Menu

Webmin repo certificate error

Webmin
2020-09-09
2020-12-09
  • Artur Meinild

    Artur Meinild - 2020-09-09

    As of today, we get the following error when doing sudo apt update:

    Err:10 https://download.webmin.com/download/repository sarge Release                                          
      Certificate verification failed: The certificate is NOT trusted. The certificate chain uses expired certificate.  Could not handshake: Error in the certificate verification. [IP: 104.207.151.13 443]
    

    So what happened here? Also see attached image.

    Thanks.

     
  • Ilia

    Ilia - 2020-09-09

    This is a common error when ca-certificates package is missing or corrupt.

    Try installing or reinstalling it.

     
  • Artur Meinild

    Artur Meinild - 2020-09-09

    Did you see the last part of the screenshot? It also says:

    E: The repository 'https://download.webmin.com/download/repository sarge Release' no longer has a Release file.
    N: Updating from such a repository can't be done securely, and is therefore disabled by default.
    N: See apt-secure(8) manpage for repository creation and user configuration details.
    

    When I run sudo apt install ca-certificates I get:

    [sudo] password for am:
    Reading package lists... Done
    Building dependency tree
    Reading state information... Done
    ca-certificates is already the newest version (20190110ubuntu1.1).
    The following packages were automatically installed and are no longer required:
      linux-headers-5.4.0-42 linux-headers-5.4.0-42-generic linux-image-5.4.0-42-generic linux-modules-5.4.0-42-generic
      linux-modules-extra-5.4.0-42-genericUse 'sudo apt autoremove' to remove them.
    0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.
    

    Also, this happened for 2 different users on 2 different computers - what are the odds that the ca-certificates package suddenly breaks simultaneously for both??? And it was working a couple of days ago, so something must have happened in the last few days I think.

     

    Last edit: Artur Meinild 2020-09-09
  • wiesi.at

    wiesi.at - 2020-09-09

    The Lets encrypt certificate has run out

     

    Last edit: wiesi.at 2020-09-09
  • Ilia

    Ilia - 2020-09-09

    Perhaps it's a browser's cache issue? Can you try some other browser and see if you're getting the same issue?

    Is the time set on the machine in sync, by the way?

     
  • Craig Scheets

    Craig Scheets - 2020-09-09

    I created an issue on the GitHub and have verified the certificate has indeed expired with more information on the issue there. It's not a browser cache or time sync issue. Hopefully they'll have it sorted out soon.

    https://github.com/webmin/webmin/issues/1294

     
    • hansaplast

      hansaplast - 2020-09-09

      Missed that one =)

       
  • hansaplast

    hansaplast - 2020-09-09

    Same here:

    Ign:6 https://download.webmin.com/download/repository sarge InRelease                                   
    Err:7 https://download.webmin.com/download/repository sarge Release              
      Certificate verification failed: The certificate is NOT trusted. The certificate chain uses expired certificate.  Could not handshake: Error in the certificate verification. [IP: 104.207.151.13 443]
    

    Browsing to https://download.webmin.com/download/repository shows that the Lestencrypt certificate for "download.webmin.com domain" is expired.

     Validity ----------------------------
     Not Before  6/11/2020, 7:56:09 AM (Central European Summer Time)
     Not After   9/9/2020, 7:56:09 AM (Central European Summer Time)
    
     
  • rj elleray

    rj elleray - 2020-09-09

    Craig.
    Brilliant proactive help :-)
    d

     
  • hansaplast

    hansaplast - 2020-09-09

    Exactly ;-)

     
  • rj elleray

    rj elleray - 2020-09-09

    however everyone,

    when i saw the post earlier today (ilia's first response) i checked the link and the cert was ok, having been renewed 'today' so thought his ca-certificates advice was good

    it now appears to have expired.

    Is this a dateline issue ?

    Perhaps the renew period should be set to 2 months just in case ?

     

    Last edit: rj elleray 2020-09-09
  • Craig Scheets

    Craig Scheets - 2020-09-09

    The certificate expired at exactly 2020-09-09 05:56:09 UTC (a little over 12 hours ago). Certificates have a UTC expiration so it is the same for everyone and does not vary by location or time zone.

    Additionally, Let's Encrypt has a fixed length of time for which their SSL certificates are valid. It's a free service, but does require the host to request a renewed certificate periodically. If the host fails to update its certificate for any reason, events like today are what happens.

    For anyone interrested in learning more about the free certificate service Let's Encrypt offers, see here: https://letsencrypt.org/. The only way to get a certificate that lasts longer is to purchase one.

     

    Last edit: Craig Scheets 2020-09-09
  • Ilia

    Ilia - 2020-09-09

    Okay, thanks. It seems to be fixed now.

     
  • rj elleray

    rj elleray - 2020-09-09

    swicthing from opera to firefox shows the cert is ok
    'expires08 November 2020'
    Not Before
    10/08/2020, 07:01:47 (British Summer Time)
    Not After
    08/11/2020, 06:01:47 (British Summer Time)
    DNS Name
    download.webmin.com

    same pc within 10 mins opera actively used today versus new firewox session ??
    craig so it was renewed in august !

     

    Last edit: rj elleray 2020-09-09
  • Ilia

    Ilia - 2020-09-09

    Okay, please wait. There is one more mirror to sync with. We will fix it shortly..

     
  • rj elleray

    rj elleray - 2020-09-09

    mirror mirror in the cloud
    how I wish you were what i looked at a minute ago...

     
  • Artur Meinild

    Artur Meinild - 2020-09-09

    Thanks - yes I still get the error on one machine - thanks for taking care!

     
  • Ilia

    Ilia - 2020-09-09

    Okay, this time it's fixed.

     
  • Artur Meinild

    Artur Meinild - 2020-11-09

    You have certificate error on one of your Repo mirrors - again (IP: 104.207.151.13). It expired yesterday on november 8th.
    Why don't you have a script that updates the certificates automatically?

     

    Last edit: Artur Meinild 2020-11-09
  • Ilia

    Ilia - 2020-11-09

    Why don't you have a script that updates the certificates automatically?

    We do. We checked it yesterday and something was wrong. Which particular URL fails at the moment?

     
  • Ilia

    Ilia - 2020-11-09

    Okay, I see that 104.207.151.13 still fails. Darn it.

    Sorry about that.

     
  • Artur Meinild

    Artur Meinild - 2020-11-09

    It's ok - just wanted to point out. Hope you can get it all to work. Thanks. :-)

     
  • Pelican Media

    Pelican Media - 2020-12-09

    This seems to be failing on 104.207.151.13 again

    Err:7 https://download.webmin.com/download/repository sarge Release
      Certificate verification failed: The certificate is NOT trusted. The certificate issuer is unknown.  Could not handshake: Error in the certificate verification. [IP: 104.207.151.13 443]
    Reading package lists... Done
    E: The repository 'https://download.webmin.com/download/repository sarge Release' no longer has a Release file.
    N: Updating from such a repository can't be done securely, and is therefore disabled by default.
    N: See apt-secure(8) manpage for repository creation and user configuration details.
    
     

Log in to post a comment.

MongoDB Logo MongoDB