My guess would be that the url you're trying to retrieve is getting redirected to https:// and at least one of the certs in the chain isn't trusted in the installation environment. The installation environment is different from the target environment; the installation environment is the temporary kernel and initrd you point to during boot, and the target environment is that kernel and file systems that actually get installed.
At the point at which the preseed/late_command is ran, the target environment is mounted at /mnt/target and to run commands there, you'll need to chroot into it via chroot /mnt/target
. Once you've done that, all commands you run will effect the target environment, not the installation environment. Now the kicker is that debconf provides you with the in-target
command which chroots to the target, runs the given command, then exits back to the installation environment. Thus:
d-i preseed/late_command string apt-get install -y htop
tries to install htop in the installation environment (not the "Finished" target environment), while:
d-i preseed/late_command string in-target apt-get install -y htop
tries to install htop in the finished target environment.
So now that we're installing to the right place, it might also be that the cert still isn't trusted, in which case you can either fix the trust issue with some more in-target
commands, then do the wget
or throw caution to the end and disable wget's trust checking with something like this:
d-i preseed/late_command string in-target wget -O /tmp/post-install.sh "https://foo.bar/postinstall.sh" --no-check-certificate; in-target chmod +x /tmp/post-install.sh; in-target /bin/bash /tmp/post-install.sh;