snapcraft cannot connect through a transparent SSL proxy
Metadata
Current evaluation
snapcraft fails with SSL CERTIFICATE_VERIFY_FAILED behind transparent MITM proxies; no system CA store option exists. Open 772 days, 0 comments, no labels, no maintainer engagement.
Suggested action: needs triage
Reason: The issue has never been assessed by a maintainer (0 comments, no labels, no assignee) despite being open for 772 days. The reported SSL proxy problem is a legitimate bug/feature request with a workaround (REQUESTS_CA_BUNDLE), but it requires triage to determine current relevance, whether it's a duplicate, and if it's still applicable to the current snapcraft version.
Impact:
55
Quick Win:
30.25
Staleness:
75
Complexity:
45
Confidence:
50
Support Request:
15
Issue body
Problem Description
If there is a transparent MITM proxy between the client machine and the Snapcraft servers, the snapcraft binary is unable to connect and complains of a certificate error:
[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1007)
This is after the CA for the proxy is trusted by the system, and picked up by other system tools, eg. apt.
Currently, there is no flag to instruct snapcraft to use the system's CA certificate store to connect through that transparent proxy.
The workaround is to set an environment variable for python `requests` that forces the use of the system trusted certificate bundle.
`export REQUESTS_CA_BUNDLE=/etc/ssl/certs/ca-certificates.crt`
Snapcraft should have an option (or default) to pick up this CA bundle, without needing to use such a large hammer that can affect other software on the system as well.
$ lsb_release -a
No LSB modules are available.
Distributor ID: Ubuntu
Description: Ubuntu 24.04 LTS
Release: 24.04
Codename: noble
$ snapcraft --version
snapcraft 8.3.1
Also seen on 7.5.5
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| qwen3.6-35b-a3b-mtp-q6 |
Impact:
55
Quick Win:
30.25
Staleness:
75
Complexity:
45
Confidence:
50
Support Request:
15
|
needs triage | snapcraft fails with SSL CERTIFICATE_VERIFY_FAILED behind transparent MITM proxies; no system CA store option exists. Open 772 days, 0 comments, no labels, no maintainer engagement. | |
| qwen/qwen3.6-35b-a3b |
Staleness:
95
Complexity:
60
Confidence:
80
Support Request:
20
|
needs triage | Untriaged report from 729 days ago requesting native system CA bundle support for transparent SSL proxies. Currently requires a Python environment variable workaround. No maintainer interaction or labels present. | |
| qwen/qwen3.6-35b-a3b |
Staleness:
90
Complexity:
40
Confidence:
75
Support Request:
20
|
needs triage | SSL certificate verification fails when snapcraft runs behind a transparent MITM proxy due to missing system CA store support. The issue is untriaged, has no maintainer comments, and has been inactive for over two years. | |
| qwen3.6-35b-a3b-mtp-q6 |
Staleness:
95
Complexity:
35
Confidence:
85
Support Request:
10
|
needs triage | snapcraft fails to connect through transparent SSL proxies due to certificate verification errors. The issue is unlabelled, has zero maintainer comments, and has been inactive for nearly two years, awaiting initial triage. | |
| qwen3.6-35b-a3b-mtp-q6 |
Staleness:
92
Complexity:
45
Confidence:
85
Support Request:
20
|
needs triage | snapcraft fails to connect through transparent SSL proxies due to missing system CA bundle support. Issue remains open with no maintainer response or labels after nearly two years. |
Update history
No update history recorded yet.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #4935 snapcraft cannot connect through a transparent SSL proxy | snapcraft | open | snapcraft fails with SSL CERTIFICATE_VERIFY_FAILED behind a transparent MITM proxy because it does not use the system CA store; workaround is REQUESTS_CA_BUNDLE. Reported on 8.3.1/7.5.5; maintainer asked a clarifying question, no labels or fix yet. | |
| #34 Snapcraft cannot authenticate proxy.golang.org | snapcraft-rocks | open | x509 certificate error when Go tooling in snapcraft 7_core22 docker image tries to reach proxy.golang.org. Maintainer asked reporter to test 8_core22; reporter started but never reported back. Open 2+ years, no labels, no resolution. | |
| #1946406 snapcraftcontent.com shows certificate error | snapcraft (launchpad) | open | Revoked SSL certificate on canonical-bos01.cdn.snapcraftcontent.com broke automated snap downloads. Open ~5 years with zero maintainer interaction; a similar CDN cert issue was resolved externally by Canonical renewing certificates. |