Downloading DSL drivers via GUI goes wrong... about tch-nginx-gui

[Ansuel]

umm yes i need to add -K to the script as normally the modem doesn't have certificate

about version... well it's another bug... problem is that you are not connected to dslam i think

(or can you give me xdslctl info --vendor output ? )

[meyergru]

Yes, I think so. Here is the output.

# xdslctl info --vendor
xdslctl: ADSL driver and PHY status
Status: Idle
Last Retrain Reason:    0
Last initialization procedure status:   0

ChipSet Vendor Id:
ChipSet VersionNumber:
ChipSet SerialNumber:

The '-k' switch would be needed for version checks as well, in fact everywhere when curl is used for ilpuntotecnico repo (e.g. the cron script). The better option woul be to add Letsencrypt CA to the cert chain. I can look into that...

[Ansuel]

and it's already like that ;)

anyway i fixed the error with no dsl

[meyergru]

The "-k" option is potentially unsafe against MITM-attacks.

About the "better" option: curl can use a --cacert (bundle or single cert) or a --capath parameter.

The Letsencrypt CA certs are not contained in the default path /etc/ssl/certs - nor are most other CAs.
One could provide a standard set of CAs in a bundle.

Alas, the usual cert bundle file is named ca-certificates.crt, but it is not compiled into the curl version in openwrt, so what would be needed is:

1. Providing an /etc/ssl/certs/ca-certificates.crt with the usual root CAs.
2. Setting a system-wide environment variable CURL_CA_BUNDLE pointing to that bundle.

or:

2. Calling curl with --ca-bundle "/etc/ssl/certs/ca-certificates.crt" every time.