ubuntu-ports focal 证书过期

[meta-inf]

发生了什么（What happened）

在 Ubuntu 20.04 (arm64) 上 apt update 产生证书错误:

$ sudo apt update
Ign:1 https://mirrors.tuna.tsinghua.edu.cn/ubuntu-ports focal InRelease
Ign:2 https://mirrors.tuna.tsinghua.edu.cn/ubuntu-ports focal-updates InRelease
Ign:3 https://mirrors.tuna.tsinghua.edu.cn/ubuntu-ports focal-backports InRelease
Ign:4 https://mirrors.tuna.tsinghua.edu.cn/ubuntu-ports focal-security InRelease
Err:5 https://mirrors.tuna.tsinghua.edu.cn/ubuntu-ports focal Release
  Certificate verification failed: The certificate is NOT trusted. The certificate chain uses expired certificate.  Could not handshake: Error in the certificate verification. [IP: 2402:f000:1:400::2 443]
Err:6 https://mirrors.tuna.tsinghua.edu.cn/ubuntu-ports focal-updates Release
  Certificate verification failed: The certificate is NOT trusted. The certificate chain uses expired certificate.  Could not handshake: Error in the certificate verification. [IP: 2402:f000:1:400::2 443]
Err:7 https://mirrors.tuna.tsinghua.edu.cn/ubuntu-ports focal-backports Release
  Certificate verification failed: The certificate is NOT trusted. The certificate chain uses expired certificate.  Could not handshake: Error in the certificate verification. [IP: 2402:f000:1:400::2 443]
Err:8 https://mirrors.tuna.tsinghua.edu.cn/ubuntu-ports focal-security Release
  Certificate verification failed: The certificate is NOT trusted. The certificate chain uses expired certificate.  Could not handshake: Error in the certificate verification. [IP: 2402:f000:1:400::2 443]

期望的现象（What you expected to happen）

apt update 正常运行.

如何重现（How to reproduce it）

sudo apt update

其他事项（Anything else we need to know）

• 该问题是否被之前的 issue 提出过：否

您的环境（Environment）

• 操作系统（OS Version）：Ubuntu 20.04.2 (arm64)
• 浏览器（如果适用）（Browser version, if applicable）：N/A
• 其他（Others）：

[makeding]

可以看看系统时间？

复现成功
Err:8 https://mirrors.tuna.tsinghua.edu.cn/ubuntu-ports focal Release
Certificate verification failed: The certificate is NOT trusted. The certificate chain uses expired certificate. Could not handshake: Error in the certificate verification. [IP: 101.6.15.130 443]
Err:9 https://mirrors.tuna.tsinghua.edu.cn/ubuntu-ports focal-security Release
Certificate verification failed: The certificate is NOT trusted. The certificate chain uses expired certificate. Could not handshake: Error in the certificate verification. [IP: 101.6.15.130 443]
Err:10 https://mirrors.tuna.tsinghua.edu.cn/ubuntu-ports focal-updates Release
Certificate verification failed: The certificate is NOT trusted. The certificate chain uses expired certificate. Could not handshake: Error in the certificate verification. [IP: 101.6.15.130 443]
Err:11 https://mirrors.tuna.tsinghua.edu.cn/ubuntu-ports focal-backports Release
Certificate verification failed: The certificate is NOT trusted. The certificate chain uses expired certificate. Could not handshake: Error in the certificate verification. [IP: 101.6.15.130 443]
Err:12 https://mirrors.tuna.tsinghua.edu.cn/mongodb/apt/ubuntu focal/mongodb-org/4.4 Release
Certificate verification failed: The certificate is NOT trusted. The certificate chain uses expired certificate. Could not handshake: Error in the certificate verification. [IP: 101.6.15.130 443]

[makeding]

推测是 let's encrypt 的 DST Root CA X3 不再被系统信任（过期了）
参考此篇文章
解决方法：
先使用 http 源，然后再执行 apt upgrade 更新 ca-certificates 即可解决。

[shankerwangmiao]

确实是由于 LE 此前的交叉根 DST Root CA X3 于今天（30 日）22 时许过期所致。请按下表升级相应包后即可修复：

Ubuntu 版本	openssl	gnutls	ca-certificates
Precise(12.04)		官方不提供修复
Trusty (14.04)	请等待官方修复	官方不提供修复	在 ESM 中修复
Xenial (16.04)	libssl1.0.0 1.0.2g-1ubuntu4.20 以上	libgnutls30 3.4.10-4ubuntu1.9 以上	ca-certificates 20210119~16.04.1 以上
Bionic (18.04)		libgnutls30 3.5.18-1ubuntu1.5 以上	ca-certificates 20210119~18.04.2 以上
Focal (20.04)		请等待官方修复	ca-certificates 20210119~20.04.2 以上

Debian 版本	openssl	gnutls	ca-certificates
Stretch	libssl1.0.0 1.0.2u-1~deb9u5 以上	libgnutls30 3.5.8-5+deb9u6 以上
Buster		libgnutls30 3.6.7-4+deb10u5 以上

Rhel/CentOS 版本	ca-certificates
8	ca-certificates-2021.2.50-80.0.el8_4 以上
7	ca-certificates-2021.2.50-72.el7_9 以上
6	ca-certificates-2021.2.50-60.1.el6_10 以上

如果您获取软件包有困难，可以采用下列措施临时处理该问题：

trust dump --filter "pkcs11:id=%c4%a7%b1%a4%7b%2c%71%fa%db%e1%4b%90%75%ff%c4%15%60%85%89%10" | openssl x509 | sudo tee /etc/pki/ca-trust/source/blacklist/DST-Root-CA-X3.pem
sudo update-ca-trust extract

[skyzh]

如果您获取软件包有困难，可以采用下列措施临时处理该问题：

trust dump --filter "pkcs11:id=%c4%a7%b1%a4%7b%2c%71%fa%db%e1%4b%90%75%ff%c4%15%60%85%89%10" | openssl x509 | sudo tee /etc/pki/ca-trust/source/blacklist/DST-Root-CA-X3.pem
sudo update-ca-trust extract

换 http 就行了吧（思考

[sandyzikun]

根据上面所说的，，，

我原本apt包中的ca-certificates就是20210119版本的：

$ apt list | grep ca-certificates
WARNING: apt does not have a stable CLI interface. Use with caution in scripts.

ca-certificates-java/focal 20190405ubuntu1 all
ca-certificates-mono/focal 6.8.0.105+dfsg-2 all
ca-certificates/focal-updates,focal-security,now 20210119~20.04.2 all [installed,automatic]

刚才我把conda包的也更新到了2021.01.19版本：

$ conda install ca-certificates==2021.01.19
...

$ conda list | grep ca-certificates
ca-certificates           2021.1.19            h06a4308_1    defaults

然后我再次尝试用conda连接镜像站，结果还是返回

CondaHTTPError: HTTP 000 CONNECTION FAILED for url <https://mirrors.tuna.tsinghua.edu.cn/anaconda/pkgs/msys2/noarch/repodata.json>
Elapsed: -

An HTTP error occurred when trying to retrieve this URL.
HTTP errors are often intermittent, and a simple retry will get you on your way.
SSLError(MaxRetryError('HTTPSConnectionPool(host=\'mirrors.tuna.tsinghua.edu.cn\', port=443): Max retries exceeded with url: /anaconda/pkgs/msys2/noarch/repodata.json (Caused by SSLError(SSLError("bad handshake: Error([(\'SSL routines\', \'ssl3_get_server_certificate\', \'certificate verify failed\')])")))'))

我的环境是 Ubuntu(server)-20.04 with Anaconda-5.3.1 on VirtualBox-6.0.4 （本体是win10

请问这是正常的吗？如若不是正常的话，请问问题出在哪里了呢？

[wllenyj]

trust dump --filter "pkcs11:id=%c4%a7%b1%a4%7b%2c%71%fa%db%e1%4b%90%75%ff%c4%15%60%85%89%10" | openssl x509 | sudo tee /etc/pki/ca-trust/source/blacklist/DST-Root-CA-X3.pem
sudo update-ca-trust extract

系统：Centos7，使用该方法可以解决问题。

提示：certificate has expired.
使用上面命令解决：

trust dump --filter "pkcs11:id=%c4%a7%b1%a4%7b%2c%71%fa%db%e1%4b%90%75%ff%c4%15%60%85%89%10" | openssl x509 | sudo tee /etc/pki/ca-trust/source/blacklist/DST-Root-CA-X3.pem
sudo update-ca-trust extract

提示：unable to get local issuer certificate
使用：yum install ca-certificates 解决。