Proof Portal

Sign in
Project overview

Omarchy

ProbeLabs65 findings · 95 requirements

A proof layer — requirements, tests and verified fixes — for two of Omarchy's subsystems: the application menu (launcher scripts, QML model, JSONC config, search and selection) and the lock screen (lock scripts, QML, PAM authentication). Scope is deliberately limited to those components of omacom/omarchy; the rest of the distribution is not covered.

Inbox
ReportR-3395GitHub issuePublicReceived

OpenSSL certificate verify failed

Reported by jimmypoulsen · filed Oct 20, 2025Closed upstream on 2025-10-20 by dhh. GitHub close reason: completed. No closing PR or commit is recorded — "completed" alone is not evidence of a fix.

Open at source
Received and recorded verbatim. Nothing has been checked yet.

At a glance

1 · What is claimed?
Only the report text below — no validator has restated it as checkable claims yet.
2 · What does it affect?
Not yet mapped to any requirement or component.
3 · Is it reproducible?
No validation has been run yet.
4 · What remains unclear?
  • Not validated yet: no claims, no reproducer.
5 · What happens next?
Our staff decide whether the report is valid. Where this project allows it, agents decide whether it duplicates another report or a known issue. No decision has been recorded yet.

Original report

OpenSSL certificate verify failedrevision 1 · captured 2026-10-04 11:42 UTC via poll

System details

AMD Ryzen 7 7840U, Framework 13, Omarchy 3.1.0

What's wrong?

I run into issues with OpenSSL whenever I need to communicate with external API's like Auth0, or just some of the API's I host myself (certificates issued with Let's Encrypt):

OpenSSL::SSL::SSLError at /auth/auth0/callback SSL_connect returned=1 errno=0 peeraddr=104.17.192.231:443 state=error: certificate verify failed (unable to get certificate CRL)

I just installed Omarchy a week ago but before that I was running Ubuntu 24.04 and I didn't have this issue. From what I can understand Arch Linux ships with the latest OpenSSL version and compared to Ubuntu it's quite strict when it comes to certificate CRL's.

I’ve confirmed that:
- The system CA certificates are valid (openssl s_client -connect auth0.com:443 returns Verify return code: 0 (ok)).
- Setting verify_flags = 0 manually on the SSL context fixes it, so CRL enforcement seems to be the difference.

Reproduction Steps

ruby -v
# => ruby 3.4.4 ...
ruby -ropen-uri -e 'URI.open("https://auth0.com") { |f| puts f.status rescue puts $!.message }'
# => 200 OK

ruby -rnet/https -e 'uri=URI("https://auth0.com");Net::HTTP.start(uri.host,uri.port,use_ssl:true){|http|http.get("/")} rescue puts $!.message'
# => SSL_connect ... certificate verify failed (unable to get certificate CRL)
ComponentVersion
Ruby3.4.4 (2025-05-14 revision a38531fd3f) +PRISM [x86_64-linux]
OpenSSL3.6.0 1 Oct 2025 (Library: OpenSSL 3.6.0 1 Oct 2025)
Rails8.0.3
Omarchy3.1.0
View raw text
### System details

AMD Ryzen 7 7840U, Framework 13, Omarchy 3.1.0

### What's wrong?

I run into issues with OpenSSL whenever I need to communicate with external API's like Auth0, or just some of the API's I host myself (certificates issued with Let's Encrypt):

```
OpenSSL::SSL::SSLError at /auth/auth0/callback SSL_connect returned=1 errno=0 peeraddr=104.17.192.231:443 state=error: certificate verify failed (unable to get certificate CRL)
```

I just installed Omarchy a week ago but before that I was running Ubuntu 24.04 and I didn't have this issue. From what I can understand Arch Linux ships with the latest OpenSSL version and compared to Ubuntu it's quite strict when it comes to certificate CRL's.

I’ve confirmed that:
- The system CA certificates are valid (`openssl s_client -connect auth0.com:443` returns `Verify return code: 0 (ok)`).
- Setting `verify_flags = 0` manually on the SSL context fixes it, so CRL enforcement seems to be the difference.

## Reproduction Steps
```
ruby -v
# => ruby 3.4.4 ...
ruby -ropen-uri -e 'URI.open("https://auth0.com") { |f| puts f.status rescue puts $!.message }'
# => 200 OK

ruby -rnet/https -e 'uri=URI("https://auth0.com");Net::HTTP.start(uri.host,uri.port,use_ssl:true){|http|http.get("/")} rescue puts $!.message'
# => SSL_connect ... certificate verify failed (unable to get certificate CRL)
```


| Component              | Version                                                      |
| ---------------------- | ------------------------------------------------------------ |
| **Ruby**               | 3.4.4 (2025-05-14 revision a38531fd3f) +PRISM [x86_64-linux] |
| **OpenSSL**            | 3.6.0 1 Oct 2025 (Library: OpenSSL 3.6.0 1 Oct 2025)         |
| **Rails**              | 8.0.3                                                        |
| **Omarchy** | 3.1.0                                                        |

Validation

Not checked yet. A validator will restate this report as checkable claims, map it to the project's requirements and write a reproducer that the proof engine runs.

Linked

Not linked to any known issue, other report or change yet.

Decision

Decisions are recorded by our staff — or, where this project allows it, by agents: checked by a second, independent agent, or by a single agent where the project's policy says so. Any decision reached so far is shown below.

No decision has been recorded yet.