SSL certificate problem with Miniconda?

[harvey012]

🏷️ Discussion Type

Question

💬 Feature/Topic Area

Actions Runner Image

Discussion Details

I'm having a continued issue with getting ubuntu-22_04.azure-arm.image to build it's constantly failing on /scripts/build/install-miniconda.sh after around 30. I get a curl: (60) SSL certificate problem: unable to get local issuer certificate error every time, going on for weeks now. Has anyone else experienced this issue and can give me some advice? It's always the same package, the vm is running in a subnet with no ssl inspection, and it's unrestricted.

I'm very new to using these runner-images so apologies, I have a lot of missing knowledge

Error message:

==> ubuntu-22_04.azure-arm.image: Running tests.
==> ubuntu-22_04.azure-arm.image:
==> ubuntu-22_04.azure-arm.image: Running tests from '/imagegeneration/tests/Tools.Tests.ps1'
==> ubuntu-22_04.azure-arm.image: Describing Leiningen
==> ubuntu-22_04.azure-arm.image: [+] leiningen 916ms (867ms|49ms)
==> ubuntu-22_04.azure-arm.image: Tests completed in 2.2s
==> ubuntu-22_04.azure-arm.image: Tests Passed: 1, Failed: 0, Skipped: 0, Inconclusive: 0, NotRun: 81
==> ubuntu-22_04.azure-arm.image: Provisioning with shell script: /azp/_work/1/s/runner-images/images/ubuntu/templates/../scripts/build/install-miniconda.sh
==> ubuntu-22_04.azure-arm.image: curl: (60) SSL certificate problem: unable to get local issuer certificate
==> ubuntu-22_04.azure-arm.image: More details here: https://curl.se/docs/sslcerts.html
==> ubuntu-22_04.azure-arm.image:
==> ubuntu-22_04.azure-arm.image: curl failed to verify the legitimacy of the server and therefore could not
==> ubuntu-22_04.azure-arm.image: establish a secure connection to it. To learn more about this situation and
==> ubuntu-22_04.azure-arm.image: how to fix it, please visit the web page mentioned above.
==> ubuntu-22_04.azure-arm.image: CONDA=/usr/share/miniconda

[adityassarode]

I havent hit this exact issue, but a curl (60) error is usually a certificate trust problem rather than the package itself. Since its always failing on the Miniconda step, I'd try manually downloading the same URL from the VM and checking the certificate chain. Might also be worth verifying the VM time and CA certificates just to rule those out. The fact that it fails at the same place every time makes me think something in the environment is blocking or not trusting the certificate rather than a random build failure.

[Luke-Corwin]

The error is occurring during Miniconda download, not during the runner image build logic itself.

curl: (60) SSL certificate problem: unable to get local issuer certificate usually indicates one of the following:

• Missing or outdated CA certificate bundle on the build VM
• Corporate proxy or SSL inspection device replacing certificates
• Incomplete certificate chain being presented by an intermediate proxy
• Custom networking/security appliance modifying TLS traffic

Things I’d check:

1. Verify CA certificates are installed and up to date:

sudo apt update
sudo apt install --reinstall ca-certificates
sudo update-ca-certificates

2. Test the download URL manually:

curl -v https://repo.anaconda.com/

3. Check which certificate chain is being presented:

openssl s_client -connect repo.anaconda.com:443 -showcerts

4. Compare behavior from:
   • the failing subnet
   • a public network
   • a fresh Ubuntu 22.04 VM

Since you mention the issue started recently and consistently fails at the same step, I’d also check whether the Miniconda endpoint certificate chain changed and whether the image-generation environment has an outdated trust store.

Can you provide:

• runner-images commit/version
• whether this is Azure ARM image generation or self-hosted image generation
• output of curl -v https://repo.anaconda.com

That would help narrow it down.