3

I have a (private) apt repository setup on a server. I'm only allowing access to this repository over SSL, and only with a client certificate. I have tested the connection using curl:

$ curl --cacert /opt/CA.crt --cert /opt/user.crt --key /opt/user.key

https://example.com/dists/lucid/main/binary-amd64/Packages.gz The content is downloaded as expected.

I've created a file in /etc/apt/apt.conf.d/45example-com with

Debug::Acquire::https "true";

Acquire::https::example.com {
    Verify-Peer "false";
    Verify-Host "false";

    CaInfo "/opt/CA.crt";

    SslCert "/opt/user.crt";
    SslKey  "/opt/user.key";
};

I've added a file at /etc/apt/sources.list.d/example.com.list with:

deb https://example.com/ lucid main

There seems to be a problem with the CA cert, when I try an update I get the following:

> apt-get update
> * Connected to example.com (8.0.0.8) port 443 (#0)
> * found 1 certificates in /opt/CA.crt
> * error reading X.509 key or certificate file
> * Closing connection #0

The server logs on example.com show that no request got there, so I guess that apt-get is failing before trying to send the request (which matches what the log says).

I've had a hard time finding any documentation on apt-get with ssl on the interwebs, and haven't even been able to find the source code.

Does anyone have any ideas?

  • Options/Solutions discussed in thread askubuntu.com/questions/166215/… isnt helping much, I still encounter the same errors. – davidls May 25 '17 at 21:30
  • what are the file permissions on /opt/CA.crt? Are you running selinux? – cleary May 25 '17 at 22:55
  • I tried almost every possible combinations, from 755, 744, to 444 right now its 755 and no I am not running selinux – davidls May 25 '17 at 23:46
  • To add with, I could connect successfully with gnutls-cli and curl. – davidls May 25 '17 at 23:59
1

This mostly happens with a directory permission issue, apt-get is very conscious on what the permission is set for keys and cert file, so setting a mere 777 or 644 would never work.

Steps described in https://bugs.launchpad.net/ubuntu/+source/apt/+bug/1668944 was very helpful to narrow down this issue.

I did the following steps to address this,

  1. add _apt user to group ssl-cert

~# usermod -G ssl-cert _apt

  1. Change the group of certs directory

~# chgrp ssl-cert /opt/CA.crt /opt/user.crt /opt/user.key

  1. Fix the file permissions

~# chmod 655 /opt/CA.crt /opt/user.crt /opt/user.key

Also if this doesnt work for you, you can su as _apt and try to read your cert and key files, if you can then apt with client cert should work as expected.

Just to make sure if you are using self signed certificate, make sure you run

~# sudo update-ca-certificates

once you moved your ca certificate /usr/local/share/ca-certificates/

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.