0

In the installation procedure of Gentoo, there is a step to check signature of the downloaded iso file. To do so, we first need to download the set of keys from a key server:

$ gpg --keyserver hkps://hkps.pool.sks-keyservers.net --recv-keys 0xBB572E0E2D182910

However, when I first run this command, I got the following error:

$ gpg --keyserver hkps://hkps.pool.sks-keyservers.net --recv-keys 0xBB572E0E2D182910
gpg: requesting key 2D182910 from hkps server hkps.pool.sks-keyservers.net
gpgkeys: HTTP fetch error 60: server certificate verification failed. CAfile: /etc/ssl/certs/ca-certificates.crt CRLfile: none

If I correctly understand this error, that means gpg can't trust the CA that emitted the certificate of the key server. To fix this issue, I need to add the certificate of the CA to my list of trusted certificates.

The question is: how can I get this certificate in a safely manner? By safe, I mean the certificate can't be compromised by a man-in-the-middle attack, for instance.

Using openssl, I can see the certificate of the key server is signed by sks-keyservers.net:

$ openssl s_client -showcerts -connect hkps.pool.sks-keyservers.net:443
CONNECTED(00000005)
depth=1 C = NO, ST = Oslo, O = sks-keyservers.net CA, CN = sks-keyservers.net CA
verify error:num=19:self signed certificate in certificate chain

But how can I trust the certificate given by this command? How can I be sure no attacker falsified the anwser?

2 Answers 2

1

They publish their CA certificate on their website. Verify that you are accessing it securely (HTTPS with no errors), then download it. You can also verify its signature and fingerprint (all listed).

They also have instructions to tell gpg to use a local CA to verify the connection:

hkps.pool.sks-keyservers.net

This is a pool containing only servers available using hkps. Regular A and AAAA and SRV records are included for port 443 servers, and a lookup is performed for _pgpkey-https._tcp on the individual servers to determine if a hkps enabled service is listening on another port. At this point, however, servers not running on port 443 are not included.

This pool only include servers that have been certified by the sks-keyservers.net CA, of which the certificate can be found at https://sks-keyservers.net/sks-keyservers.netCA.pem [OpenPGP signature] [CRL].

For GnuPG 1.4 and 2.0 installations this can be used by using the following parameters in gpg.conf:

~/.gnupg/gpg.conf:
  keyserver hkps://hkps.pool.sks-keyservers.net  
  keyserver-options ca-cert-file=/path/to/CA/sks-keyservers.netCA.pem

GnuPG 2.1 users prior to version 2.1.11 (starting with this version the certificate is enabled by default for this pool) want to add the following in dirmngr.conf:

~/.gnupg/dirmngr.conf:
   hkp-cacert
   /path/to/CA/sks-keyservers.netCA.pem
1

You can simply follow the alternative instructions just below that block:

Alternatively you can use instead the WKD to download the key:

wget -O- https://gentoo.org/.well-known/openpgpkey/hu/wtktzo4gyuhzu8a4z5fdj3fgmr1u6tob?l=releng | gpg --import

Although, if you have a new enough gpg client, you can simply perform

gpg --verbose --locate-key [email protected]

and it will automatically retrieve the key via WKD.

Since the key is fetched through https:// from gentoo.org, you can be quite sure this is not more malicious than the rest of the instructions you are following.

For the record, the fingerprint of the key I receive this way is 13EB BDBE DE7A 1277 5DFD B1BA BB57 2E0E 2D18 2910, in case you want to verify the key you received (and trust the fingerprint I am providing!).

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .