Cannot install packages on oraclelinux:8(-slim)

[danslapman]

I'm trying to install unzip and can't get (micro)dnf working:

docker run -it --entrypoint sh oraclelinux:8
sh-4.4# dnf install unzip
Oracle Linux 8 BaseOS Latest (x86_64)                                                                                           0.0  B/s |   0  B     00:00    
Errors during downloading metadata for repository 'ol8_baseos_latest':
  - Curl error (60): Peer certificate cannot be authenticated with given CA certificates for https://yum.oracle.com/repo/OracleLinux/OL8/baseos/latest/x86_64/repodata/repomd.xml [SSL certificate problem: unable to get local issuer certificate]
Error: Failed to download metadata for repo 'ol8_baseos_latest': Cannot download repomd.xml: Cannot download repodata/repomd.xml: All mirrors were tried

docker run -it --entrypoint sh oraclelinux:8-slim
sh-4.4# microdnf install unzip
Downloading metadata...
error: cannot update repo 'ol8_baseos_latest': Cannot download repomd.xml: Cannot download repodata/repomd.xml: All mirrors were tried; Last error: Curl error (60): Peer certificate cannot be authenticated with given CA certificates for https://yum.oracle.com/repo/OracleLinux/OL8/baseos/latest/x86_64/repodata/repomd.xml [SSL certificate problem: unable to get local issuer certificate]

I can access https://yum.oracle.com/repo/OracleLinux/OL8/baseos/latest/x86_64/repodata/repomd.xml with no problem

[tvierling]

From inside the container, do this:

curl -vkI https://yum.oracle.com/

to see what it shows for the Server certificate. It should show subject and issuer as:
* subject: C=US; ST=California; L=Redwood Shores; O=Oracle Corporation; CN=yum.oracle.com
* issuer: C=US; O=DigiCert Inc; CN=DigiCert SHA2 Secure Server CA

If either of these do not match, then your network has a transparent proxy intercepting TLS connections and rewriting the certificate.

If you see a different certificate, the reason you don't seem to have a problem connecting via a browser or other application on your host system is because the host has a custom certificate installed to trust the proxy. OL's dnf tool absolutely requires end-to-end security and will reject a transparent proxy certificate.

[danslapman]

Sorry, my VPN caused that 😔 my bad