From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <goc-cygwin@m.gmane-mx.org>
Received: from ciao.gmane.io (ciao.gmane.io [116.202.254.214])
 by sourceware.org (Postfix) with ESMTPS id 024C73858427
 for <cygwin@cygwin.com>; Wed,  6 Oct 2021 12:25:48 +0000 (GMT)
DMARC-Filter: OpenDMARC Filter v1.4.1 sourceware.org 024C73858427
Received: from list by ciao.gmane.io with local (Exim 4.92)
 (envelope-from <goc-cygwin@m.gmane-mx.org>) id 1mY5zX-0003Qm-SD
 for cygwin@cygwin.com; Wed, 06 Oct 2021 14:25:47 +0200
X-Injected-Via-Gmane: http://gmane.org/
To: cygwin@cygwin.com
From: Jib Style <jibstyle209@gmail.com>
Subject: Re: Emacs, GnuTLS, and DST Root CA X3
Date: Wed, 06 Oct 2021 05:25:40 -0700
Message-ID: <vriu1r4yibln.fsf@gmail.com>
References: <vriuy277ank1.fsf@gmail.com>
 <5e7db95b-7904-a991-5257-8c929efadc57@SystematicSw.ab.ca>
Mime-Version: 1.0
Content-Type: text/plain
User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/27.2 (cygwin)
Cancel-Lock: sha1:Aaiwv5YNfvscJDDaNEx9mM2BqdU=
X-Spam-Status: No, score=1.2 required=5.0 tests=BAYES_00, DKIM_ADSP_CUSTOM_MED,
 FORGED_GMAIL_RCVD, FREEMAIL_FORGED_FROMDOMAIN, FREEMAIL_FROM,
 HEADER_FROM_DIFFERENT_DOMAINS, KAM_DMARC_STATUS, KAM_NUMSUBJECT,
 NML_ADSP_CUSTOM_MED, SPF_HELO_NONE, SPF_PASS,
 TXREP autolearn=no autolearn_force=no version=3.4.4
X-Spam-Level: *
X-Spam-Checker-Version: SpamAssassin 3.4.4 (2020-01-24) on
 server2.sourceware.org
X-BeenThere: cygwin@cygwin.com
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: General Cygwin discussions and problem reports <cygwin.cygwin.com>
List-Unsubscribe: <https://cygwin.com/mailman/options/cygwin>,
 <mailto:cygwin-request@cygwin.com?subject=unsubscribe>
List-Archive: <https://cygwin.com/pipermail/cygwin/>
List-Post: <mailto:cygwin@cygwin.com>
List-Help: <mailto:cygwin-request@cygwin.com?subject=help>
List-Subscribe: <https://cygwin.com/mailman/listinfo/cygwin>,
 <mailto:cygwin-request@cygwin.com?subject=subscribe>
X-List-Received-Date: Wed, 06 Oct 2021 12:25:50 -0000

I followed the recent announcements, but unfortunately the problem
persists.

I tested on two computers, with the following ca-certificates versions:

- ca-certificates-2.40-1
- ca-certificates-2.50-1
- ca-certificates-2.50-2
- ca-certificates-2.50-3
- ca-certificates-2.50-3 AND ca-certificates-letsencrypt-2.50-3

In all cases, the result was the same.

>From the ca-certificates-letsencrypt-2.50-3 announcement:

> It may be necessary to also remove trust for the already expired DST
> X3 root CA

I'm still trying to figure out _how_ to do this, although I'm not sure
whether it should help my situation. I'll report back with the result.

Some (non-Cygwin) Emacs users reported that GnuTLS >= 3.6.14 works.