fg-web.fantasygrounds.com using self-signed and expired SSL certificate

[SharkBaitDLS]

Steps to reproduce:

Load https://fg-web.fantasygrounds.com, note that the certificate is currently for "localhost.localdomain" signed by "SomeOrganization"

This is breaking a fresh Linux install of FGU as the updater login attempts to access this domain and fails due to an SSL error.

[damned]

Welcome SharkBaitDLS

That is unusual. From what I can see that server cert has been expired a long time. Are you installing from Steam or the website installer? What version of linux are you using.
I have sent your post to the dev team.

[Elohir]

Just want to point out I am seeing the same error, and agree, self-signed certificates are NOT the way to go.

47424

[damned]

Just want to point out I am seeing the same error, and agree, self-signed certificates are NOT the way to go.

47424

Id just like to point out Im sure the reference to this server is in error or was not meant for live release.
The cert hasnt been valid in nearly four years.

[Jiminimonka]

Where is this url used? I've not got any such errors on several Linux installs.

[SharkBaitDLS]

I’ve tested with both the Steam and website installer. Brand-new installs in both cases and using the latest version of the updater. I’m on OpenSUSE Leap 15.2.

The certificate expiring a long time ago doesn’t necessarily mean this is a long-standing issue. It seems more likely the wrong certificate was mistakenly deployed since it’s for localhost, not the actual domain being served. Either that, or this is a deprecated web endpoint and the Linux updater was mistakenly changed to point at it for the login flow.

The URL is specifically hit when attempting to log in for the first time in the updater, captured via TCPDump as I was trying to figure out why the logs for FGUpdaterEngine just got SSL errors when I tried to log in.