It's working now, see final 2 edits
There have been multiple instance recently for me where sha256sum is failing or a certificate cannot be verified. This has happened during use of wget, winetricks, and lutris. It has not happened with firefox at all.
I recently upgraded my openssl to 1.1.1c. I'm not sure if that's the cause or not.
Does anyone have any ideas on how I can fix my issue? Is there something extra I need to do after installing openssl? Or is there a way to check to make sure my certificates in /etc/ssl/certs are correct?
Two examples with wget
wget https://raw.githubusercontent.com/Winetricks/winetricks/master/src/winetricks --2019-06-25 18:56:33-- https://raw.githubusercontent.com/Winetricks/winetricks/master/src/winetricks Resolving raw.githubusercontent.com (raw.githubusercontent.com)... 220.127.116.11 Connecting to raw.githubusercontent.com (raw.githubusercontent.com)|18.104.22.168|:443... connected. ERROR: cannot verify raw.githubusercontent.com's certificate, issued by ‘CN=DigiCert SHA2 High Assurance Server CA,OU=www.digicert.com,O=DigiCert Inc,C=US’: Unable to locally verify the issuer's authority. To connect to raw.githubusercontent.com insecurely, use `--no-check-certificate'.
wget https://dl.google.com/dl/android/studio/ide-zips/22.214.171.124/android-studio-ide-183.5522156-linux.tar.gz --2019-06-25 19:08:19-- https://dl.google.com/dl/android/studio/ide-zips/126.96.36.199/android-studio-ide-183.5522156-linux.tar.gz Resolving dl.google.com (dl.google.com)... 2607:f8b0:4009:807::200e, 188.8.131.52 Connecting to dl.google.com (dl.google.com)|2607:f8b0:4009:807::200e|:443... connected. ERROR: cannot verify dl.google.com's certificate, issued by ‘CN=Google Internet Authority G3,O=Google Trust Services,C=US’: Unable to locally verify the issuer's authority. To connect to dl.google.com insecurely, use `--no-check-certificate'.
/etc/wgetrc fixed the issue with wget. I still have issues with other programs sometimes though. I'm wondering if some system link got removed when I updated openssl. I should mention I built openssl from source following the instructions on the openssl website. I did not use a package manager because the version I needed was not available there yet.
Here is an example of lutris failing to verify a certificate via python 3 urllib
2019-06-25 19:36:04,485: Error while completing task <function fetch_script at 0x7f0533fd1730>: Unable to connect to server https://lutris.net/api/installers/hearthstone-dx11-to-vulkan-dxvk: <urlopen error [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:852)> <class 'lutris.util.http.HTTPError'> Unable to connect to server https://lutris.net/api/installers/hearthstone-dx11-to-vulkan-dxvk: <urlopen error [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:852)> File "/usr/lib/python3/dist-packages/lutris/util/jobs.py", line 30, in target result = self.function(*args, **kwargs) File "/usr/lib/python3/dist-packages/lutris/installer/interpreter.py", line 56, in fetch_script request.get() File "/usr/lib/python3/dist-packages/lutris/util/http.py", line 81, in get raise HTTPError("Unable to connect to server %s: %s" % (self.url, error))
I got it working! I needed to add a system link from
This must have be deleted when I upgraded openssl
This also fixed the sha256sum issues I was having with winetricks
/usr/local/ssl/certs was never deleted. It just never existed. The old version of openssl I had looked for certs in
/usr/lib/ssl/certs. After upgrading, it was looking for them in
/usr/local/ssl/certs. I was able to check this with the command
openssl version -d