[LinuxBender]

For which domain? joinpeertube.org or one of the video hosting nodes?

Use Qualys [1] to test the domain in question to link here or use the testssl.sh [2] code only depends on openssl and bash to test from your machine. If one of the many self hosted nodes, see if you can find a way to reach out to them and kindly suggest they set up certbot or a cron job to renew their certs.

Joinpeertube.org looks good to me [3] so I assume you find a self-hosted node that needs some attention.

If someone here knows of a way to query a list of all the self-hosted domains joined into peertube perhaps we could run testssl.sh against all of them to generate reports. I am not opposed to doing this if someone knows how I can get a list of all the domains using curl.

[1] - https://www.ssllabs.com/ssltest/

[2] - https://github.com/drwetter/testssl.sh

[3] - https://www.ssllabs.com/ssltest/analyze.html?d=joinpeertube....

[ehutch79]

joinpeertube.org

Clicking on the HN link, as a user how would I know this is to be expected? or that it's one random node?

[LinuxBender]

Joinpeertube.org is not a random node, however that site links to many random nodes for the videos. One may or may not realize when they click on a video that they are on a new domain unless they glance at the URL bar. That is why I was looking for clarification.

If you are experiencing issues on joinpeertube.org then it may be worth running an OS update and ensuring you also have the latest version of your browser to rule out CA certificate store issues. CA stores are periodically updated and LetsEncrypt did go through a change that will eventually invalidate its older signing keys and intermediate certificates. This would only impact people that have stagnant operating systems or browsers unless one is being routed through an outdated MitM Man-in-the-Middle HTTPS proxy.

We may be able to rule out MitM with openssl, see if the fingerprint is the same for you.

    openssl s_client -servername joinpeertube.com -connect joinpeertube.com:443 < /dev/null 2>/dev/null | openssl x509 -fingerprint -noout -in /dev/stdin
    SHA1 Fingerprint=C0:4E:F2:F6:EA:2B:72:C5:84:E0:73:2C:2C:2B:BB:FB:A1:34:C8:20

[ehutch79]

Something looks weird with dns on my end. Now I have to figure that out

[LinuxBender]

It seems China is the only place that shows a different IP for joinpeertube.org [1] Are you seeing the same IP?

[1] - https://www.whatsmydns.net/#A/joinpeertube.org