gnutls tls client error: cannot load trusted Certificate Authorities: An unimplemented or disabled feature has been requ

[zjxy63]

We have a custom built VLC 2.2.5 on intel coreI7 target running yocto linux, VLC won't play some of the https steams. VLC verbose debug output says error about gnutls certificates error:

[00007f6280003908] gnutls tls client debug: using GnuTLS version 3.4.9
[00007f6280003908] gnutls tls client error: cannot load trusted Certificate Authorities: An unimplemented or disabled feature has been requested.

and later some errors about certificates failure:

00007f6280027bb8] gnutls tls session debug: TLS handshake: Success.
[00007f6280027bb8] gnutls tls session error: Certificate verification failure (0x0042)
[00007f6280027bb8] gnutls tls session error: * Certificate not verified
[00007f6280027bb8] gnutls tls session error: * Signer not found
[00007f6280027bb8] gnutls tls session debug: 2 certificate(s) in the list
[00007f6280027bb8] gnutls tls session debug: no known certificates for ondemand.npr.org
[00007f6280027bb8] core tls session error: TLS client session handshake error
[00007f6280000e88] http access error: cannot establish HTTP/TLS session
[00007f6280000e88] core access debug: no access modules matched
[00007f627c0009b8] core input error: open of `https://ondemand.npr.org/anon.npr-mp3/n ... 150651.mp3' failed
[00007f627c0009b8] core input error: Your input can't be opened
[00007f627c0009b8] core input error: VLC is unable to open the MRL 'https://ondemand.npr.org/anon.npr-mp3/n ... 150651.mp3'. Check the log for details.

Searched over net, tried to copy firefox certificates to ~/.vlc/certs or ~/.local/share/vlc/certs locations, but none of the attempts works.

Anyone seen this kind of problem ? Appreciated.

[Jean-Baptiste Kempf]

This is related to your GnuTLS install. Not sure we can do anything about it. Installed ca-certificates ?

[Rémi Denis-Courmont]

Your GnuTLS build lacks support for root CAs, and is thus not compatible with VLC. Complain to Yocto or rebuild GnuTLS yourself.

Unfortunately, we cannot help you here.

[zjxy63]

Thanks for all the suggestions. We rebuilt the gnutls with config flag options set to correct certificates trust store and file, fixed the problem.

[xitij67]

I am having similar issue.
Can you please provide the certificate trust store and file you used to build the gnutls ?

[Rémi Denis-Courmont]

GnuTLS does not include a trust store at build time. It loads it from the file system at run-time.