Update Globus libs?

[ahaupt]

Hi *,

we recently started the migration of our host certificates from GridKa CA to Geant-TCS/Sectigo multi-domain certs (accepted in both, the CAB as well as the IGTF world).

Those certs cause verification errors when they contain the full trust chain (with issuer after) with Globus client lib from DiracOS:

[wgs34] ~/grid/CTA-dirac % globus-url-copy -version
globus-url-copy: 9.19
[wgs34] ~/grid/CTA-dirac % globus-url-copy -v gsiftp://papaya01.zeuthen.desy.de//pnfs/ifh.de/acs/grid/cta/vo.cta.in2p3.fr/MC/PROD5/Paranal/proton/sim_telarray/2221/Data/000xxx/proton_20deg_0deg_run274___cta-prod5-paranal_desert-2147m-Paranal-dark.simtel.zst file:///tmp/blub
Source: gsiftp://papaya01.zeuthen.desy.de//pnfs/ifh.de/acs/grid/cta/vo.cta.in2p3.fr/MC/PROD5/Paranal/proton/sim_telarray/2221/Data/000xxx/
Dest:   file:///tmp/
  proton_20deg_0deg_run274___cta-prod5-paranal_desert-2147m-Paranal-dark.simtel.zst  ->  blub

error: globus_ftp_control: gss_init_sec_context failed
OpenSSL Error: s3_clnt.c:1188: in library: SSL routines, function SSL3_GET_SERVER_CERTIFICATE: certificate verify failed
globus_gsi_callback_module: Could not verify credential
globus_gsi_callback_module: Can't get the local trusted CA certificate: Cannot find trusted CA certificate with hash ee64a828 in /project/grid/certificates

The interesting thing is, the error does not show up with current Globus from EPEL or UMD-UI:

[wgs34] ~ % globus-url-copy -version
globus-url-copy: 10.3
[wgs34] ~ % globus-url-copy -v gsiftp://papaya01.zeuthen.desy.de//pnfs/ifh.de/acs/grid/cta/vo.cta.in2p3.fr/MC/PROD5/Paranal/proton/sim_telarray/2221/Data/000xxx/proton_20deg_0deg_run274___cta-prod5-paranal_desert-2147m-Paranal-dark.simtel.zst file:///tmp/blub
Source: gsiftp://papaya01.zeuthen.desy.de//pnfs/ifh.de/acs/grid/cta/vo.cta.in2p3.fr/MC/PROD5/Paranal/proton/sim_telarray/2221/Data/000xxx/
Dest:   file:///tmp/
  proton_20deg_0deg_run274___cta-prod5-paranal_desert-2147m-Paranal-dark.simtel.zst  ->  blub
[wgs34] ~ % 

Any chance to update these libs inside DiracOS?

Cheers,
Andreas

[fstagni]

Hi, I assume you are using a python2 DIRAC client (which version?). Because, using a py3 client I get:

bash-4.2$ globus-url-copy -version
globus-url-copy: 10.10

We are not updating anymore python2 clients' DIRACOS.

[ahaupt]

Hi Fabio, thanks! Indeed, I was not aware I was still using py2-based client! Will install the py3-based now!

[fstagni]

Federico ;-)