Project services are inaccessible.
Andy says it appears to be a network issue at the department level.

I get problems using Firefox on this site, but on no other sites. I have restarted Firefox and that did not help. I then rebooted my system (to install updates, including a new Firefox) and that did not help either. On most pages I see


Warning: file_get_contents(): SSL operation failed with code 1. OpenSSL Error messages: error:14090086:SSL routines:ssl3_get_server_certificate:certificate verify failed in /home/boinc/cpdnboinc/html/inc/header.inc on line 9

Warning: file_get_contents(): Failed to enable crypto in /home/boinc/cpdnboinc/html/inc/header.inc on line 9

Warning: file_get_contents(https://www.cpdn.org/menu_boinc.xml): failed to open stream: operation failed in /home/boinc/cpdnboinc/html/inc/header.inc on line 9

Now there is no such directory on my machine named /home/boinc, so of course there is none named /home/boinc/cpdnboinc/html/inc/header.inc

Maybe this is on your machine(s)?

I hope it goes away.

---

I get problems using Firefox on this site, but on no other sites. I have restarted Firefox and that did not help. I then rebooted my system (to install updates, including a new Firefox) and that did not help either. On most pages I see


Warning: file_get_contents(): SSL operation failed with code 1. OpenSSL Error messages: error:14090086:SSL routines:ssl3_get_server_certificate:certificate verify failed in /home/boinc/cpdnboinc/html/inc/header.inc on line 9

Warning: file_get_contents(): Failed to enable crypto in /home/boinc/cpdnboinc/html/inc/header.inc on line 9

Warning: file_get_contents(https://www.cpdn.org/menu_boinc.xml): failed to open stream: operation failed in /home/boinc/cpdnboinc/html/inc/header.inc on line 9

Now there is no such directory on my machine named /home/boinc, so of course there is none named /home/boinc/cpdnboinc/html/inc/header.inc

Maybe this is on your machine(s)?

I hope it goes away.

If I got the above, I would delete all cookies for the cpdn site and try again. Nothing untoward on FF here.

I'm getting the same error messages, using Chrome under Windows.

The line numbers referencing '.inc' ("include") files under /home/boinc/... will be HTML source code being assembled on the project web server.

I'm getting the same error messages, using Chrome under Windows.

The line numbers referencing '.inc' ("include") files under /home/boinc/... will be HTML source code being assembled on the project web server.

I just switched to the Chromium browser and get the same complaints. Using

Red Hat Enterprise Linux release 8.4 (Ootpa)
chromium-93.0.4577.63-1.el8.x86_64

My regular browser is

firefox-78.14.0-1.el8_4.x86_64

---

I wonder if any of their certificates have DST Root CA X3 at the top of their certificate chain. It lapsed on 29th September, I believe...

Cheers - Al.

---

I wonder if any of their certificates have DST Root CA X3 at the top of their certificate chain. It lapsed on 29th September, I believe...

Cheers - Al.

Is causing problems for Windows version of BOINC. I have replaced the certificate in the BOINC folder under .wine but as currently not running that, haven't tested it. See this thread on BOINC forums.

There is something wrong system-wide. The following is what I get on my browser when opening up the CPDN website. Collatz has collapsed while World Community Grid seems to be suffering from asthma.
Warning: file_get_contents(): SSL operation failed with code 1. OpenSSL Error messages: error:14090086:SSL routines:ssl3_get_server_certificate:certificate verify failed in /home/boinc/cpdnboinc/html/inc/header.inc on line 9

Warning: file_get_contents(): Failed to enable crypto in /home/boinc/cpdnboinc/html/inc/header.inc on line 9

Warning: file_get_contents(https://www.cpdn.org/menu_boinc.xml): failed to open stream: operation failed in /home/boinc/cpdnboinc/html/inc/header.inc on line 9

09/30/21 23:11:54 | climateprediction.net | Scheduler request failed: Peer certificate cannot be authenticated with given CA certificates
From my event log just now.

World Community Grid seems to be suffering from asthma.

World Community Grid is under new management. No longer IBM, but now Krembil.

https://www.uhn.ca/Research/Research_Institutes/Krembil

---

World Community Grid is under new management. No longer IBM, but now Krembil.

Well, they've made an agreement to move, but it's likely to be a slow, extended, transfer. I think that for the moment, the project is still running on IBM hardware.

There has been a recent outage announcement by the long-standing IBM administrator:

Greetings,

We are experiencing an outage that has caused us to stop issuing new work or receiving completed work back from the volunteers.

We apologize for the issue and are working to restoring normal service as soon as possible.

https://www.worldcommunitygrid.org/forums/wcg/viewthread_thread,43772

I notice that the main CPDN page does not suffer from these messages:

https://www.climateprediction.net/

---

World Community Grid is under new management. No longer IBM, but now Krembil.

Well, they've made an agreement to move, but it's likely to be a slow, extended, transfer. I think that for the moment, the project is still running on IBM hardware.

I have no idea about the hardware, but the appearance of the WCG web site has changed dramatically. I do not like the looks of it, but I will eventually get used to it.

---

World Community Grid is under new management. No longer IBM, but now Krembil.

Well, they've made an agreement to move, but it's likely to be a slow, extended, transfer. I think that for the moment, the project is still running on IBM hardware.

I have no idea about the hardware, but the appearance of the WCG web site has changed dramatically. I do not like the looks of it, but I will eventually get used to it.

___________________
From a colourful Mardi Gras kind of nightclub to a fully sterile hospital or a laboratory? :) I do not like it either but will have to get on with it.

09/30/21 23:11:54 | climateprediction.net | Scheduler request failed: Peer certificate cannot be authenticated with given CA certificates
From my event log just now.

From BOINC forums

AT YOUR OWN RISK

Google drive

Make a safe copy of your old one, just in case.


Works for me.. Downloaded and copied to BOINC program folder replacing old certificate.

The certificate bundle that comes with BOINC has had part of that bundle expire. At some point an update to BOINC should sort it (a ticket has been raised) in the meantime the solution above seems to work.

09/30/21 23:11:54 | climateprediction.net | Scheduler request failed: Peer certificate cannot be authenticated with given CA certificates
From my event log just now.

From BOINC forums

AT YOUR OWN RISK

Google drive

Make a safe copy of your old one, just in case.


Works for me.. Downloaded and copied to BOINC program folder replacing old certificate.

I get no such message in my EventLog. Here is all I get for climateprediction.net messages.
I do not even have a Google Drive.

Fri 01 Oct 2021 09:24:48 AM EDT | climateprediction.net | Sending scheduler request: To send trickle-up message.
Fri 01 Oct 2021 09:24:48 AM EDT | climateprediction.net | Not requesting tasks: don't need ()
Fri 01 Oct 2021 09:24:50 AM EDT | climateprediction.net | Scheduler request completed
Fri 01 Oct 2021 09:24:50 AM EDT | climateprediction.net | Project requested delay of 3636 seconds
Fri 01 Oct 2021 09:25:19 AM EDT | climateprediction.net | Started upload of hadam4h_a22x_209911_5_895_012065319_0_r576379608_1.zip
Fri 01 Oct 2021 09:25:39 AM EDT | climateprediction.net | Finished upload of hadam4h_a22x_209911_5_895_012065319_0_r576379608_1.zip
Fri 01 Oct 2021 12:27:29 PM EDT | climateprediction.net | Sending scheduler request: To send trickle-up message.
Fri 01 Oct 2021 12:27:29 PM EDT | climateprediction.net | Not requesting tasks: don't need ()
Fri 01 Oct 2021 12:27:31 PM EDT | climateprediction.net | Scheduler request completed
Fri 01 Oct 2021 12:27:31 PM EDT | climateprediction.net | Project requested delay of 3636 seconds
Fri 01 Oct 2021 12:27:38 PM EDT | climateprediction.net | Started upload of hadam4h_a04n_209111_4_861_011981282_2_r943468045_2.zip
Fri 01 Oct 2021 12:27:57 PM EDT | climateprediction.net | Finished upload of hadam4h_a04n_209111_4_861_011981282_2_r943468045_2.zip
Sat 02 Oct 2021 06:38:53 AM EDT |  | Project communication failed: attempting access to reference site
Sat 02 Oct 2021 06:38:55 AM EDT |  | Internet access OK - project servers may be temporarily down.

But the problem persists.

The certificate bundle that comes with BOINC has had part of that bundle expire.

What is the name of the file or directory containing the certificate bundle?

---

What is the name of the file or directory containing the certificate bundle?

ca-bundle.crt

It seems most Linux installations are not affected and there has been an acknowledgement of the issue on git-hub. Some of the certificates in ca-bundle.crt on the latest Windows client went out of date at the end of last month. Not all projects are affected and some may be putting their own solutions in place till a BOINC revision is released with updated certs.

My Linux installation of BOINC is not affected. My Windows one under WINE was until I replaced the file with the one from the googledocs link. YOu do not need to have a googledocs account to access it.

It seems most Linux installations are not affected and there has been an acknowledgement of the issue on git-hub. Some of the certificates in ca-bundle.crt on the latest Windows client went out of date at the end of last month. Not all projects are affected and some may be putting their own solutions in place till a BOINC revision is released with updated certs.

Mine is a Linux installation, Red Hat Enterprise Linux release 8.4 (Ootpa). But it does have this problem.

I have looked around and found this. It seems my files are pretty up-to-date (Sep 30 11:13). The files are not in my Boinc partition. In full disclosure, I did accept a system update from Red Hat at September 30 11:14:52

$ locate ca-bundle.crt
/etc/pki/tls/certs/ca-bundle.crt

$ cd /etc/pki/tls/certs/
$ ls -l
lrwxrwxrwx. 1 root root 49 Jun 16 16:28 ca-bundle.crt -> /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem
lrwxrwxrwx. 1 root root 55 Jun 16 16:28 ca-bundle.trust.crt -> /etc/pki/ca-trust/extracted/openssl/ca-bundle.trust.crt

$ ls -l /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem /etc/pki/ca-trust/extracted/openssl/ca-bundle.trust.crt
-r--r--r--. 1 root root 243169 Sep 30 11:13 /etc/pki/ca-trust/extracted/openssl/ca-bundle.trust.crt
-r--r--r--. 1 root root 200578 Sep 30 11:13 /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem

---

Mine is a Linux installation, Red Hat Enterprise Linux release 8.4 (Ootpa). But it does have this problem.

Richard posted the following on the BOINC forums a few minutes ago.

A volunteer developer is working on creating an emergency release (take a bow, Vitalii).

The new release will contain a fresh certificate bundle, sourced from a genuine and reliable public source: https://curl.se/docs/caextract.html

You will need to rename cacert.pem to ca-bundle.crt, but it works with some of the projects that were having problems on Thursday (I haven't checked them all). If you feel nervous about downloading amateur hacks like mine, feel free to download from there instead.

Looks like file names may be slightly different in Red Hat for the record the ca-bundle.crt on Ubuntu is by default in /var/lib/boinc-client/

Looks like file names may be slightly different in Red Hat for the record the ca-bundle.crt on Ubuntu is by default in /var/lib/boinc-client/

For what it's worth, on Ubuntu that entry in boinc-client is a link to /etc/ssl/certs/ca-certificates.crt, which gets updated as necessary - I would expect most Linux distributions that have a properly curated BOINC client package to do something similar, but I could be wrong :-)

And I note that we still have the (internal to CPDN) PHP warnings at the top of every page, so it looks like Oxford have some sorting out to do anyway...

Cheers - Al.

[Edit...] P.S. The certificate bundle was most recently updated on 28th September, 2021, round about when this root certificate expired.

---