[Tests] exclude expired LetsEncrypt CA

[rickbutton]

🤷‍♂️ who knows if this works lets find out

[ljharb]

Worth a shot! I just tried https://app.travis-ci.com/github/nvm-sh/nvm/jobs/541600178 and it didn't work, but this is slightly different.

[ljharb]

Sadly no, same failure :-/

Let's keep this open tho and use it for experimentation.

[rickbutton]

I think I've fixed it by replacing

mozilla/DST_Root_CA_X3.crt

with

!mozilla/DST_Root_CA_X3.crt

in /etc/ca-certificates.conf and running update-ca-certificates which will blacklist that specific expired CA certficate. For whatever reason curl is still failing with the openssl bug that forces the expired cert to be chosen even after updating, but just dropping the cert will fix it. Any downstream LetsEncrypt certs that aren't expired can use the new chain, so should be fine.

thanks for the nerd snipe :)

[ljharb]

ooh! thank you!!

travis folks also just suggested:
sudo apt update && sudo apt install libgnutls-openssl27 libgnutls30

i'm going to try that real quick to see if that works, because that'll be a bit less hacky than the sed :-)

[ljharb]

Their suggestion fixes the curl tests, but not the wget tests. I'm waiting to hear back from them.

[ljharb]

Going to go ahead and land just your fix, and we can iterate on travis' suggestion later. Thanks!