Root Certificate error

When opening DB Browser for SQLite, I receive the following error:

"Error opening remote file at https://raw.githubusercontent.com/sqlitebrowser/sqlitebrowser/master/currentrelease.
The root certificate of the certificate chain is self-signed, and untrusted."

I have tried reinstalling, but still receive this error.

The info below often helps, please fill it out if you're able to. :)

What operating system are you using?

[ X] Windows: ( _version:10 Enterprise )
Linux: ( distro: ___ )
Mac OS: ( version: ___ )
Other: ___

What is your DB4S version?

[X ] 3.10.1
3.10.0
3.9.1
Other: ___

Did you also

Try out the latest nightly version: https://github.com/sqlitebrowser/sqlitebrowser#nightly-builds
[X ] Search for an existing similar issue: https://github.com/sqlitebrowser/sqlitebrowser/issues?utf8=%E2%9C%93&q=is%3Aissue%20

@jawhogan

Thanks @jawhogan. That definitely sounds like something is wrong.

A few potential causes spring to mind, although there might be others that aren't obvious just at the moment. 😄

Something on the network between yourself and GitHub is intercepting your traffic, putting a self-generated certificate in place of the real one. If you're in a corporate environment, or some other kind of situation where that's a known thing... that might be the most likely case.
It could be a bug in our software, getting things wrong. Although we definitely have bugs 😄, this error would probably have shown up by now. But still, maybe it's just a bug we haven't seen yet.
GitHub might be doing some kind of internal certificate changes, and you're having the bad luck to be hit by it. Personally, I reckon this is pretty unlikely. But, people are human and mistakes can happen... 😄

Does option 1 seem like it might be a thing in your situation?

Oh, it's probably a good idea to try one of our nightly releases too, just in case it really is a bug thing. We've fixed and upgraded heaps of things since the 3.10.1 release, so it's worth a shot. 😄

https://nightlies.sqlitebrowser.org/latest/

I can try to run it from a different network than I am currently on to see if it is #1. I will also try the nightly build and post results.

Thanks for the response.

No worries, and yep, those are good things to try. If the behaviour changes, that will narrow things down. 😄

Received same error with the nightly and with no network connection. I will try this weekend on a different network.

That URL is used to identify the latest version. To stop the error, one workaround would be to stop the check for updates.
I presume DB4S is actually starting, or is the error preventing the continuation of the program?

From the preferences (View | Preferences) turn off automatic updates.

Thankfully DB4S isn't updated frequently enough to worry about updates! ;)

Received same error with the nightly and with no network connection.

The "with no network connection" bit finally sunk in this morning. To me, that sounds like you have something running on the computer which is replacing GitHub's certificate on the fly.

Since you mention you're using Win 10 Enterprise, it's sounding like you're in one of those work places that install some "security suite" on all their computers. It's not super common (as far as I know), but it does seem to crop up now and again. 😉

It'd be interesting to see what certificate is given to your web browser when you try opening that URL.

In theory, the web browser would also be getting certificates replaced on the fly. And it's easier to look at the details of the certifcate using a web browser. 😄

And it's easier to look at the details of the certifcate using a web browser.

I take that back. When trying to look at the details of the certificate just now using Firefox... no info is shown.

Note the empty values for "Website", "Owner", and "Verified by". Also the "View Certificate" button does nothing when clicked.

This bit seems like a bug in Firefox. 😦

As a workaround for the Firefox problem, I just went with the command line approach instead. Grabbing the certifcate can be done (on a *nix system) using the openssl command line tool:

openssl s_client -connect raw.githubusercontent.com:443 </dev/null 2>/dev/null | sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' > somename.pem

That saves the certificate to a file called "somename.pem". The pem file can be viewed using the openssl command line tool as well:

$ openssl x509 -text -noout -in somename.pem
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            08:3a:84:59:2f:77:f2:e7:95:1b:f8:87:ce:de:c9:66
    Signature Algorithm: sha256WithRSAEncryption
        Issuer: C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert SHA2 High Assurance Server CA
        Validity
            Not Before: Mar 23 00:00:00 2017 GMT
            Not After : May 13 12:00:00 2020 GMT
        Subject: C=US, ST=California, L=San Francisco, O=GitHub, Inc., CN=www.github.com
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Modulus:
                    00:c6:d3:f1:8a:3b:cf:a4:45:f2:cb:70:67:d7:45:
                    9f:a1:69:8a:4d:6e:f9:dd:4b:f6:3e:eb:03:36:66:
                    a5:c7:fe:e6:a8:5a:a2:e4:1a:8a:e3:15:90:1d:08:
                    12:a7:28:5e:76:0b:56:21:75:82:24:61:ed:80:55:
                    5c:93:e0:c1:01:b1:e2:1e:c1:3a:ed:ec:29:57:56:
                    b6:97:61:a9:a8:d0:85:4d:4e:fb:52:ca:0d:54:3f:
                    f1:3f:2c:77:93:e7:0f:5f:dc:bc:ae:a8:cc:89:90:
                    77:c6:cd:73:28:36:01:91:ca:01:56:b0:3e:88:ed:
                    f6:dd:89:09:98:22:c4:5c:23:b6:3b:b6:f5:b7:02:
                    c5:5a:43:70:31:de:de:ee:7b:5e:bb:6b:82:32:fc:
                    4d:a7:94:20:db:63:08:9f:7d:ed:d9:e8:0c:3d:f2:
                    03:53:f4:dc:28:37:f2:6a:dc:b9:fa:ce:85:de:0c:
                    e1:ed:e2:20:9e:a3:50:37:44:ff:e5:fa:5a:62:4a:
                    9d:c7:c8:f6:d5:00:ec:23:21:7f:09:f4:a9:03:9a:
                    8a:2e:e8:65:ba:ef:31:ad:46:e7:73:43:22:81:7e:
                    d5:4e:14:bd:3d:b7:f1:31:24:35:71:04:1f:6c:67:
                    71:a1:03:49:4c:d1:f1:5e:ff:99:4d:70:31:28:28:
                    ee:e7
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier: 
                keyid:51:68:FF:90:AF:02:07:75:3C:CC:D9:65:64:62:A2:12:B8:59:72:3B

            X509v3 Subject Key Identifier: 
                30:82:29:D8:6D:4C:E0:D4:A2:C6:10:48:05:80:87:A8:BC:AA:E9:12
            X509v3 Subject Alternative Name: 
                DNS:www.github.com, DNS:*.github.com, DNS:github.com, DNS:*.github.io, DNS:github.io, DNS:*.githubusercontent.com, DNS:githubusercontent.com
            X509v3 Key Usage: critical
                Digital Signature, Key Encipherment
            X509v3 Extended Key Usage: 
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 CRL Distribution Points: 

                Full Name:
                  URI:http://crl3.digicert.com/sha2-ha-server-g5.crl

                Full Name:
                  URI:http://crl4.digicert.com/sha2-ha-server-g5.crl

            X509v3 Certificate Policies: 
                Policy: 2.16.840.1.114412.1.1
                  CPS: https://www.digicert.com/CPS
                Policy: 2.23.140.1.2.2

            Authority Information Access: 
                OCSP - URI:http://ocsp.digicert.com
                CA Issuers - URI:http://cacerts.digicert.com/DigiCertSHA2HighAssuranceServerCA.crt

            X509v3 Basic Constraints: critical
                CA:FALSE
            CT Precertificate SCTs: 
                Signed Certificate Timestamp:
                    Version   : v1(0)
                    Log ID    : A4:B9:09:90:B4:18:58:14:87:BB:13:A2:CC:67:70:0A:
                                3C:35:98:04:F9:1B:DF:B8:E3:77:CD:0E:C8:0D:DC:10
                    Timestamp : Mar 23 22:19:01.508 2017 GMT
                    Extensions: none
                    Signature : ecdsa-with-SHA256
                                30:45:02:20:45:5E:C5:9A:0B:56:EE:A7:C4:34:26:0A:
                                D8:F4:48:08:C6:3A:A2:D6:FD:9F:03:A6:60:E3:88:91:
                                5D:24:32:CB:02:21:00:8C:E1:CD:4D:73:96:C7:89:87:
                                9F:B2:5D:CE:54:D4:8F:A9:82:A4:66:5D:BD:57:70:F2:
                                2C:18:BF:28:39:DC:23
                Signed Certificate Timestamp:
                    Version   : v1(0)
                    Log ID    : 56:14:06:9A:2F:D7:C2:EC:D3:F5:E1:BD:44:B2:3E:C7:
                                46:76:B9:BC:99:11:5C:C0:EF:94:98:55:D6:89:D0:DD
                    Timestamp : Mar 23 22:19:01.605 2017 GMT
                    Extensions: none
                    Signature : ecdsa-with-SHA256
                                30:44:02:20:4A:40:CB:32:4A:68:FA:F6:82:99:31:E0:
                                BE:30:3A:24:2E:BA:D5:37:6B:4A:F8:E3:25:CD:FD:53:
                                E6:A8:07:B6:02:20:44:92:CD:1A:F7:D6:0E:63:29:08:
                                AF:E2:58:F4:A6:32:C6:0A:DB:26:32:4E:5F:4A:6E:D1:
                                C1:B4:FE:56:A6:47
                Signed Certificate Timestamp:
                    Version   : v1(0)
                   Log ID    : 56:14:06:9A:2F:D7:C2:EC:D3:F5:E1:BD:44:B2:3E:C7:
                                46:76:B9:BC:99:11:5C:C0:EF:94:98:55:D6:89:D0:DD
                    Timestamp : Mar 23 22:19:01.605 2017 GMT
                    Extensions: none
                    Signature : ecdsa-with-SHA256
                                30:44:02:20:4A:40:CB:32:4A:68:FA:F6:82:99:31:E0:
                                BE:30:3A:24:2E:BA:D5:37:6B:4A:F8:E3:25:CD:FD:53:
                                E6:A8:07:B6:02:20:44:92:CD:1A:F7:D6:0E:63:29:08:
                                AF:E2:58:F4:A6:32:C6:0A:DB:26:32:4E:5F:4A:6E:D1:
                                C1:B4:FE:56:A6:47
                Signed Certificate Timestamp:
                    Version   : v1(0)
                    Log ID    : EE:4B:BD:B7:75:CE:60:BA:E1:42:69:1F:AB:E1:9E:66:
                                A3:0F:7E:5F:B0:72:D8:83:00:C4:7B:89:7A:A8:FD:CB
                    Timestamp : Mar 23 22:19:01.535 2017 GMT
                    Extensions: none
                    Signature : ecdsa-with-SHA256
                                30:45:02:20:0D:A7:D1:36:DE:01:AE:4A:6E:E3:A9:9D:
                                7A:49:6E:73:9B:C1:C9:29:3A:C1:EC:68:DF:B6:AC:0E:
                                D9:03:5E:98:02:21:00:97:B2:53:9D:53:DD:98:57:1A:
                                BB:3C:0B:8E:03:44:48:C4:45:B6:7E:01:AF:39:BD:5C:
                                94:CF:25:B6:96:3D:A7
                Signed Certificate Timestamp:
                    Version   : v1(0)
                    Log ID    : BB:D9:DF:BC:1F:8A:71:B5:93:94:23:97:AA:92:7B:47:
                                38:57:95:0A:AB:52:E8:1A:90:96:64:36:8E:1E:D1:85
                    Timestamp : Mar 23 22:19:01.521 2017 GMT
                    Extensions: none
                    Signature : ecdsa-with-SHA256
                                30:45:02:21:00:AA:AE:DB:AA:EF:52:7A:4C:CE:F0:28:
                                C5:9E:48:04:4E:75:36:BC:7F:7E:46:A0:B3:08:98:95:
                                CE:35:23:47:7D:02:20:38:DB:D2:BB:F5:47:E6:39:59:
                                D7:E3:C3:F9:BE:93:84:51:75:FA:95:7B:C2:9E:F0:AB:
                                EF:FC:C6:21:D4:32:5B
    Signature Algorithm: sha256WithRSAEncryption
         99:7e:d6:2f:ce:1b:a6:15:f5:15:b3:ef:f1:30:c1:1f:54:10:
         92:a4:8c:43:c0:bc:bd:a5:0d:00:53:e2:42:c1:85:6f:e5:a7:
         a9:41:99:4b:46:11:5a:dd:fd:e8:27:69:97:b6:3c:a6:0e:2a:
         30:db:33:53:be:83:b0:aa:08:89:04:7e:66:35:e5:5c:b3:2c:
         28:7f:a7:b1:e5:27:79:6d:81:26:89:ea:a0:55:51:70:10:cb:
         eb:43:59:6b:aa:52:b4:46:fd:d2:ff:89:16:8a:45:da:0e:bf:
         87:0d:53:ef:83:24:c5:17:ad:12:63:40:74:80:4d:bd:a4:c9:
         dd:74:d9:df:1c:61:02:0a:71:b0:93:24:2f:2d:a9:20:7a:43:
         86:44:11:58:8a:45:9b:d7:5c:e2:66:eb:a6:c6:f1:7c:a7:dc:
         dd:af:27:89:39:f7:c1:9a:99:c8:7f:34:7a:d9:39:73:83:cb:
         73:75:bc:16:b0:4e:a1:49:2d:09:12:8d:4e:3e:63:ff:f0:88:
         71:df:50:46:2b:a5:38:3d:db:38:08:97:29:64:de:cb:c7:eb:
         88:70:59:dd:62:dc:16:76:2d:30:6a:e3:a3:2f:40:a5:36:0f:
         cc:05:76:d5:e0:6e:04:40:3d:6a:21:5f:bf:4e:a3:a8:6c:d0:
         98:21:b9:bd

Note the "Issuer" bits there, showing the certificate was issued by DigiCert. I'm kind of guessing yours will show something different, maybe BlueCoat or Symantec? (just guesses) 😄

Problem is now resolved. It turned out to be a network issue. Thanks for all the comments, they have been very informative.

It turned out that I was having larger certificate errors than just SQLite. This was just the first manifestation of the issue.

Thanks again.

Cool, no worries at all. 😄

Navigation Menu

Repository navigation

Root Certificate error #1429

What operating system are you using?

What is your DB4S version?

Did you also

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Root Certificate error #1429

Description

What operating system are you using?

What is your DB4S version?

Did you also

Activity

justinclift commented on Jun 15, 2018

jawhogan commented on Jun 15, 2018

justinclift commented on Jun 15, 2018

jawhogan commented on Jun 15, 2018

chrisjlocke commented on Jun 16, 2018

justinclift commented on Jun 16, 2018

justinclift commented on Jun 16, 2018

justinclift commented on Jun 16, 2018

jawhogan commented on Jun 18, 2018

justinclift commented on Jun 18, 2018

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions