[quote=shinger post_id=241294 time=1786301301 user_id
How can you ignore certificate validation with YaRSS2 plugin? They have a forced https redirection even if you try using http as you can see with the 301 redirection.
Code: Select all
<USER>@<SYSTEM>:~$ curl -IL http://nyaa.si
HTTP/1.1 301 Moved Permanently
Server: ddos-guard
Date: Sun, 09 Aug 2026 18:49:19 GMT
Connection: keep-alive
Keep-Alive: timeout=60
Set-Cookie: __ddg8_=Nl3SEg9ukEQIM8im; Domain=.nyaa.si; Path=/; Expires=Sun, 09-Aug-2026 19:09:19 GMT
Set-Cookie: __ddg10_=1786301359; Domain=.nyaa.si; Path=/; Expires=Sun, 09-Aug-2026 19:09:19 GMT
Set-Cookie: __ddg9_=169.150.242.5; Domain=.nyaa.si; Path=/; Expires=Sun, 09-Aug-2026 19:09:19 GMT
Location: https://nyaa.si/
And yes, their Lets Encrypt SSL certificate is fine. I am thinking that maybe within the YaRSS2 plugin the CA certificate is outdate or not present?
Code: Select all
<USER>@<SYSTEM>:~$ checkSSL nyaa.si | grep -E -A2 "Issuer|DNS|Validity"
Issuer: C=US, O=Let's Encrypt, CN=R13
Validity
Not Before: May 28 08:31:57 2026 GMT
Not After : Aug 26 08:31:56 2026 GMT
--
CA Issuers - URI:http://r13.i.lencr.org/
X509v3 Subject Alternative Name:
DNS:nyaa.si, DNS:www.nyaa.si
X509v3 Certificate Policies:
Policy: 2.23.140.1.2.1
:
YaRSS2 plugin has its own cacertificate, instead of relying on the ca certificate provided by the system it self. This is within docker container.
Code: Select all
root@e73441ac7620:/# ls -l /config/plugins/YaRSS2-2.2.5-py.egg/yarss2/include/certifi/certifi/cacert.pem
ls: cannot access '/config/plugins/YaRSS2-2.2.5-py.egg/yarss2/include/certifi/certifi/cacert.pem': Not a directory
So thinking outloud. Is within the plugin some code that refers to this path for validation of SSL certificates instead of using the system ca certificated directory?
Code: Select all
root@e73441ac7620:/etc/ssl/certs# pwd
/etc/ssl/certs
root@e73441ac7620:/etc/ssl/certs# ls -lha | wc -l
242
[/quote]
I suppose you could mount your host systems SSL CA authorities into the container, not sure if that would work, but libtorrent has an option that literally is "validate_https_tracker"
Deluge
.