Can't contact EAH Servers - Peer Certificate Cannot be Authenticated...

pi@rpi0-0:~ $ curl -v https://scheduler.einsteinathome.org/EinsteinAtHome_cgi/cgi
* Hostname was NOT found in DNS cache
*   Trying 130.75.116.40...
* Connected to scheduler.einsteinathome.org (130.75.116.40) port 443 (#0)
* successfully set certificate verify locations:
*   CAfile: none
  CApath: /etc/ssl/certs
* SSLv3, TLS handshake, Client hello (1):
* SSLv3, TLS handshake, Server hello (2):
* SSLv3, TLS handshake, CERT (11):
* SSLv3, TLS alert, Server hello (2):
* SSL certificate problem: unable to get local issuer certificate
* Closing connection 0
curl: (60) SSL certificate problem: unable to get local issuer certificate
More details here: http://curl.haxx.se/docs/sslcerts.html

curl performs SSL certificate verification by default, using a "bundle"
of Certificate Authority (CA) public keys (CA certs). If the default
bundle file isn't adequate, you can specify an alternate file
using the --cacert option.
If this HTTPS server uses a certificate signed by a CA represented in
the bundle, the certificate verification probably failed due to a
problem with the certificate (it might be expired, or the name might
not match the domain name in the URL).
If you'd like to turn off curl's verification of the certificate, use
the -k (or --insecure) option.

Since I can show BOINC/EAH working fine before doing an apt-get update/upgrade, I'm going to guess it came in the update, which I realize that is very unusual.

By chance, can anyone download the 11/21/2015-jessie lite image, install it, and do an apt-get update/upgrade to verify that the ca-certificates v20141019+deb8u1 gets installed and breaks boinc? I can reliably reproduce the error, but I'd like to see if someone else can.

I haven't tried stretch because again, I had heard that there was an issue as they were updating libc that broke the EAH application (read about this in the parallella thread).

Here's the output from rpi2-3, which is running stock jessie more or less.

First, the curl output

pi@rpi2-3:~ $ curl -v https://scheduler.einsteinathome.org/EinsteinAtHome_cgi/cg                                     i
* Hostname was NOT found in DNS cache
*   Trying 130.75.116.40...
* Connected to scheduler.einsteinathome.org (130.75.116.40) port 443 (#0)
* successfully set certificate verify locations:
*   CAfile: none
  CApath: /etc/ssl/certs
* SSLv3, TLS handshake, Client hello (1):
* SSLv3, TLS handshake, Server hello (2):
* SSLv3, TLS handshake, CERT (11):
* SSLv3, TLS handshake, Server key exchange (12):
* SSLv3, TLS handshake, Server finished (14):
* SSLv3, TLS handshake, Client key exchange (16):
* SSLv3, TLS change cipher, Client hello (1):
* SSLv3, TLS handshake, Finished (20):
* SSLv3, TLS change cipher, Client hello (1):
* SSLv3, TLS handshake, Finished (20):
* SSL connection using TLSv1.2 / ECDHE-RSA-AES128-GCM-SHA256
* Server certificate:
*        subject: C=US; ST=Wisconsin; L=Milwaukee; O=University of Wisconsin-Mil                                     waukee; OU=Physics; CN=www.einsteinathome.org
*        start date: 2015-12-11 00:00:00 GMT
*        expire date: 2018-12-10 23:59:59 GMT
*        subjectAltName: scheduler.einsteinathome.org matched
*        issuer: C=US; O=thawte, Inc.; CN=thawte SSL CA - G2
*        SSL certificate verify ok.
> GET /EinsteinAtHome_cgi/cgi HTTP/1.1
> User-Agent: curl/7.38.0
> Host: scheduler.einsteinathome.org
> Accept: */*
>

611
http://einstein.phys.uwm.edu/
60.000000
Error in request message: no start tag
Einstein@Home

* Connection #0 to host scheduler.einsteinathome.org left intact

Next, ca-certificates version

pi@rpi2-3:~ $ sudo apt-cache policy ca-certificates
ca-certificates:
  Installed: 20141019
  Candidate: 20141019+deb8u1
  Version table:
     20141019+deb8u1 0
        500 http://mirrordirector.raspbian.org/raspbian/ jessie/main armhf Packages
 *** 20141019 0
        100 /var/lib/dpkg/status

I am interested in trying either forbidding an upgrade to ca-certificates or installing the version from the test stream.

Right now, the only node I don't really want to fool with rolling back is rpi0-0, which is currently broken due to ca-certs and is the master node w/ the correct network setup. I will try to get the testing version of ca-certs installed there though. I can blow the rest of my Zeros away and test whatever as I have time.