← Back to issue list

Unable to verify self signed certificate

View original Launchpad issue

Metadata

Project
snapcraft (launchpad)
Number
#1875781
Type
issue
State
closed
Author
~taitenpeng
Labels
—
Created
Updated
Closed

Current evaluation

Fixed in newer OpenSSL releases; Snapcraft improved proxy env var handling. Marked as resolved by maintainer mr-cal after upstream patch landed.

Resolution: closed resolved

Reason: The upstream OpenSSL fix has landed in newer releases, and Snapcraft improved its proxy environment variable handling. Maintainer mr-cal explicitly marked the issue as resolved.

Evaluated by: mr-cal-bot

No scores available.

Issue body

See the upstream bug background https://github.com/openssl/openssl/issues/1418 The issue initially was caught in a case when developers works behind company firewall and requires install company self signed certificate on Ubuntu host in order to access internet via company proxy. User may experience unable to access internet services via https protocol when even manually installed root trust ca-certificate on host machine due to openssl unable to verify some type of self signed certificate. This is also causing problems for snapcraft developers who work behind proxy servers unable to build snap packages. There is a fix going into openssl upstream apparently https://github.com/openssl/openssl/pull/10587 Just create a bug here to track this issue in Ubuntu in order to make sure we merge upstream fixes ultimately. Similar case reported by other users: [1] https://serverfault.com/questions/966846/cannot-trust-development-https-self-signed-certificate-in-ubuntu-18-04-2-lts [2] https://stackoverflow.com/questions/55485511/how-to-run-dotnet-dev-certs-https-trust/59702094#59702094

Evaluation history

Date Model Scores Action Summary
qwen/qwen3.6-35b-a3b — closed resolved Fixed in newer OpenSSL releases; Snapcraft improved proxy env var handling. Marked as resolved by maintainer mr-cal after upstream patch landed.
stealth/space-bunny-alpha
Impact: 20
Quick Win: 2
Complexity: 70
Confidence: 74
Actionability: 25
close resolved Tracking bug: OpenSSL cannot verify some self-signed certs installed as local CAs, breaking HTTPS/proxy access and builds behind corporate proxies. Root cause is upstream openssl, not snapcraft; ~adrien confirmed the fix is merged and shipped.
stealth/space-bunny-alpha
Impact: 45
Quick Win: 8
Complexity: 72
Confidence: 84
Actionability: 60
close resolved Tracking issue: Ubuntu's OpenSSL 1.1.1f could not verify some self-signed root CAs, breaking builds behind corporate proxies; maintainer reported the upstream fix shipped in newer releases
stealth/space-bunny-alpha
Impact: 52
Quick Win: 7
Complexity: 68
Confidence: 87
Actionability: 43
needs triage OpenSSL reportedly fails to verify some corporate self-signed CAs despite manual host trust installation, blocking HTTPS proxy builds; the report remains untriaged without a reproducible certificate case.
qwen/qwen3.8-27b
Impact: 15
Quick Win: 14
Staleness: 95
Complexity: 10
Confidence: 85
Support Request: 10
close stale Tracking bug for an OpenSSL self-signed certificate verification failure (openssl/openssl#1418) that broke HTTPS behind corporate proxies. Upstream fix (openssl/openssl#10587) merged in 2019. No activity for ~3.3 years, no labels or comments.
qwen/qwen3.6-35b-a3b
Staleness: 98
Complexity: 15
Confidence: 95
Support Request: 10
close stale Tracking ticket for upstream OpenSSL fix regarding self-signed certificate verification failures behind corporate proxies. Inactive for over three years with no maintainer interaction.
qwen/qwen3.6-35b-a3b
Staleness: 95
Complexity: 15
Confidence: 90
Support Request: 10
close stale Tracking issue for an upstream OpenSSL fix regarding self-signed certificate verification behind proxies. No maintainer interaction, labels, or comments in over six years.
qwen3.6-35b-a3b-mtp-q6
Staleness: 95
Complexity: 15
Confidence: 85
Support Request: 5
close stale Tracking bug to monitor and backport an upstream OpenSSL fix for self-signed certificate verification failures behind corporate proxies. Currently inactive with no maintainer response or labels.

Update history

Date Change
created

Related issues

Issue Project State Summary Similarity
#34 Snapcraft cannot authenticate proxy.golang.org snapcraft-rocks open Go builds via Snapcraft fail TLS verification against proxy.golang.org in the 7_core22 container. Maintainers traced it to CA certificates and two merged snapcraft PRs addressed it; issue left open since Apr 2024.
70%