Error using gnus with gmane

Question

I'm trying to set up gnus for reading mailing lists.

According to some threads I have the following in my init.el

(setq user-mail-address "myname@domain.org")
(setq user-full-name "my name")

(setq gnus-select-method
             '(nntp "news.gmane.org"
                     (nntp-open-connection-function nntp-open-tls-stream)
                     (nntp-port-number 563)
                     (nnir-search-engine gmane)
                     ))

But running M-x gnus results in:

Warning: Opening nntp server on news.gmane.org...failed: >>> (error
Certificate validation failed news.gmane.org, verification code 42);
Server nntp+news.gmane.org previously determined to be down; not
retrying

Do I do something wrong or is gmane down?

Answer 1

Since 2018-01-12 (about half a year as I write this), the certificate for news.gmane.org has been expired.

% gnutls-cli --crlf news.gmane.org -p nntps <<<QUIT
Processed 148 CA certificate(s).
Resolving 'news.gmane.org:nntps'...
Connecting to '195.159.176.226:563'...
- Certificate type: X.509
- Got a certificate list of 1 certificates.
- Certificate[0] info:
 - subject `CN=news.gmane.org,O=Gmane,ST=Some-State,C=NO', issuer `CN=news.gmane.org,O=Gmane,ST=Some-State,C=NO', serial 0x009398630d3ab6ffd6, RSA key 1024 bits, signed using RSA-SHA1, activated `2015-01-13 21:13:46 UTC', expires `2018-01-12 21:13:46 UTC', pin-sha256="V/d+/hePkSL5MylBGzvZ/c21qMz+E9H1SfyP1NKBr1Y="
        Public Key ID:
                sha1:d21a01452b5a9b06106946930e64717869ff7ae0
                sha256:57f77efe178f9122f93329411b3bd9fdcdb5a8ccfe13d1f549fc8fd4d281af56
        Public Key PIN:
                pin-sha256:V/d+/hePkSL5MylBGzvZ/c21qMz+E9H1SfyP1NKBr1Y=
        Public key's random art:
                +--[ RSA 1024]----+
                |=O+.ooo          |
                |+*o+ . .         |
                |= + + o          |
                | . + = o         |
                |  . + + S        |
                |   . . =         |
                |    . +          |
                |     E .         |
                |      .          |
                +-----------------+

- Status: The certificate is NOT trusted. The certificate issuer is unknown. The certificate chain uses expired certificate.
*** PKI verification of server certificate failed...
*** Fatal error: Error in the certificate.
*** handshake has failed: Error in the certificate.

January 2018 is after you posed this question, but this (less than ideal) workaround still applies: do not connect to Gmane with a secure connection.

(setq gnus-select-method
      '(nntp "news.gmane.org"
             (nntp-open-connection-function nntp-open-plain-stream)))