\EOT\DC4\135\&3\157\214\FS\135G85\141\230p\187\206\221\174\EM\192:J0\US\ACK\ETXU\GS#\EOT\CAN0\SYN\128\DC4\DC1\219#E\253T\204jqo\132\138\ETX\215\190\247\SOH/&\134\&0'\ACK\ETXU\GS\DC1\EOT 0\RS\130\SO*.stackage.org\130\fstackage.org0\130\SOHV\ACK\ETXU\GS \EOT\130\SOHM0\130\SOHI0\b\ACK\ACKg\129\f\SOH\STX\STX0\130\SOH;\ACK\v+\ACK\SOH\EOT\SOH\129\181\&7\SOH\STX\ETX0\130\SOH*0.\ACK\b+\ACK\SOH\ENQ\ENQ\a\STX\SOH\SYN\"http://www.startssl.com/policy.pdf0\129\247\ACK\b+\ACK\SOH\ENQ\ENQ\a\STX\STX0\129\234\&0'\SYN StartCom Certification Authority0\ETX\STX\SOH\SOH\SUB\129\190This certificate was issued according to the Class 2 Validation requirements of the StartCom CA policy, reliance only for the intended purpose in compliance of the relying party obligations.05\ACK\ETXU\GS\US\EOT.0,0*\160(\160&\134$http://crl.startssl.com/crt2-crl.crl0\129\142\ACK\b+\ACK\SOH\ENQ\ENQ\a\SOH\SOH\EOT\129\129\&0\DEL09\ACK\b+\ACK\SOH\ENQ\ENQ\a0\SOH\134-http://ocsp.startssl.com/sub/class2/server/ca0B\ACK\b+\ACK\SOH\ENQ\ENQ\a0\STX\134\&6http://aia.startssl.com/certs/sub.class2.server.ca.crt0#\ACK\ETXU\GS\DC2\EOT\FS0\SUB\134\CANhttp://www.startssl.com/", encodeSignedObject = "0\130\ACK\185\&0\130\ENQ\161\160\ETX\STX\SOH\STX\STX\a\aW\133\216\136\203x0\r\ACK\t*\134H\134\247\r\SOH\SOH\v\ENQ\NUL0\129\140\&1\v0\t\ACK\ETXU\EOT\ACK\DC3\STXIL1\SYN0\DC4\ACK\ETXU\EOT\n\DC3\rStartCom Ltd.1+0)\ACK\ETXU\EOT\v\DC3\"Secure Digital Certificate Signing1806\ACK\ETXU\EOT\ETX\DC3/StartCom Class 2 Primary Intermediate Server CA0\RS\ETB\r150521142739Z\ETB\r170521080916Z0\129\189\&1\v0\t\ACK\ETXU\EOT\ACK\DC3\STXUS1\DC30\DC1\ACK\ETXU\EOT\b\DC3\nCalifornia1\DC20\DLE\ACK\ETXU\EOT\a\DC3\tSan Diego1!0\US\ACK\ETXU\EOT\n\DC3\CANFP Complete, Corporation1\ETB0\NAK\ACK\ETXU\EOT\ETX\DC4\SO*.stackage.org1I0G\ACK\t*\134H\134\247\r\SOH\t\SOH\SYN:7919dd9d0359fa12883565991dc1bc19-1899042@contact.gandi.net0\130\SOH\"0\r\ACK\t*\134H\134\247\r\SOH\SOH\SOH\ENQ\NUL\ETX\130\SOH\SI\NUL0\130\SOH\n\STX\130\SOH\SOH\NUL\203~CU\215\160\173\225\220\189\135\SOH\161\163\ETX&\157U\SUB\195\130k\241*\248\SI\166A\ACK\179\214\205e};Y\185\231\192U\DC2p\222\238\181\205T\255\251*\217?\200\234\218\184\182\171]\253\218\252\141\150\254\190\165\172_cH\195\213\t\232\218\195\&4_D\215\188{\129\223\FS\SYN\211(/\208\156\195\241vO\ETBY\235\222h9\149w\239\205\195\142.N\172\187\214i\202,\249\&4\242*\244\STX&_x\DEL\132d\ESC]\158\144~\169\200?\242\236z\132\226\SI\218\230&\209\163\214]F\249\150q\234\187o\163\RS7\187\139\&4\215T\144\ETX\203\157\224I\209\&5\SUB\236\251D\175\249\r\166\223VZ\171\168\&1\244F\198\NUL(8)\b$\166\220y\198\r\ETX:G}:\"B\134\DC2\163\129\&3\EM\254_`\DC2\152/\138 \183p \v\212\192D\138'\154\165\163*\237\144\137Z\218\134#\203WI[}\174\rd\245\239\175\235\202\207\171\STX\ETX\SOH\NUL\SOH\163\130\STX\235\&0\130\STX\231\&0\t\ACK\ETXU\GS\DC3\EOT\STX0\NUL0\v\ACK\ETXU\GS\SI\EOT\EOT\ETX\STX\ETX\168\&0\GS\ACK\ETXU\GS%\EOT\SYN0\DC4\ACK\b+\ACK\SOH\ENQ\ENQ\a\ETX\STX\ACK\b+\ACK\SOH\ENQ\ENQ\a\ETX\SOH0\GS\ACK\ETXU\GS\SO\EOT\SYN\EOT\DC4\135\&3\157\214\FS\135G85\141\230p\187\206\221\174\EM\192:J0\US\ACK\ETXU\GS#\EOT\CAN0\SYN\128\DC4\DC1\219#E\253T\204jqo\132\138\ETX\215\190\247\SOH/&\134\&0'\ACK\ETXU\GS\DC1\EOT 0\RS\130\SO*.stackage.org\130\fstackage.org0\130\SOHV\ACK\ETXU\GS \EOT\130\SOHM0\130\SOHI0\b\ACK\ACKg\129\f\SOH\STX\STX0\130\SOH;\ACK\v+\ACK\SOH\EOT\SOH\129\181\&7\SOH\STX\ETX0\130\SOH*0.\ACK\b+\ACK\SOH\ENQ\ENQ\a\STX\SOH\SYN\"http://www.startssl.com/policy.pdf0\129\247\ACK\b+\ACK\SOH\ENQ\ENQ\a\STX\STX0\129\234\&0'\SYN StartCom Certification Authority0\ETX\STX\SOH\SOH\SUB\129\190This certificate was issued according to the Class 2 Validation requirements of the StartCom CA policy, reliance only for the intended purpose in compliance of the relying party obligations.05\ACK\ETXU\GS\US\EOT.0,0*\160(\160&\134$http://crl.startssl.com/crt2-crl.crl0\129\142\ACK\b+\ACK\SOH\ENQ\ENQ\a\SOH\SOH\EOT\129\129\&0\DEL09\ACK\b+\ACK\SOH\ENQ\ENQ\a0\SOH\134-http://ocsp.startssl.com/sub/class2/server/ca0B\ACK\b+\ACK\SOH\ENQ\ENQ\a0\STX\134\&6http://aia.startssl.com/certs/sub.class2.server.ca.crt0#\ACK\ETXU\GS\DC2\EOT\FS0\SUB\134\CANhttp://www.startssl.com/0\r\ACK\t*\134H\134\247\r\SOH\SOH\v\ENQ\NUL\ETX\130\SOH\SOH\NULIg\148|\154[\ETB\230\149\214Ba\238\FSGt\223m\146G}\253\&9\139E{uO\208\184\133\233\241\244Ng\246\RS\174\211\EM\132\196\231~\DC3m\145}\ENQU@\DLE\227,\190\247#\245TL\242\163\SYN\210\144\234\137\b?22\b\220\209)t\181\134\r\195\179\STX\203\&07Li\ETB6P\147\250J-\249\206\158\194\DC2j\RS\155\173O#\203T\t\225R\201\ACK)\212\&9\GS\SUB\165\215\NAK\135\201\156\NUL\186\133^\239\225\186\196\&5\134vd\232J\168%\175\217C\r\161\223\163\151\161&\182/\US\229\219K\245\223\RS\149Q\183p\250=\133%-\150\232C\193J\162\a!n\ETX\EOT}7\167^\213E7\171\222}\215\141\STX\SOH\186\DLEIZF\ACK\157\167\227 \168T\r\DC3\200@n\145\216x\208\158\CAN\DC3ZS\251\184\NUL\EM3\156\162\166 Q\145\220%\am\218\201&\225\206ipA\SIz1\201\180t\216\187L\183\229\211n\157"},SignedExact {getSigned = Signed {signedObject = Certificate {certVersion = 2, certSerial = 8069548958653521, certSignatureAlg = SignatureALG HashSHA256 PubKeyALG_RSA, certIssuerDN = DistinguishedName {getDistinguishedElements = [([2,5,4,6],ASN1CharacterString {characterEncoding = Printable, getCharacterStringRawData = "IL"}),([2,5,4,10],ASN1CharacterString {characterEncoding = Printable, getCharacterStringRawData = "StartCom Ltd."}),([2,5,4,11],ASN1CharacterString {characterEncoding = Printable, getCharacterStringRawData = "Secure Digital Certificate Signing"}),([2,5,4,3],ASN1CharacterString {characterEncoding = Printable, getCharacterStringRawData = "StartCom Certification Authority"})]}, certValidity = (DateTime {dtDate = Date {dateYear = 2007, dateMonth = October, dateDay = 14}, dtTime = TimeOfDay {todHour = 20h, todMin = 57m, todSec = 9s, todNSec = 0ns}},DateTime {dtDate = Date {dateYear = 2022, dateMonth = October, dateDay = 14}, dtTime = TimeOfDay {todHour = 20h, todMin = 57m, todSec = 9s, todNSec = 0ns}}), certSubjectDN = DistinguishedName {getDistinguishedElements = [([2,5,4,6],ASN1CharacterString {characterEncoding = Printable, getCharacterStringRawData = "IL"}),([2,5,4,10],ASN1CharacterString {characterEncoding = Printable, getCharacterStringRawData = "StartCom Ltd."}),([2,5,4,11],ASN1CharacterString {characterEncoding = Printable, getCharacterStringRawData = "Secure Digital Certificate Signing"}),([2,5,4,3],ASN1CharacterString {characterEncoding = Printable, getCharacterStringRawData = "StartCom Class 2 Primary Intermediate Server CA"})]}, certPubKey = PubKeyRSA (PublicKey {public_size = 256, public_n = 28568923428535968968429075512499593566472247050071932853221512591874174172278465357969842479113669390079229530932008587837181722479707763363460430580799413265494883960468634704299550454601425102745460150628874040908717206127137268397831020021644555320877773536856171967252874808246249013804799236990164954539560495786776421486687777584807321151201285134839276593695071279286184208425624708561326040063866202937932130960566677161937657587326385095440079552740072820745841130046981356121311512767951113910892706590619313483396585017782590638733330087065686818293632801765779074685467445294329066570886735478932395181059, public_e = 65537}), certExtensions = Extensions (Just [ExtensionRaw {extRawOID = [2,5,29,19], extRawCritical = True, extRawASN1 = [Start Sequence,Boolean True,IntVal 0,End Sequence]},ExtensionRaw {extRawOID = [2,5,29,15], extRawCritical = True, extRawASN1 = [BitString (BitArray 7 "\ACK")]},ExtensionRaw {extRawOID = [2,5,29,14], extRawCritical = False, extRawASN1 = [OctetString "\DC1\219#E\253T\204jqo\132\138\ETX\215\190\247\SOH/&\134"]},ExtensionRaw {extRawOID = [2,5,29,35], extRawCritical = False, extRawASN1 = [Start Sequence,Other Context 0 "N\v\239\SUB\164@[\165\ETBi\135\&0\202\&4hC\208A\174\242",End Sequence]},ExtensionRaw {extRawOID = [1,3,6,1,5,5,7,1,1], extRawCritical = False, extRawASN1 = [Start Sequence,Start Sequence,OID [1,3,6,1,5,5,7,48,1],Other Context 6 "http://ocsp.startssl.com/ca",End Sequence,Start Sequence,OID [1,3,6,1,5,5,7,48,2],Other Context 6 "http://aia.startssl.com/certs/ca.crt",End Sequence,End Sequence]},ExtensionRaw {extRawOID = [2,5,29,31], extRawCritical = False, extRawASN1 = [Start Sequence,Start Sequence,Start (Container Context 0),Start (Container Context 0),Other Context 6 "http://crl.startssl.com/sfsca.crl",End (Container Context 0),End (Container Context 0),End Sequence,End Sequence]},ExtensionRaw {extRawOID = [2,5,29,32], extRawCritical = False, extRawASN1 = [Start Sequence,Start Sequence,OID [2,5,29,32,0],Start Sequence,Start Sequence,OID [1,3,6,1,5,5,7,2,1],ASN1String (ASN1CharacterString {characterEncoding = IA5, getCharacterStringRawData = "http://www.startssl.com/policy.pdf"}),End Sequence,End Sequence,End Sequence,End Sequence]}])}, signedAlg = SignatureALG HashSHA256 PubKeyALG_RSA, signedSignature = "R\201\189\243\189\203\249\235\162\196\&2\202\134r\252\207\191\167\&0\181\253\145\247\213\129\225!\EOT\173\NULL\255\233\139'\218\255\242$\205\252\US\SI\DEL\210\209\229\129\146#x\SYN\238k\ETX.\157\NULHO\174\130e.\135o\238j\a_KVn\247\150FA\230\221\254E\185b*\154\138v\233\173\189\214s\179\188\&1+\208,\213lk\188j:%\135\169\168\165\r\215\133\241ll\ENQ\SO\244\193h\203\187*\129X\165>\153\196\159\247\US\132\142\160z\209M\219\184\SOH\156\r\129\&4\202\130\254#bM?m\164R\192L^\242iH\177\242\223\172Ddi\176F)\199\173\240\242\192\157h#\138\168gq\"\ETB\190\206\137zv\190Tl\147\\\139\240\SUBn\174\237\142\174\194\ENQ\174\DC3W\230\185\231p\200\&3\184\158\253J0\227\152\212\DC3k\238N\185\230\236\223\206\234\160\158vj\151\170\234\223\&4EB\245\218M\214\135vm\255\206i\134z\129_\219\178O\206\176\224g`9D\176E\DLE\133e\151\DC2y\223\212\151\216x!\f\132\152\206\187Ok\SI\EM\218\133i\145Al\ETB\FS\198\185\246\DC4\174\242\161\128z\226\233\149\239\"\138\204\255\&8\219\252!V\236\128\253m\162\133\145)\ETX\234\171\ETX\189,`D\130\NUL5\231\DC4lv;@\131U\213\\\223\199(\163Y\213\137x>\SI\224\ACK\253\213W\138$\FS\167b8\GS\133\147K\249\147\DEL\243D\250c\152\158\237&\137\157\246\254\248Cl%\255\a\249\DC2<\158\DC1\176\211\128\238\236\171;\f\164r\ETX\146\DC46\233\190\230\138:\145\139\173\f\ACK\168\179\131\130o\169\245\&69\130#\f\142\234\253\\~\211K\\3\211gH\207N\238\203cpagU\235\187\220\156\vzC\DC4HI\170yE\182\143\190,\144g\FS\248\156V\146\149\&00\RS\131\218[\\\174U-u\182k\DC18\201QD\219\219h\fHS\133:\237\134\153K"}, exactObjectRaw = "0\130\ETX\193\160\ETX\STX\SOH\STX\STX\a\FS\171\&6G-\156Q0\r\ACK\t*\134H\134\247\r\SOH\SOH\v\ENQ\NUL0}1\v0\t\ACK\ETXU\EOT\ACK\DC3\STXIL1\SYN0\DC4\ACK\ETXU\EOT\n\DC3\rStartCom Ltd.1+0)\ACK\ETXU\EOT\v\DC3\"Secure Digital Certificate Signing1)0'\ACK\ETXU\EOT\ETX\DC3 StartCom Certification Authority0\RS\ETB\r071014205709Z\ETB\r221014205709Z0\129\140\&1\v0\t\ACK\ETXU\EOT\ACK\DC3\STXIL1\SYN0\DC4\ACK\ETXU\EOT\n\DC3\rStartCom Ltd.1+0)\ACK\ETXU\EOT\v\DC3\"Secure Digital Certificate Signing1806\ACK\ETXU\EOT\ETX\DC3/StartCom Class 2 Primary Intermediate Server CA0\130\SOH\"0\r\ACK\t*\134H\134\247\r\SOH\SOH\SOH\ENQ\NUL\ETX\130\SOH\SI\NUL0\130\SOH\n\STX\130\SOH\SOH\NUL\226O9/\161\140\154\133\173\b\SO\b>W\242\136\SOH!\ESC\148\169l\226\184\219\170\EM\CANF:R\161\245\SI\244n\140\234\150\140\150\135y\DC3@Q/\"\242\f\139\135\SIe\223qt4CU\177\&5\t\155\217\188\US\250\235B\208\151@r\183C\150=\186\150\157]P\STX\FS\155\145\141\156\192\172\215\187/\ETB\215\203>\130\157s\235\aB\146\178\205d\179tU\ESC\180K\134!,\247x\135\&2\224\SYN\228\218\189L\149\234\164\n~\182\n\r.\138\207U\171\195\229\221A\138N\230oel\178@\207\ETB]\185\195j\v'\DC1\132wa\246\194|\237\192\141x\DC4\CAN\153\129\153uc\183\232S\211\186a\233\SO\250\162\&0\243F\162\185\201\USl\128Z@\172'\237HG3\176T\198F\SUB\243\&5a\193\STX)\144T~dM\196\&0R\STX\130\215\223\206!n\CAN\145\215\184\171\140'\ETB\181\240\163\SOH/\142\210.\135:=\180)g\138\196\ETX\STX\ETX\SOH\NUL\SOH\163\130\SOHL0\130\SOHH0\DC2\ACK\ETXU\GS\DC3\SOH\SOH\255\EOT\b0\ACK\SOH\SOH\255\STX\SOH\NUL0\SO\ACK\ETXU\GS\SI\SOH\SOH\255\EOT\EOT\ETX\STX\SOH\ACK0\GS\ACK\ETXU\GS\SO\EOT\SYN\EOT\DC4\DC1\219#E\253T\204jqo\132\138\ETX\215\190\247\SOH/&\134\&0\US\ACK\ETXU\GS#\EOT\CAN0\SYN\128\DC4N\v\239\SUB\164@[\165\ETBi\135\&0\202\&4hC\208A\174\242\&0i\ACK\b+\ACK\SOH\ENQ\ENQ\a\SOH\SOH\EOT]0[0'\ACK\b+\ACK\SOH\ENQ\ENQ\a0\SOH\134\ESChttp://ocsp.startssl.com/ca00\ACK\b+\ACK\SOH\ENQ\ENQ\a0\STX\134$http://aia.startssl.com/certs/ca.crt02\ACK\ETXU\GS\US\EOT+0)0'\160%\160#\134!http://crl.startssl.com/sfsca.crl0C\ACK\ETXU\GS \EOT<0:08\ACK\EOTU\GS \NUL000.\ACK\b+\ACK\SOH\ENQ\ENQ\a\STX\SOH\SYN\"http://www.startssl.com/policy.pdf", encodeSignedObject = "0\130\ENQ\217\&0\130\ETX\193\160\ETX\STX\SOH\STX\STX\a\FS\171\&6G-\156Q0\r\ACK\t*\134H\134\247\r\SOH\SOH\v\ENQ\NUL0}1\v0\t\ACK\ETXU\EOT\ACK\DC3\STXIL1\SYN0\DC4\ACK\ETXU\EOT\n\DC3\rStartCom Ltd.1+0)\ACK\ETXU\EOT\v\DC3\"Secure Digital Certificate Signing1)0'\ACK\ETXU\EOT\ETX\DC3 StartCom Certification Authority0\RS\ETB\r071014205709Z\ETB\r221014205709Z0\129\140\&1\v0\t\ACK\ETXU\EOT\ACK\DC3\STXIL1\SYN0\DC4\ACK\ETXU\EOT\n\DC3\rStartCom Ltd.1+0)\ACK\ETXU\EOT\v\DC3\"Secure Digital Certificate Signing1806\ACK\ETXU\EOT\ETX\DC3/StartCom Class 2 Primary Intermediate Server CA0\130\SOH\"0\r\ACK\t*\134H\134\247\r\SOH\SOH\SOH\ENQ\NUL\ETX\130\SOH\SI\NUL0\130\SOH\n\STX\130\SOH\SOH\NUL\226O9/\161\140\154\133\173\b\SO\b>W\242\136\SOH!\ESC\148\169l\226\184\219\170\EM\CANF:R\161\245\SI\244n\140\234\150\140\150\135y\DC3@Q/\"\242\f\139\135\SIe\223qt4CU\177\&5\t\155\217\188\US\250\235B\208\151@r\183C\150=\186\150\157]P\STX\FS\155\145\141\156\192\172\215\187/\ETB\215\203>\130\157s\235\aB\146\178\205d\179tU\ESC\180K\134!,\247x\135\&2\224\SYN\228\218\189L\149\234\164\n~\182\n\r.\138\207U\171\195\229\221A\138N\230oel\178@\207\ETB]\185\195j\v'\DC1\132wa\246\194|\237\192\141x\DC4\CAN\153\129\153uc\183\232S\211\186a\233\SO\250\162\&0\243F\162\185\201\USl\128Z@\172'\237HG3\176T\198F\SUB\243\&5a\193\STX)\144T~dM\196\&0R\STX\130\215\223\206!n\CAN\145\215\184\171\140'\ETB\181\240\163\SOH/\142\210.\135:=\180)g\138\196\ETX\STX\ETX\SOH\NUL\SOH\163\130\SOHL0\130\SOHH0\DC2\ACK\ETXU\GS\DC3\SOH\SOH\255\EOT\b0\ACK\SOH\SOH\255\STX\SOH\NUL0\SO\ACK\ETXU\GS\SI\SOH\SOH\255\EOT\EOT\ETX\STX\SOH\ACK0\GS\ACK\ETXU\GS\SO\EOT\SYN\EOT\DC4\DC1\219#E\253T\204jqo\132\138\ETX\215\190\247\SOH/&\134\&0\US\ACK\ETXU\GS#\EOT\CAN0\SYN\128\DC4N\v\239\SUB\164@[\165\ETBi\135\&0\202\&4hC\208A\174\242\&0i\ACK\b+\ACK\SOH\ENQ\ENQ\a\SOH\SOH\EOT]0[0'\ACK\b+\ACK\SOH\ENQ\ENQ\a0\SOH\134\ESChttp://ocsp.startssl.com/ca00\ACK\b+\ACK\SOH\ENQ\ENQ\a0\STX\134$http://aia.startssl.com/certs/ca.crt02\ACK\ETXU\GS\US\EOT+0)0'\160%\160#\134!http://crl.startssl.com/sfsca.crl0C\ACK\ETXU\GS \EOT<0:08\ACK\EOTU\GS \NUL000.\ACK\b+\ACK\SOH\ENQ\ENQ\a\STX\SOH\SYN\"http://www.startssl.com/policy.pdf0\r\ACK\t*\134H\134\247\r\SOH\SOH\v\ENQ\NUL\ETX\130\STX\SOH\NULR\201\189\243\189\203\249\235\162\196\&2\202\134r\252\207\191\167\&0\181\253\145\247\213\129\225!\EOT\173\NULL\255\233\139'\218\255\242$\205\252\US\SI\DEL\210\209\229\129\146#x\SYN\238k\ETX.\157\NULHO\174\130e.\135o\238j\a_KVn\247\150FA\230\221\254E\185b*\154\138v\233\173\189\214s\179\188\&1+\208,\213lk\188j:%\135\169\168\165\r\215\133\241ll\ENQ\SO\244\193h\203\187*\129X\165>\153\196\159\247\US\132\142\160z\209M\219\184\SOH\156\r\129\&4\202\130\254#bM?m\164R\192L^\242iH\177\242\223\172Ddi\176F)\199\173\240\242\192\157h#\138\168gq\"\ETB\190\206\137zv\190Tl\147\\\139\240\SUBn\174\237\142\174\194\ENQ\174\DC3W\230\185\231p\200\&3\184\158\253J0\227\152\212\DC3k\238N\185\230\236\223\206\234\160\158vj\151\170\234\223\&4EB\245\218M\214\135vm\255\206i\134z\129_\219\178O\206\176\224g`9D\176E\DLE\133e\151\DC2y\223\212\151\216x!\f\132\152\206\187Ok\SI\EM\218\133i\145Al\ETB\FS\198\185\246\DC4\174\242\161\128z\226\233\149\239\"\138\204\255\&8\219\252!V\236\128\253m\162\133\145)\ETX\234\171\ETX\189,`D\130\NUL5\231\DC4lv;@\131U\213\\\223\199(\163Y\213\137x>\SI\224\ACK\253\213W\138$\FS\167b8\GS\133\147K\249\147\DEL\243D\250c\152\158\237&\137\157\246\254\248Cl%\255\a\249\DC2<\158\DC1\176\211\128\238\236\171;\f\164r\ETX\146\DC46\233\190\230\138:\145\139\173\f\ACK\168\179\131\130o\169\245\&69\130#\f\142\234\253\\~\211K\\3\211gH\207N\238\203cpagU\235\187\220\156\vzC\DC4HI\170yE\182\143\190,\144g\FS\248\156V\146\149\&00\RS\131\218[\\\174U-u\182k\DC18\201QD\219\219h\fHS\133:\237\134\153K"}])]
debug: >> Alert [(AlertLevel_Fatal,UnknownCa)]
tls-simpleclient : tls-simpleclient.exe: HandshakeFailed (Error_Protocol ("certificate has unknown CA",True,UnknownCa))

Running tls-retrievecertificate www.stackage.org 443 --verify I got:

connecting to www.stackage.org on port 443 ...
serial:   2066557212085112
issuer:   DistinguishedName {getDistinguishedElements = [([2,5,4,6],ASN1CharacterString {characterEncoding = Printable, getCharacterStringRawData = "IL"}),([2,5,4,10],ASN1CharacterString {characterEncoding = Printable, getCharacterStringRawData = "StartCom Ltd."}),([2,5,4,11],ASN1CharacterString {characterEncoding = Printable, getCharacterStringRawData = "Secure Digital Certificate Signing"}),([2,5,4,3],ASN1CharacterString {characterEncoding = Printable, getCharacterStringRawData = "StartCom Class 2 Primary Intermediate Server CA"})]}
subject:  DistinguishedName {getDistinguishedElements = [([2,5,4,6],ASN1CharacterString {characterEncoding = Printable, getCharacterStringRawData = "US"}),([2,5,4,8],ASN1CharacterString {characterEncoding = Printable, getCharacterStringRawData = "California"}),([2,5,4,7],ASN1CharacterString {characterEncoding = Printable, getCharacterStringRawData = "San Diego"}),([2,5,4,10],ASN1CharacterString {characterEncoding = Printable, getCharacterStringRawData = "FP Complete, Corporation"}),([2,5,4,3],ASN1CharacterString {characterEncoding = T61, getCharacterStringRawData = "*.stackage.org"}),([1,2,840,113549,1,9,1],ASN1CharacterString {characterEncoding = IA5, getCharacterStringRawData = "7919dd9d0359fa12883565991dc1bc19-1899042@contact.gandi.net"})]}
validity: DateTime {dtDate = Date {dateYear = 2015, dateMonth = May, dateDay = 21}, dtTime = TimeOfDay {todHour = 14h, todMin = 27m, todSec = 39s, todNSec = 0ns}} to DateTime {dtDate = Date {dateYear = 2017, dateMonth = May, dateDay = 21}, dtTime = TimeOfDay {todHour = 8h, todMin = 9m, todSec = 16s, todNSec = 0ns}}
### certificate chain trust
fail validation:
[UnknownCA]

I have to say, being new to Haskell I find the language really promising but the tooling lacks professional quality.

[3noch]

@wismill Thanks to folks like you who work with us on these issues, we aim to change that sentiment soon!

[3noch]

@wismill In Haskell's defense, Windows is its toughest spot.

[snoyberg]

@vincenthz Any thoughts on the error message above?

@wismill This may be a legitimate failure on the tls packages part. It's possible that your system isn't recognizing the SSL certificate used by stackage.org for some reason.

[wismill]

Thanks to @snoyberg's comment:

It's possible that your system isn't recognizing the SSL certificate used by stackage.org for some reason.

I have investigate a bit the question. The "lock" icon confirm the SSL certificate works in Firefox for https://www.stackage.org.

But, hey, it's Windows: I have some intuition Internet Explorer should not left apart. I was right: certificate recognized and now the previous commands work: stack build, tls-simpleclient, tls-retrievecertificate!

This is a trail, but it does not solve the issue if one want stack to be a turnkey product.

@3noch : I know Windows has a lot of drawbacks, but being imposed at my work, I do not have much choice. Please keep working on this platform: the recent survey on the Haskellers shows it is important! And I think the ARM architecture too. But this is another story.

[snoyberg]

We're kind of caught in a pickle on this one. We can turn off certificate checking and avoid this problem, but that will make stack very insecure. We don't want to go down that route (a problem which plagues other tools in the ecosystem). Also, this doesn't seem to be a universal problem, as many Windows users have no problem here.

One possible mitigation here would be: default the specific call that failed (downloading the most recent snapshots) to non-SSL, or have it fall back to non-SSL, given that an attacker can't compromise the system by telling you something invalid here (you'll still be downloading the snapshots themselves over a secure connection). Another option is to move the snapshots.json off of stackage.org and put it on Github or S3, or to try and use a more universally supported CA (though I haven't really had any other problems).

Any thoughts on these ideas?

And again, thank you @wismill for working through this with us.

[vincenthz]

tls uses the certificate CAs that are installed on the machine. On windows the pre-populated CA is bare, compared to the CAs on unix or OSX. That causes the "problem" above, which basically say: "the certificate received from this server has been signed by this authority A, but my system is not trusting this authority A in the first place"

There's couple of solution:

• certificate pinning: A user of a specific service can encode a fingerprint list of certificate it's allowed to talk to. this allow to circumvent the need for CA in the first place (and it's more secure if you don't trust CAs), but when your certificate is renewed, the fingerprint need to be updated in the binary/source/config file.
• have tls (or some user of tls) come down with its own CA list (this is what chrome and firefox routinely do). It's not obvious where to store things and such, nor how to update this list.

Obviously I would advise against disabling security, that's just a bad idea compare to a simple pinning mechanism and through a little config file, this let the users with no/bad CAs have a somewhat secure transport.

[wismill]

I think disabling security is not a conceivable option. At least not without imposing explicit command line option.

The developers of Pip, the package manager of Python, seem to have the same issue and it seems solved in the Python's standard library or with a dedicated package. Could it help?

[wismill]

These links may be useful too:

• http://serverfault.com/questions/620013/importing-a-certificate-and-granting-permissions-on-windows-server-2012-r2
• https://technet.microsoft.com/library/cc732443.aspx

[3noch]

@wismill I'm in the same boat you are: Windows. So all we can do is plug away at these issues and hope for a brighter tomorrow. Thanks for your help.

[snoyberg]

I've pushed a commit to hopefully make the error message far more helpful in this situation. @wismill if you are still able to reproduce the original problem, would you be able to take a try with the newest master?

[wismill]

@snoyberg I would like to try your commit: I have cloned this repo, created a cabal sandbox and tried to install the dependencies. But I am facing this issue: haskell/cabal#2502. You see what I mean about insufficient tooling support, especially on Windows :-| And Cabal is a serious one (currently 582 issues!).

I think I will just wait now the next version of minGHC with the new GHC 7.10.2, hopping it includes also the patch for cabal. All these issues at the same time, it is just too frustrating. But I will continue the testing soon, and ghci is all I need now to learn Haskell.

[snoyberg]

I'm planning on cutting another beta release this Sunday, which will include another Windows executable. That may be an easier way to get this tested.

Thanks again for the perseverance!

[3noch]

@wismill GHC 7.10 is brand spanking new. If you were using GHC 7.8.4 you would get a very different feel.

[snoyberg]

There's a new build of stack (0.0.2) that has the changes I mentioned above in place. @wismill can you give it a shot?

[snoyberg]

I'm going to close this. If errors like this still occur with new versions, please reopen.

[wismill]

It is working fine now.

[borsboom]

Not sure if it's relevant, but I'm experiencing this on Windows 10 preview 64-bit with the stack-0.0.3 binary. This is on a fresh install.

C:\Users\emanu>stack install cabal-install
TlsException (HandshakeFailed (Error_Protocol ("certificate has unknown CA",True,UnknownCa)))

[snoyberg]

I'll open up a new issue about this, so that the stackage cron job generates a JSON file and puts it on S3 somewhere. I'm presuming the S3 downloads don't have certificate issues?

[NCrashed]

Hit the bug on fresh Windows 7 x86 installed to VirtualBox.

$ stack --version
Version 0.1.2.0, Git revision 65246552936b7da4b64b38372feac903d96a8911

$ stack test
Downloading nightly-2015-07-24 build plan ...TlsException (HandshakeFailed (Erro
r_Protocol ("certificate has unknown CA",True,UnknownCa)))

[NCrashed]

Installation of all Windows updates fixed the problem.

[3noch]

@NCrashed Great info. Thanks. @snoyberg What do you think of making that error message a little less frightening?

TlsException (HandshakeFailed (Error_Protocol ("certificate has unknown CA",True,UnknownCa)))
Hint: Your system does not recognize my certificate authority. Try installing system
updates [or simply kick it into shape by browsing to https://www.stackage.org with IE...].

[snoyberg]

I'm in favor of such a change, but I don't think that the problem was
connecting to stackage.org in this case, was it?

On Sat, Jul 25, 2015, 10:31 AM Elliot Cameron notifications@github.com
wrote:

@NCrashed https://github.com/NCrashed Great info. Thanks. @snoyberg
https://github.com/snoyberg What do you think of making that error
message a little less frightening?

TlsException (HandshakeFailed (Error_Protocol ("certificate has unknown CA",True,UnknownCa)))
Hint: Your system does not recognize my certificate authority. Try installing system
updates [or simply kick it into shape by browsing to https://www.stackage.org with IE...].

—
Reply to this email directly or view it on GitHub
#234 (comment)
.

[NCrashed]

Either build plan downloading, either ghc installation through stack setup were producting the exception.

[NCrashed]

Oh, I found an easy fix for the problem. You need to visit https://github.com at least once on the new machine. IE downloads certificate, verifies it and then you are able to use stack setup or stack build...

[dominique-unruh]

I confirm the problem with stack 0.1.4.0 on Window 7.
The fix by @NCrashed almost works.
In my case, I opened https://www.haskell.org in Internet Explorer to get the right certificate (https://github.com did not help).
To find out which site to visit, one can run stack -v setup.
The debug messages then indicate from which URL stack unsuccessfully downloaded.
One then just has to visit the host of that URL in IE.

[snoyberg]

Would it be possible to put this information as a question and answer on
Stack Overflow, so people looking for information on this problem can find
it more easily in the future?

On Fri, Sep 18, 2015 at 4:09 PM, dominique-unruh notifications@github.com
wrote:

I confirm the problem with stack 0.1.4.0 on Window 7.
The fix by @NCrashed https://github.com/NCrashed almost works.
In my case, I opened https://www.haskell.org in Internet Explorer to get
the right certificate (https://github.com did not help).
To find out which site to visit, one can run stack -v setup.
The debug messages then indicate from which URL stack unsuccessfully
downloaded.
One then just has to visit the host of that URL in IE.

—
Reply to this email directly or view it on GitHub
#234 (comment)
.

[dominique-unruh]

I've added it on Stack Overflow: http://stackoverflow.com/questions/32654493/stack-haskell-throws-tlsexception-in-windows/32654494#32654494

It would help if the next version of stack would catch the TLS Error and output the URL it failed to access? That would make it already a bit easier to fix. (And, if more users confirm that the hack of opening IE helps, the error message could explicitly say: "Open the following page in IE: https://blabla".)

[snoyberg]

That's a great idea, can you open a new issue so that it doesn't get lost?

On Fri, Sep 18, 2015, 5:29 PM dominique-unruh notifications@github.com
wrote:

I've added it on Stack Overflow:
http://stackoverflow.com/questions/32654493/stack-haskell-throws-tlsexception-in-windows/32654494#32654494

It would help if the next version of stack would catch the TLS Error and
output the URL it failed to access? That would make it already a bit easier
to fix. (And, if more users confirm that the hack of opening IE helps, the
error message could explicitly say: "Open the following page in IE:
https://blabla".)

—
Reply to this email directly or view it on GitHub
#234 (comment)
.

[arrowd]

I got this problem with latest stack on FreeBSD. Symptoms are same:

$ stack new bla hakyll
Downloading template "hakyll" to create project "bla" in bla/ ...
TlsExceptionHostPort (HandshakeFailed (Error_Protocol ("certificate has unknown CA",True,UnknownCa))) "raw.githubusercontent.com" 443

$ cabal exec tls-retrievecertificate -- api.github.com 443 --verify
connecting to api.github.com on port 443 ...
serial:   17862844379041280932537185190414400495
issuer:   DistinguishedName {getDistinguishedElements = [([2,5,4,6],ASN1CharacterString {characterEncoding = Printable, getCharacterStringRawData = "US"}),([2,5,4,10],ASN1CharacterString {characterEncoding = Printable, getCharacterStringRawData = "DigiCert Inc"}),([2,5,4,11],ASN1CharacterString {characterEncoding = Printable, getCharacterStringRawData = "www.digicert.com"}),([2,5,4,3],ASN1CharacterString {characterEncoding = Printable, getCharacterStringRawData = "DigiCert SHA2 High Assurance Server CA"})]}
subject:  DistinguishedName {getDistinguishedElements = [([2,5,4,6],ASN1CharacterString {characterEncoding = Printable, getCharacterStringRawData = "US"}),([2,5,4,8],ASN1CharacterString {characterEncoding = Printable, getCharacterStringRawData = "California"}),([2,5,4,7],ASN1CharacterString {characterEncoding = Printable, getCharacterStringRawData = "San Francisco"}),([2,5,4,10],ASN1CharacterString {characterEncoding = Printable, getCharacterStringRawData = "GitHub, Inc."}),([2,5,4,3],ASN1CharacterString {characterEncoding = UTF8, getCharacterStringRawData = "*.github.com"})]}
validity: DateTime {dtDate = Date {dateYear = 2014, dateMonth = April, dateDay = 8}, dtTime = TimeOfDay {todHour = 0h, todMin = 0m, todSec = 0s, todNSec = 0ns}} to DateTime {dtDate = Date {dateYear = 2017, dateMonth = April, dateDay = 12}, dtTime = TimeOfDay {todHour = 12h, todMin = 0m, todSec = 0s, todNSec = 0ns}}
### certificate chain trust
fail validation:
[UnknownCA]

[snoyberg]

Please report that issue to the tls package following its debugging
guidelines.

On Fri, Oct 2, 2015, 11:24 PM arrowdodger notifications@github.com wrote:

I got this problem with latest stack on FreeBSD. Symptoms are same:

$ stack new bla hakyll
Downloading template "hakyll" to create project "bla" in bla/ ...
TlsExceptionHostPort (HandshakeFailed (Error_Protocol ("certificate has unknown CA",True,UnknownCa))) "raw.githubusercontent.com" 443

$ cabal exec tls-retrievecertificate -- api.github.com 443 --verify
connecting to api.github.com on port 443 ...
serial: 17862844379041280932537185190414400495
issuer: DistinguishedName {getDistinguishedElements = [([2,5,4,6],ASN1CharacterString {characterEncoding = Printable, getCharacterStringRawData = "US"}),([2,5,4,10],ASN1CharacterString {characterEncoding = Printable, getCharacterStringRawData = "DigiCert Inc"}),([2,5,4,11],ASN1CharacterString {characterEncoding = Printable, getCharacterStringRawData = "www.digicert.com"}),([2,5,4,3],ASN1CharacterString {characterEncoding = Printable, getCharacterStringRawData = "DigiCert SHA2 High Assurance Server CA"})]}
subject: DistinguishedName {getDistinguishedElements = [([2,5,4,6],ASN1CharacterString {characterEncoding = Printable, getCharacterStringRawData = "US"}),([2,5,4,8],ASN1CharacterString {characterEncoding = Printable, getCharacterStringRawData = "California"}),([2,5,4,7],ASN1CharacterString {characterEncoding = Printable, getCharacterStringRawData = "San Francisco"}),([2,5,4,10],ASN1CharacterString {characterEncoding = Printable, getCharacterStringRawData = "GitHub, Inc."}),([2,5,4,3],ASN1CharacterString {characterEncoding = UTF8, getCharacterStringRawData = "*.github.com"})]}
validity: DateTime {dtDate = Date {dateYear = 2014, dateMonth = April, dateDay = 8}, dtTime = TimeOfDay {todHour = 0h, todMin = 0m, todSec = 0s, todNSec = 0ns}} to DateTime {dtDate = Date {dateYear = 2017, dateMonth = April, dateDay = 12}, dtTime = TimeOfDay {todHour = 12h, todMin = 0m, todSec = 0s, todNSec = 0ns}}

certificate chain trust

fail validation:
[UnknownCA]

—

Reply to this email directly or view it on GitHub
#234 (comment)
.