13

When I want to upgrade Ubuntu from 18.04 Bionic Beaver to 18.10 to Cosmic Cuttlefish via terminal with sudo do-release-upgrade -d command it gives me warning:

Failed to connect to https://changelogs.ubuntu.com/meta-release-development. 
Check your Internet connection or proxy settings.

However I have internet connection, I write this question now from my Ubuntu computer.

How can I resolve this?

0

3 Answers 3

18

It seems like there is an issue about certificates:

result of meta-release download: <urlopen error [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:841)>

As a workaround, I edited the file /usr/lib/python3/dist-packages/UpdateManager/Core/MetaRelease.py and added these lines to the beginning:

import ssl
ssl._create_default_https_context = ssl._create_unverified_context
5
  • Why would that work?
    – alvas
    Mar 1, 2019 at 1:45
  • 1
    @alvas I'm not sure why but I figured out that in my case SSL verification failed. So I applied the workaround to skip SSL verification. Mar 1, 2019 at 6:34
  • 1
    For months I've been seeing this in my 18.04.4 LTS release, and alas it didn't fix itself as 20.04 LTS became available today. I searched everywhere, including in #ubuntu on freenode. Finally this solution worked. Thank you.
    – DavidO
    Apr 23, 2020 at 18:38
  • This fixed it for me on the corporate network that MITMs SSL connections
    – Neil Twist
    Jul 24, 2020 at 14:08
  • This is highly insecure, as it disables SSL certificate validation. The solution described in the other answer is much better as it fixes the underlying issue.
    – fly.floh
    Nov 3, 2021 at 18:37
10

The problem is the used ca:

$ python3 -c 'import ssl; print(ssl.get_default_verify_paths().openssl_cafile)'
/usr/lib/ssl/cert.pem

But:

$ ll /usr/lib/ssl/cert.pem
ls: cannot access '/usr/lib/ssl/cert.pem': No such file or directory

You can fix it by linking the global ca-certificates to the file Python uses:

ln -s /etc/ssl/certs/ca-certificates.crt /usr/lib/ssl/cert.pem

After that running do-release-upgrade works just fine.

For a temporary solution:

SSL_CERT_FILE=/etc/ssl/certs/ca-certificates.crt do-release-upgrade
2
  • This fixed the issue. one simple symlink. I tried upgrading from 16.04 to the current release, and this fixed the updating process. without having to hack the python file. Feb 2, 2021 at 21:36
  • Thanks for this. On 20.04 I had to run sudo update-ca-certificates then link to /usr/local/ssl/cert.pem rather than /usr/lib/ssl/cert.pem, as guided by the output of the python query. Can't account for why /usr/local... rather than /usr/lib.... Aug 27 at 1:50
4

This is an Ubuntu bug that has been fixed, but I'm not sure if the patch will be available in updates for 18.04.2 LTS.

From 2018:

update-manager (1:18.10.3) cosmic; urgency=medium

  • Add support for HTTPS proxies; this breaks UpdateManager.Core.utils.init_proxy() API - the return value is now a dict, rather than a string (LP: #1771914).
    ...
    The verification of the Stable Release Update for update-manager has completed successfully and the package has now been released to -updates.
1
  • I had a version > 18.04.2 (Ubuntu 18.04.5 LTS) however still it did not work. Above solution of updating MetaRelease.py fixed it. Aug 28, 2020 at 16:03

Not the answer you're looking for? Browse other questions tagged or ask your own question.