4

I am currently trying to develop gstreamer plugins by using gstreamer-development library as instructed in:

http://docs.gstreamer.com/display/GstSDK/Installing+the+SDK

I have an Ubuntu 14.04 installed PC, and tried to install the library via the following instructions:

wget -q -O - http://www.freedesktop.org/software/gstreamer-sdk/sdk.gpg | sudo apt-key add - sudo apt-get update

I got the following error:

Err http://www.freedesktop.org ./ Packages
  server certificate verification failed. CAfile: /etc/ssl/certs/ca-certificates.crt CRLfile: none
Ign http://www.freedesktop.org ./ Translation-en_US
Ign http://www.freedesktop.org ./ Translation-en
W: Failed to fetch http://www.freedesktop.org/software/gstreamer-sdk/data/packages/ubuntu/raring/amd64/./Packages  server certificate verification failed. CAfile: /etc/ssl/certs/ca-certificates.crt CRLfile: none

E: Some index files failed to download. They have been ignored, or old ones used instead.

In order to get rid of certificate errors, I searched it but this thread is so "gitlab" specific and was not useful:

server certificate verification failed. CAfile: /etc/ssl/certs/ca-certificates.crt CRLfile: none

I could not manage to find to instruct apt-get update utility to ignore when my source is not certified. Maybe my problem is not gstreamer-dev specific, apt-get specific.

Another note: A few days ago, I did this installation without a problem. Something may have changed.

Best regards,

fercis

Community
  • 1
  • 1
fercis
  • 611
  • 2
  • 12
  • 26

2 Answers2

2

You shouldn't need to disable the certificate verification, but one situation where I have had to do this is when adding a new local repository, whose certificates package is stored on the same server (yes, a chicken-and-egg situation). For that, you can disable the peer verification using the APT option Acquire::https::Verify-Peer=false, as documented in the apt-transport-https(1) man page.

Example:

apt-get -q2 -y install --no-install-recommends    \
        -o Acquire::https::Verify-Peer=false      \
             ca-certificates-example.com

Obviously, ensure the server really is under your control, and don't simultaneously disable signature checking on the packages.

Toby Speight
  • 27,591
  • 48
  • 66
  • 103
1

Either you don't have the right CA certificates installed (they should be there by default in ubuntu 14.04), or something is intercepting your traffic.

The error is likely a correct result in this case. You can get more information about the cert by running:

openssl s_client -CAfile /etc/ssl/certs/ca-certificates.crt -showcerts -connect www.freedesktop.org:443 < /dev/null

This should give you all the certs served by freedesktop and end in Verify return code: 0 (ok). If it doesn't, look into that specific error.

The output should start with:

depth=2 O = Digital Signature Trust Co., CN = DST Root CA X3
verify return:1
depth=1 C = US, O = Let's Encrypt, CN = Let's Encrypt Authority X3
verify return:1
depth=0 CN = www.freedesktop.org
verify return:1
viraptor
  • 33,322
  • 10
  • 107
  • 191
  • It seems like Verify return code: 1. As I said, I found the pc I installed a few days ago and copy all the files under /opt/gstreamer-sdk to my new pc - manual install, it worked :/ But I did not undertstand – fercis May 12 '16 at 13:28
  • I have this same problem. However, my verify return code is 0 (OK). Is it because we're running on 14.04 and trying to install a package corresponding to 13.04? – nirvanaswap May 12 '16 at 19:46
  • @nirvanaswap no, that's irrelevant to the issue with https connection – viraptor May 12 '16 at 23:42
  • @fercis Does your output start with the same certificates as mine? (see updated answer) If not, are you behind a corporate web proxy by any chance? – viraptor May 12 '16 at 23:45
  • @viraptor Yes, my output is exactly the same as in the updated answer. I am connecting the pc to internet by usb tethering utility of my android phone, without any proxy setting – fercis May 13 '16 at 06:55
  • No idea then, sorry. "this should work" :) If you want to debug it, learn about certificate chains and `update-ca-certificates`, but it's too long to really describe in this answer. – viraptor May 13 '16 at 07:18