I can't make a copy of the .crt / security file let alone edit it as a test file. OF course I have all the permissions.

Have not been able to get tasks for 4 days

---

Bibi, thanks for the workaround. Works like a charm.

For Windows:
- make a backup from "C:\Program Files\BOINC\ca-bundle.crt"
- open it as administrator in an editor
it is a text file
- delete "DST Root CA X3" until "-----END CERTIFICATE-----"
- restart boinc
the needed "ISRG Root X1" is already contained


see https://boinc.berkeley.edu/forum_thread.php?id=14413
and https://letsencrypt.org/certificates/

---

Thanks bibi
Solved my problem immediately!
Candido

---

For Windows:
- make a backup from "C:\Program Files\BOINC\ca-bundle.crt"
- open it as administrator in an editor
it is a text file
- delete "DST Root CA X3" until "-----END CERTIFICATE-----"
- restart boinc
the needed "ISRG Root X1" is already contained

This didn't help. Last succesfull contact from a Windows host with project servers was on Sep 30. Linux hosts work fine.

Log file on a Win10 host says:

...
12.10.2021 10.26.04 | GPUGRID | update requested by user
12.10.2021 10.26.05 | GPUGRID | Fetching scheduler list
12.10.2021 10.26.07 |  | Project communication failed: attempting access to reference site
12.10.2021 10.26.08 |  | Internet access OK - project servers may be temporarily down.
...

Fixing the ca-bundle.crt file is certainly a cure for the current problem.

1) An alternative way of fixing it is to download a whole new file from the BOINC workround thread.
2) Make sure that you place the replacement in the correct place for your system. The location C:\Program Files\BOINC\ca-bundle.crt is BOINC's default on Windows, but you had the choice during installation to put it anywhere else you wanted.

Fixing the ca-bundle.crt file is certainly a cure for the current problem.

1) An alternative way of fixing it is to download a whole new file from the BOINC workround thread.
2) Make sure that you place the replacement in the correct place for your system. The location C:\Program Files\BOINC\ca-bundle.crt is BOINC's default on Windows, but you had the choice during installation to put it anywhere else you wanted.

Unfortunately this didn't help either. Boinc client seems to be installed to default location c:\program files\boinc since TaskManager shows boinc.exe being executed at that location. I replaced c:\program files\boinc\ca-bundle.crt file with the one from BOINC workround and rebooted, but no dice.

That same Win10 host is currently running WCG and Rosetta tasks, so I believe its network connection is basically ok.

OK, it seems to be a local problem specific to your machine, rather than the general problem affecting all Windows users.

You could get more detailed information by enabling 'http_debug' logging in the Event Log. Set that in BOINC Manager Options -> Event Log options: update the project: turn off the option again. (It produces a lot of output, so unwise to leave it running continuously)

See if you can see the cause of the problem, or post the output relating to GPUGrid here and we can take a look.

I've had to remove the project and re-attach even after replacing the crt file. Others have had to do the same.

I've had to remove the project and re-attach even after replacing the crt file. Others have had to do the same.

Ok, thanks. I'll give that a try tomorrow.

You could get more detailed information by enabling 'http_debug' logging in the Event Log. Set that in BOINC Manager Options -> Event Log options: update the project: turn off the option again. (It produces a lot of output, so unwise to leave it running continuously)

Thanks, I'll check first what extra information that gives.

You could get more detailed information by enabling 'http_debug' logging in the Event Log. Set that in BOINC Manager Options -> Event Log options: update the project: turn off the option again. (It produces a lot of output, so unwise to leave it running continuously)

See if you can see the cause of the problem, or post the output relating to GPUGrid here and we can take a look.

Hello.

Here's what http_debug logging option wrote to logfile:

14.10.2021 15.15.29 |  | Re-reading cc_config.xml
14.10.2021 15.15.29 |  | Not using a proxy
14.10.2021 15.15.29 |  | log flags: file_xfer, sched_ops, task, http_debug
14.10.2021 15.15.35 | GPUGRID | update requested by user
14.10.2021 15.15.36 |  | [http] HTTP_OP::init_get(): https://www.gpugrid.net/notices.php?userid=163138&auth=xxxxxxxxxxxxxxx_censored_xxxxxxxxxxxxxx
14.10.2021 15.15.36 |  | [http] HTTP_OP::libcurl_exec(): ca-bundle set
14.10.2021 15.15.37 |  | [http] [ID#0] Info:  Connection 134 seems to be dead!
14.10.2021 15.15.37 |  | [http] [ID#0] Info:  Closing connection 134
14.10.2021 15.15.37 |  | [http] [ID#0] Info:  timeout on name lookup is not supported
14.10.2021 15.15.37 |  | [http] [ID#0] Info:  Hostname was NOT found in DNS cache
14.10.2021 15.15.37 |  | [http] [ID#0] Info:    Trying 84.89.134.145...
14.10.2021 15.15.37 |  | [http] [ID#0] Info:  Connected to www.gpugrid.net (84.89.134.145) port 443 (#135)
14.10.2021 15.15.37 |  | [http] [ID#0] Info:  successfully set certificate verify locations:
14.10.2021 15.15.37 |  | [http] [ID#0] Info:    CAfile: C:\Program Files\BOINC\ca-bundle.crt
14.10.2021 15.15.37 |  | [http] [ID#0] Info:    CApath: none
14.10.2021 15.15.37 |  | [http] [ID#0] Info:  SSLv3, TLS Unknown, Unknown (22):
14.10.2021 15.15.37 |  | [http] [ID#0] Info:  SSLv3, TLS handshake, Client hello (1):
14.10.2021 15.15.37 |  | [http] [ID#0] Info:  SSLv2, Unknown (22):
14.10.2021 15.15.37 |  | [http] [ID#0] Info:  SSLv3, TLS handshake, Server hello (2):
14.10.2021 15.15.37 |  | [http] [ID#0] Info:  SSLv2, Unknown (22):
14.10.2021 15.15.37 |  | [http] [ID#0] Info:  SSLv3, TLS handshake, CERT (11):
14.10.2021 15.15.37 |  | [http] [ID#0] Info:  SSLv2, Unknown (21):
14.10.2021 15.15.37 |  | [http] [ID#0] Info:  SSLv3, TLS alert, Server hello (2):
14.10.2021 15.15.37 |  | [http] [ID#0] Info:  SSL certificate problem: unable to get local issuer certificate
14.10.2021 15.15.37 |  | [http] [ID#0] Info:  Closing connection 135
14.10.2021 15.15.37 |  | [http] HTTP error: Peer certificate cannot be authenticated with given CA certificates
14.10.2021 15.15.39 | GPUGRID | [http] HTTP_OP::init_get(): https://www.gpugrid.net/
14.10.2021 15.15.39 | GPUGRID | [http] HTTP_OP::libcurl_exec(): ca-bundle set
14.10.2021 15.15.39 | GPUGRID | Fetching scheduler list
14.10.2021 15.15.40 | GPUGRID | [http] [ID#1] Info:  timeout on name lookup is not supported
14.10.2021 15.15.40 | GPUGRID | [http] [ID#1] Info:  Hostname was found in DNS cache
14.10.2021 15.15.40 | GPUGRID | [http] [ID#1] Info:    Trying 84.89.134.145...
14.10.2021 15.15.40 | GPUGRID | [http] [ID#1] Info:  Connected to www.gpugrid.net (84.89.134.145) port 443 (#136)
14.10.2021 15.15.40 | GPUGRID | [http] [ID#1] Info:  successfully set certificate verify locations:
14.10.2021 15.15.40 | GPUGRID | [http] [ID#1] Info:    CAfile: C:\Program Files\BOINC\ca-bundle.crt
14.10.2021 15.15.40 | GPUGRID | [http] [ID#1] Info:    CApath: none
14.10.2021 15.15.40 | GPUGRID | [http] [ID#1] Info:  SSLv3, TLS Unknown, Unknown (22):
14.10.2021 15.15.40 | GPUGRID | [http] [ID#1] Info:  SSLv3, TLS handshake, Client hello (1):
14.10.2021 15.15.40 | GPUGRID | [http] [ID#1] Info:  SSLv2, Unknown (22):
14.10.2021 15.15.40 | GPUGRID | [http] [ID#1] Info:  SSLv3, TLS handshake, Server hello (2):
14.10.2021 15.15.40 | GPUGRID | [http] [ID#1] Info:  SSLv2, Unknown (22):
14.10.2021 15.15.40 | GPUGRID | [http] [ID#1] Info:  SSLv3, TLS handshake, CERT (11):
14.10.2021 15.15.40 | GPUGRID | [http] [ID#1] Info:  SSLv2, Unknown (21):
14.10.2021 15.15.40 | GPUGRID | [http] [ID#1] Info:  SSLv3, TLS alert, Server hello (2):
14.10.2021 15.15.40 | GPUGRID | [http] [ID#1] Info:  SSL certificate problem: unable to get local issuer certificate
14.10.2021 15.15.40 | GPUGRID | [http] [ID#1] Info:  Closing connection 136
14.10.2021 15.15.40 | GPUGRID | [http] HTTP error: Peer certificate cannot be authenticated with given CA certificates
14.10.2021 15.15.41 |  | Project communication failed: attempting access to reference site
14.10.2021 15.15.41 |  | [http] HTTP_OP::init_get(): http://www.google.com/
14.10.2021 15.15.41 |  | [http] HTTP_OP::libcurl_exec(): ca-bundle set
14.10.2021 15.15.42 |  | [http] [ID#0] Info:  timeout on name lookup is not supported
14.10.2021 15.15.42 |  | [http] [ID#0] Info:  Hostname was NOT found in DNS cache
14.10.2021 15.15.42 |  | [http] [ID#0] Info:    Trying 142.250.74.36...
14.10.2021 15.15.42 |  | [http] [ID#0] Info:  Connected to www.google.com (142.250.74.36) port 80 (#137)
14.10.2021 15.15.42 |  | [http] [ID#0] Sent header to server: GET / HTTP/1.1
14.10.2021 15.15.42 |  | [http] [ID#0] Sent header to server: User-Agent: BOINC client (windows_x86_64 7.6.9)
14.10.2021 15.15.42 |  | [http] [ID#0] Sent header to server: Host: www.google.com
14.10.2021 15.15.42 |  | [http] [ID#0] Sent header to server: Accept: */*
14.10.2021 15.15.42 |  | [http] [ID#0] Sent header to server: Accept-Encoding: deflate, gzip
14.10.2021 15.15.42 |  | [http] [ID#0] Sent header to server: Content-Type: application/x-www-form-urlencoded
14.10.2021 15.15.42 |  | [http] [ID#0] Sent header to server: Accept-Language: fi_FI
14.10.2021 15.15.42 |  | [http] [ID#0] Sent header to server:
14.10.2021 15.15.42 |  | [http] [ID#0] Received header from server: HTTP/1.1 200 OK
14.10.2021 15.15.42 |  | [http] [ID#0] Received header from server: Date: Thu, 14 Oct 2021 12:15:42 GMT
14.10.2021 15.15.42 |  | [http] [ID#0] Received header from server: Expires: -1
14.10.2021 15.15.42 |  | [http] [ID#0] Received header from server: Cache-Control: private, max-age=0
14.10.2021 15.15.42 |  | [http] [ID#0] Received header from server: Content-Type: text/html; charset=ISO-8859-1
14.10.2021 15.15.42 |  | [http] [ID#0] Received header from server: P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info."
14.10.2021 15.15.42 |  | [http] [ID#0] Received header from server: Content-Encoding: gzip
14.10.2021 15.15.42 |  | [http] [ID#0] Received header from server: Server: gws
14.10.2021 15.15.42 |  | [http] [ID#0] Received header from server: Content-Length: 6541
14.10.2021 15.15.42 |  | [http] [ID#0] Received header from server: X-XSS-Protection: 0
14.10.2021 15.15.42 |  | [http] [ID#0] Received header from server: X-Frame-Options: SAMEORIGIN
14.10.2021 15.15.42 |  | [http] [ID#0] Received header from server: Set-Cookie: NID=511=rNZDMOeL-yoBDIxpS-MwJhLLHVbgNw8z6PNKY_0SER61QEYVR9fr5LRnkfMy59elOCzNmteggAsEiyy_ihMnRzYIxFPpHbp0wDnmDuX__eFZPRz-XBkqgysOUBBHtzxRW0gT0hLCYNtUn0QIqz1wp5dHbA0Ujw_Mi0TgLIsrzOE; expires=Fri, 15-Apr-2022 12:15:42 GMT; path=/; domain=.google.com; HttpOnly
14.10.2021 15.15.42 |  | [http] [ID#0] Received header from server:
14.10.2021 15.15.42 |  | [http] [ID#0] Info:  Connection #137 to host www.google.com left intact
14.10.2021 15.15.42 |  | Internet access OK - project servers may be temporarily down.
14.10.2021 15.15.47 |  | Re-reading cc_config.xml
14.10.2021 15.15.47 |  | Not using a proxy
14.10.2021 15.15.47 |  | log flags: file_xfer, sched_ops, task

Yup, that's the one.

14.10.2021 15.15.40 | GPUGRID | [http] [ID#1] Info: SSL certificate problem: unable to get local issuer certificate
14.10.2021 15.15.40 | GPUGRID | [http] HTTP error: Peer certificate cannot be authenticated with given CA certificates

The certificates you're offering (from BOINC) can't get it together with the certificates being offered by GPUGrid.

The quickest solution is to give BOINC a better set of certificates to offer. Edit the bundle, use somebody else's hacked version, or use the newer version available on the BOINC message board.

The 'local problem' I suggested earlier might simply be that some versions of Windows, or some local installations, cache frequently-used files and don't notice that the original source has changed.

You'll have to work through that one on your own system, I'm afraid - the simple file replacement worked on all my machines, without any further action.

Steps I'd suggest, in order:
1) Update the file
2) Check that the file has really updated - not been blocked by an anti-virus program.
3) Restart BOINC
4) Restart the computer
5) Detach from GPUGrid and re-attach (it worked for mmonnin, but I can't see why)

For Windows:
- make a backup from "C:\Program Files\BOINC\ca-bundle.crt"
- open it as administrator in an editor
it is a text file
- delete "DST Root CA X3" until "-----END CERTIFICATE-----"
- restart boinc
the needed "ISRG Root X1" is already contained

This didn't help. Last succesfull contact from a Windows host with project servers was on Sep 30. Linux hosts work fine.

The key of successfully modifing a file in the "C:\Program Files" folder is to do it on elevated privilege level (using administrator access rights), otherwise you can't write/modify files in the "C:\Program Files" folder.
To achieve this, copy the following to your cliboard:

notepad "C:\Program Files\BOINC\ca-bundle.crt"

Press Windows key + R (it brings up the "run" dialog box)
Paste the text into the input field
Press CTRL+SHIFT+ENTER, then click yes in the "User Account Control" dialog box
Delete the unnecessary certificate
Exit notepad with saving changes
Restart BOINC

Have anyone tried BOINC manager v7.16.20?
Is this version contain the updated certificates?

---- EDIT ----
I did.
This version has the updated certificate file.

Thanks for the update Retvari! I manually edited and replaced all the certificates on my Win systems earlier. When I have time I will start testing v7.16.20.

As always you can get actual CA bundle at curl project site:

https://curl.se/docs/caextract.html

Or use direct url to latest CA bundle:

https://curl.se/ca/cacert.pem

Steps I'd suggest, in order:
1) Update the file
2) Check that the file has really updated - not been blocked by an anti-virus program.
3) Restart BOINC
4) Restart the computer
5) Detach from GPUGrid and re-attach (it worked for mmonnin, but I can't see why)

I reloaded the cert bundle from BOINC message board and copied it again over the previous one with elevated privileges (CMD.EXE started as an Administrator), but no dice this time either. I didn't find any evidence about that host using the old cert bundle dated somewhere 2015 (perhaps BOINC being installed then).

I didn't detach/reattach from project at this point. I wanted to first try to update the BOINC manager.

Have anyone tried BOINC manager v7.16.20?
Is this version contain the updated certificates?

---- EDIT ----
I did.
This version has the updated certificate file.

This solved the problem. Now that host is again communicating with GPUGRID.

Many thanks to all of you helping to sort this out :)

Glad you got it sorted in the end.

Just for the record, BOINC v7.16.20 is an update for the whole BOINC package - Manager, client, and all the twiddly bits that glue it all together. It will be the client update that solved this particular problem - the Manager wasn't implicated this time.

Version 7.16.20 seems to be working well on the Windows clients.

For Windows:
- make a backup from "C:\Program Files\BOINC\ca-bundle.crt"
- open it as administrator in an editor
it is a text file
- delete "DST Root CA X3" until "-----END CERTIFICATE-----"
- restart boinc
the needed "ISRG Root X1" is already contained


see https://boinc.berkeley.edu/forum_thread.php?id=14413
and https://letsencrypt.org/certificates/

Tried this one...if you do, GPUgrid will not work - but neither would WCG. 🤦‍♂️🙄

So fixed it back with .old certificate & now WCG works.

But also, GPUgrid reported to have OLD certificates on Chrome. & after removing, GPUgrid would not connect again.

Admins & techs, when will this be fixed?

---

non-profit org. Play4Life in Zagreb, Croatia, EU