snapcraft content websites have expired certificates
Metadata
Current evaluation
⚠️ This summary may be outdated — the issue content or evaluation prompts have changed since this evaluation was made.
Closed without comments. The expired Snapcraft CDN certificates were resolved externally by Canonical renewing them, restoring access and allowing the LXD snap installation and Ubuntu release upgrade to complete successfully.
Suggested action: —
No scores available.
Issue body
I was trying a upgrade on a server from 18.04 to 20.04 but do-release-upgrade fails when trying to upgrade lxd as the SNAP content site has an expired/revoked certificate
The error in do-release-upgrade is
==> Installing the LXD snap from the 4.0 track for ubuntu-20.04
2021-10-15T15:34:39-04:00 INFO Waiting for automatic snapd restart...
error: cannot perform the following tasks:
- Download snap "core20" (1169) from channel "stable" (Get https://canonical-lcy
01.cdn.snapcraftcontent.com/download-origin/canonical-lgw01/DLqre5XGLbDqg9jPtiAh
RRjDuPVa5X1q_1169.snap?interactive=1&token=1634338800_2b7ac0f78ddb21e1b3760018c7
00fe9e99fd4e8f: x509: certificate signed by unknown authority)
dpkg: error processing archive /raid/scratch/apt-dpkg-install-FMjRvH/00-lxd_1%3a
0.9_all.deb (--unpack):
new lxd package pre-installation script subprocess returned error exit status 1
ERROR: Cannot create report: [Errno 17] File exists: '/var/crash/lxd.0.crash'
And we can see the issue with a simple 'wget'
$ wget -O tmp.dpkg 'https://canonical-lcy01.cdn.snapcraftcontent.com/download-origin/canonical-lgw01/DLqre5XGLbDqg9jPtiAhRRjDuPVa5X1q_1169.snap?interactive=1&token=1634338800_2b7ac0f78ddb21e1b3760018c700fe9e99fd4e8f'
--2021-10-15 20:58:22-- https://canonical-lcy01.cdn.snapcraftcontent.com/download-origin/canonical-lgw01/DLqre5XGLbDqg9jPtiAhRRjDuPVa5X1q_1169.snap?interactive=1&token=1634338800_2b7ac0f78ddb21e1b3760018c700fe9e99fd4e8f
Resolving canonical-lcy01.cdn.snapcraftcontent.com... 91.189.88.179, 91.189.88.178
Connecting to canonical-lcy01.cdn.snapcraftcontent.com|91.189.88.179|:443... connected.
ERROR: The certificate of ‘canonical-lcy01.cdn.snapcraftcontent.com’ is not trusted.
ERROR: The certificate of ‘canonical-lcy01.cdn.snapcraftcontent.com’ has expired.
$ openssl s_client -showcerts -servername canonical-lcy01.cdn.snapcraftcontent.com -connect canonical-lcy01.cdn.snapcraftcontent.com:443
CONNECTED(00000003)
depth=3 O = Digital Signature Trust Co., CN = DST Root CA X3
verify error:num=10:certificate has expired
notAfter=Sep 30 14:01:15 2021 GMT
The whole upgrade then fails as lxd is a dependency and one is left with the server in a partial state
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| qwen/qwen3.6-35b-a3b | — | — | Closed without comments. The expired Snapcraft CDN certificates were resolved externally by Canonical renewing them, restoring access and allowing the LXD snap installation and Ubuntu release upgrade to complete successfully. | |
| qwen/qwen3.6-35b-a3b | — | — | Closed. The expired SSL certificate on the snapcraft CDN was renewed, resolving the download failure during upgrades. No official resolution notes were provided. | |
| qwen3.6-35b-a3b-mtp-q6 | — | — | Closed. Snapcraft CDN certificates were renewed, resolving the LXD upgrade failures. No additional fixes were required. |
Update history
No update history recorded yet.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #1946406 snapcraftcontent.com shows certificate error | snapcraft (launchpad) | open | Revoked SSL certificate on canonical-bos01.cdn.snapcraftcontent.com broke automated snap downloads. Open ~5 years with zero maintainer interaction; a similar CDN cert issue was resolved externally by Canonical renewing certificates. |