Debian 12 apt unable to authenticate nginx repository SSL/TLS certificate

Projects NGINX
, ,
1

Please use this template for troubleshooting questions.

My issue: debian 12 apt does not recognise the SSL certificate of the NGINX apt repo

How I encountered the problem: installing the nginx apt repo in order to try installing nginx

Solutions I’ve tried: installing ca-certificates as suggest in several support articles.

Version of NGINX or NGINX adjacent software (e.g. NGINX Gateway Fabric): nginx repo for debian bookworm

Deployment environment: kitchen for testing and Nutanix VM for use

Minimal NGINX config to reproduce your issue (preferably running on https://tech-playground.com/playgrounds/nginx for ease of debugging, and if not as a code block): *(Tip → Run nginx -T to print your entire NGINX config to your terminal.)

It never gets to where nginx is installed, so config of nginx is not relevant*

NGINX access/error log: *(Tip → You can usually find the logs in the /var/log/nginx directory.)
There are no logs, due to nginx never getting installed.

Error messages are as follows*
root@dom-nginx-proxy-debian-12:/home/vagrant# apt update
Hit:1 Index of /debian bookworm InRelease
Hit:2 Index of /debian-security bookworm-security InRelease
Hit:3 Index of /debian bookworm-updates InRelease
Ign:4 Index of /packages/debian/ bookworm InRelease
Ign:4 Index of /packages/debian/ bookworm InRelease
Ign:4 Index of /packages/debian/ bookworm InRelease
Err:4 Index of /packages/debian/ bookworm InRelease
Certificate verification failed: The certificate is NOT trusted. The certificate issuer is unknown. Could not handshake: Error in the certificate v
erification. [IP: 3.125.197.172 443]
Reading package lists… Done
Building dependency tree… Done
Reading state information… Done
62 packages can be upgraded. Run ‘apt list --upgradable’ to see them.
W: https://nginx.org/packages/debian/dists/bookworm/InRelease: No system certificates available. Try installing ca-certificates.
W: https://nginx.org/packages/debian/dists/bookworm/InRelease: No system certificates available. Try installing ca-certificates.
W: https://nginx.org/packages/debian/dists/bookworm/InRelease: No system certificates available. Try installing ca-certificates.
W: https://nginx.org/packages/debian/dists/bookworm/InRelease: No system certificates available. Try installing ca-certificates.
W: Failed to fetch https://nginx.org/packages/debian/dists/bookworm/InRelease Certificate verification failed: The certificate is NOT trusted. The ce
rtificate issuer is unknown. Could not handshake: Error in the certificate verification. [IP: 3.125.197.172 443]
W: Some index files failed to download. They have been ignored, or old ones used instead.

2

Hi there,

I have a debian 12 system which does not seem to have a problem validating the certificate on nginx.org.

I suspect that this may be a debian/your-side config issue, rather than a specific nginx thing; but maybe more investigation can prove it either way.

I see the word “vagrant” in the prompt you show. Can you check / confirm: are you running “apt update” from the “host” operating system, or from one of the “virtual machines” that vagrant may be involved in managing?

Can you see: what certificate is presented by the server, that apt rejects? If I run the command

$ openssl s_client -connect nginx.org:443 < /dev/null | sed -n 1,/^Server/p

I see it reporting that the root CA involved is “C = US, O = Internet Security Research Group, CN = ISRG Root X1”, and I do have a file /etc/ssl/certs/ISRG_Root_X1.pem that is linked to /usr/share/ca-certificates/mozilla/ISRG_Root_X1.crt

Do you see the same certificate presented, or might you be having your traffic intercepted by a man-in-the-middle proxy (in which case: apt is correct to tell you that that cert is untrusted)?

Cheers,

3

This turned out to be an issue with permissions on the /etc/ssl and /etc/ssl/certs directories being too restrictive, and not allowing non-root users to read the certificates necessary to validate certs from sites. perms were 0640 and needed to be 0755 in order for the “apt” user to authenticate.

4

Thank you so much for following up with what worked! Appreciated :green_heart: