0

I'm setting up a Kubernetes cluster and as part of that, I ran the following command (mentioned on official docs: https://kubernetes.io/docs/tasks/tools/install-kubectl/) :

sudo apt-get update && sudo apt-get install -y apt-transport-https

However, it fails with the following error:

Err:3 https://packages.cloud.google.com/apt kubernetes-xenial/main amd64 Packages
  server certificate verification failed. CAfile: /etc/ssl/certs/ca-certificates.crt CRLfile: none

Now, I fetch the certificate with this command :

ex +'/BEGIN CERTIFICATE/,/END CERTIFICATE/p' <(echo | openssl s_client -showcerts -connect packages.cloud.google.com:443) -scq > kubecertificate.crt

I get the following response :

verify error:num=20:unable to get local issuer certificate
DONE

But since I see content inside my kubecertificate.crt file , I go ahead and copy the certificate in /usr/local/share/ca-certificates/ directory.

Then I run:

update-ca-certificates

After updating my ca certificates bundle, I re run the first command mentioned.

It again fails with the server certificate verification failed error.

Please help me understand where am I going wrong? Is it because I'm unable to get the local issuer certificate? Please help.

pep8
  • 371
  • 3
  • 18

1 Answers1

0

Are you using i386 image or is there some firewall involved? If it is 64bit version of Xenial then it must be some kind of system issue.

Take a look at this case. Especially I would check the current system time date -R and apt-get install NTP as advised by @davidthings as I remember having similar problem. There is also a lot of different solutions which could help, listed in the linked case - check which one is applicable for your and update if you succeeded.

After that you can try with this, to download kubectl, kubelet and kubeadm (or edit it accordingly if you want just one)

curl -s https://packages.cloud.google.com/apt/doc/apt-key.gpg | apt-key add - cat <<EOF >/etc/apt/sources.list.d/kubernetes.list deb http://apt.kubernetes.io/ kubernetes-xenial main EOF sudo apt-get update sudo apt-get install -y kubelet kubeadm kubectl

aurelius
  • 3,433
  • 1
  • 13
  • 22
  • So, none of it worked... but finally I was able to get things working with the help of a SSL decryption certificate issued by my organization. I added it to my CA bundle and updated it. – pep8 Dec 12 '18 at 20:33
  • so some kind of proxy server from company side? – aurelius Dec 12 '18 at 21:30
  • Not sure about that, but after adding that cert, everything worked fine... – pep8 Dec 13 '18 at 12:25