#5515 apt-key doesn't work on ubuntu 21.04 and 21.10
Hello, I tried installing webmin on ubuntu 21.04 and 21.10.
I tried the
apt-key add jcameron-key.asc
Warning: apt-key is deprecated. Manage keyring files in trusted.gpg.d instead (see apt-key(8)).
OKfollowed by the
apt-get update
Hit:1 http://us.archive.ubuntu.com/ubuntu impish InRelease
Get:2 http://us.archive.ubuntu.com/ubuntu impish-updates InRelease [90.7 kB]
Get:3 http://security.ubuntu.com/ubuntu impish-security InRelease [90.7 kB]
Hit:4 http://us.archive.ubuntu.com/ubuntu impish-backports InRelease
Ign:5 https://download.webmin.com/download/repository sarge InRelease
Ign:5 https://download.webmin.com/download/repository sarge InRelease
Ign:5 https://download.webmin.com/download/repository sarge InRelease
Err:5 https://download.webmin.com/download/repository sarge InRelease
Certificate verification failed: The certificate is NOT trusted. The certificate issuer is unknown. The certificate chain uses expired certificate. Could not handshake: Error in the certificate verification. [IP: 104.207.151.13 443]
Fetched 181 kB in 8s (22.4 kB/s)
Reading package lists... Done
W: Failed to fetch https://download.webmin.com/download/repository/dists/sarge/InRelease Certificate verification failed: The certificate is NOT trusted. The certificate issuer is unknown. The certificate chain uses expired certificate. Could not handshake: Error in the certificate verification. [IP: 104.207.151.13 443]
W: Some index files failed to download. They have been ignored, or old ones used instead.
gets certificate expired error.
I tried using the alternate way of using gpg keys instead of the apt-key way. But I get the same error.
Any suggestions or any updates needed to the **jcameron-key.asc **
Thanks in advance
Anand K.
By the way here is what I did for APT key replacement. May be the install instructions need to be updated as soon apt-key will be removed in the subsequent ubuntu releases.
Create a keyring directory that only root has access.
De armor the gpg ascii key and save it the above directory
Now create webmin.list file to sources
and add the following to the webmin.list file
Last edit: ak ak 2021-10-18
Thanks for reporting this. Is there no simpler replacement for the apt-key command that can do all those steps? It seems suprising that it would be so hard to add a custom key ..
FYI, it still gets the same error after doing the above.
Is it actually complaining about the SSL certificate for download.webmin.com ?
Yep, looks like it. That IP in the error message is download.webmin.com.
So probably not the issue with pgp key.
I think the issue is that the
aptcommand on your system isn't recognizing the SSL CA that the cert for download.webmin.com is signed with.Do you get errors accessing that site in your browser?
I can access it via browser as well as wget. As you can see downloading jcameron-key.asc worked fine.
I think the problem you're seeing is this : https://serverfault.com/questions/1079199/client-on-debian-9-erroneously-reports-expired-certificate-for-letsencrypt-issue
I dont think that is the issue.
curl -v https://download.webmin.com/ was successful.
I guess you can just install a ubuntu 21.04 as VM and test it, you probably will see what the real issue is. I cant really figure it out.
Last edit: ak ak 2021-10-21
Its finally working. I think it might be openjdk-8-headless install that installed java cacerts. Just guessing.
OK, great! I know some other people ran into this issue recently with certain SSL implementations due to a change in the Let's Encrypt CA cert that I don't fully understand.
Another thing looks like this works now..
apt-get install webmin --fix-missing--fix-missing installed the following missing packages
libauthen-pam-perl libio-pty-perl