4

The problem

When I do an update of apt repository, I have an issue about "Certificate verification failed" for HTTPS repository. For example:

Err:4 https://mirror.transip.net/ubuntu/ubuntu bionic Release
  Certificate verification failed: The certificate is NOT trusted. The certificate issuer is unknown.  Could not handshake: Error in the certificate verification. [IP: 149.210.210.109 443]
Err:10 https://mirror.vorboss.net/ubuntu-archive bionic Release
  Certificate verification failed: The certificate is NOT trusted. The certificate issuer is unknown.  Could not handshake: Error in the certificate verification. [IP: 5.10.147.2 443]
Reading package lists... Done
W: https://mirror.transip.net/ubuntu/ubuntu/dists/bionic/InRelease: No system certificates available. Try installing ca-certificates.

This problem arrives with all repositories (all the repo I tried).

Of course, I update the ca-certificates but it looks like apt doesn't read certificate from /etc/ssl/certs

# update-ca-certificates --fresh
Clearing symlinks in /etc/ssl/certs...
done.
Updating certificates in /etc/ssl/certs...
133 added, 0 removed; done.
Running hooks in /etc/ca-certificates/update.d...
done.

Can you have an idea to resolve the problem ?

Thanks in advance !

Tests

I tested if the certificates were well installed. So I done call the curl and openssl to test the HTTPS repository

# curl https://mirror.transip.net/ubuntu/ubuntu/dists/bionic/Release
Acquire-By-Hash: yes

# openssl s_client -CAfile /etc/ssl/certs/ca-certificates.crt -connect mirror.transip.net:443 < /dev/null
SSL handshake has read 6107 bytes and written 446 bytes
Verification: OK

With these 2 tests we can see the certificates are ok

Info

My OS is Ubuntu 18.04.4 LTS (Bionic Beaver)

Improve this question
0

2 Answers 2

Reset to default
2

Very odd, try reinstalling ca-certificates.

sudo apt install --reinstall ca-certificates

If that doesn't work, you can find the files that have the problematic servers, and add [trusted=yes] to get around the verificatin test, like so:

deb [trusted=yes] https://yaddayadda.com stuff goes on here

Improve this answer
4
  • Hello, I tried these 2 fix but it doesn't change the error, the problem is still present deb [trusted=yes] https://mirror.transip.net/ubuntu/ubuntu bionic Release Certificate verification failed: The certificate is NOT trusted. The certificate issuer is unknown. Could not handshake: Error in the certificate verification. [IP: 149.210.210.109 443]
    – Flochon
    Apr 22, 2020 at 6:21
  • 1
    @Flochon could you try doing this: sudo dpkg-reconfigure ca-certificates If that doesn't work you might try turning off verification at the apt config level. Add Acquire::https::mirror.transip.net::Verify-Peer "false"; and Acquire::https::mirror.vorboss.net::Verify-Peer "false"; Hope it at least gets you back up.
    – NiteRain
    Apr 22, 2020 at 15:33
  • it's working well with "Verify-Peer" to false ! Doesn't this fix add a security leak ? Thanks !
    – Flochon
    Apr 23, 2020 at 6:17
  • Yeah it is, since reinstall ca-certificates didn't work. Then you would have to manually install the ca-root cert yourself for all the domains giving you a problem. Just locate the ca-root certificates you need and place them in the /etc/ssl/certs I think you can also pick these locations as well /usr/share/ca-certificates, /usr/local/share/ca-certificates, and then type update-ca-certificates and that should fix your problem, if it doesn't then I think you might have to go through your certs and see if something is messing you up. Make sure they are crt files, might have to convert if not.
    – NiteRain
    May 7, 2020 at 15:07
0

Not recommended, but as a work-around, try changing your apt/sources.list

from 'deb https://...' to 'deb http://...'

e.g. Without the 's'

This will let apt use the standard http port 80 instead of the https port 443.

Improve this answer

Not the answer you're looking for? Browse other questions tagged .