← Back to issue list

snapcraftcontent.com shows certificate error

View original Launchpad issue

Metadata

Project
snapcraft (launchpad)
Number
#1946406
Type
issue
State
open
Author
~steve010
Labels
—
Created
Updated
Closed
—

Current evaluation

Reporter's Vagrant build pipeline failed to install snaps because canonical-bos01.cdn.snapcraftcontent.com served a revoked certificate chain (DST Root CA X3). Server-side CDN certs were fixed by Canonical in Oct 2021; no further action in snapcraft.

Suggested action: close resolved

Reason: The reported cause was a server-side CDN trust-chain problem, not a snapcraft code defect: the parallel report snapcraft (launchpad)#1947430 ('snapcraft content websites have expired certificates', now closed) records Canonical fixing the snapcraftcontent.com certificates by 2021-10-20, and the client-side counterpart landed in snapcraft via PR #3252 / commit 6a4aa6ff0 'snapcraft: use system certificates by default for https requests' (plus #3224 for installing CA certs into build environments). The residual question ('can I point snaps at a different CDN/URL?') is a usage/config matter handled by snapd's store assertion, not a snapcraft feature gap. Note the only comment in this issue is an empty one from the reporter (2021-10-07) with no maintainer acknowledgement, so confidence is moderate rather than high.

Evaluated by: mr-cal-bot

Impact: 22 Quick Win: 6 Complexity: 18 Confidence: 70 Actionability: 35

Issue body

We have an automated build pipeline that uses vagrant to build an ubuntu VMWare image. As part of the build it installs multiple snaps from canonical-bos01.cdn.snapcraftcontent.com. This is erroring however as this URL is showing that a certificate in the chain has been revoked. Running it through the Qualys SSL Labs tests here https://www.ssllabs.com/ssltest/analyze.html?d=canonical-bos01.cdn.snapcraftcontent.com shows the certificate has been revoked which we believe is causing our problems. Would someone be able to investigate please. I've attached a screen shot of the revoked certificates details. As a work around is there a way to point the snap to come from a different CDN/URL? Thanks. Steve Esler

Evaluation history

Date Model Scores Action Summary
stealth/space-bunny-alpha
Impact: 22
Quick Win: 6
Complexity: 18
Confidence: 70
Actionability: 35
close resolved Reporter's Vagrant build pipeline failed to install snaps because canonical-bos01.cdn.snapcraftcontent.com served a revoked certificate chain (DST Root CA X3). Server-side CDN certs were fixed by Canonical in Oct 2021; no further action in snapcraft.
stealth/space-bunny-alpha
Impact: 15
Quick Win: 3
Complexity: 20
Confidence: 68
Actionability: 25
close not a bug User's build pipeline fails because snap downloads from the store CDN (canonical-bos01.cdn.snapcraftcontent.com) served a revoked certificate chain; asks for investigation and an alternate CDN workaround
stealth/space-bunny-alpha
Impact: 28
Quick Win: 5
Complexity: 42
Confidence: 86
Actionability: 31
needs triage Reported revoked certificate chain on a snap-download CDN hostname, blocking a Vagrant image build; the report remains unassessed and current TLS impact is unverified.
qwen/qwen3.8-27b
Impact: 20
Quick Win: 18
Staleness: 95
Complexity: 10
Confidence: 70
Support Request: 55
close stale Revoked SSL certificate on canonical-bos01.cdn.snapcraftcontent.com broke automated snap downloads. Open ~5 years with zero maintainer interaction; a similar CDN cert issue was resolved externally by Canonical renewing certificates.
qwen/qwen3.6-35b-a3b
Staleness: 95
Complexity: 10
Confidence: 90
Support Request: 75
close stale Revoked SSL certificate on canonical-bos01.cdn.snapcraftcontent.com causing build pipeline failures, with a request for investigation and CDN workaround.
qwen/qwen3.6-35b-a3b
Staleness: 98
Complexity: 10
Confidence: 90
Support Request: 5
close stale Reports a revoked SSL certificate on canonical-bos01.cdn.snapcraftcontent.com causing build pipeline failures. Unaddressed for nearly 5 years with no maintainer response.
qwen/qwen3.6-35b-a3b
Staleness: 98
Complexity: 20
Confidence: 90
Support Request: 10
close stale External contributor reports revoked SSL certificate on canonical-bos01.cdn.snapcraftcontent.com breaking build pipelines. Issue has been completely inactive for nearly five years with no maintainer response or labels.
qwen3.6-35b-a3b-mtp-q6
Staleness: 95
Complexity: 20
Confidence: 90
Support Request: 30
close stale Report of a revoked SSL certificate on canonical-bos01.cdn.snapcraftcontent.com breaking automated snap builds. Issue has been inactive for over 4.5 years with no maintainer response or labels.

Update history

Date Change
created

Related work

  • Duplicate Of: snapcraft (launchpad)#1947430 (confidence 85%)

    Same root cause and timeframe (snapcraftcontent.com serving expired/revoked DST Root CA X3 chain); that issue was closed after the server-side fix.

  • Likely Fixed By: snapcraft#3252 (confidence 55%)

    Commit 6a4aa6ff0 'snapcraft: use system certificates by default for https requests' addresses client-side CA bundle handling, but the actual fix for this report was Canonical's CDN-side certificate change, not tool code.

Related issues

Issue Project State Summary Similarity
#1947430 snapcraft content websites have expired certificates snapcraft (launchpad) closed Canonical corrected the CDN certificate chain by 2021-10-20; Snapcraft PR #3252 (commit 6a4aa6ff0) also made HTTPS requests use system CA certificates.
80%
#1790258 snap download incorrect certificate snapcraft (launchpad) closed 2018 report of a bogus x509 cert (vogue.de) served by fastly.cdn.snapcraft.io breaking snap download. A Fastly edge/CDN problem, not snapcraft code; no reply from reporter, auto-closed by ~janitor 2018-11-03 as expired after 60 days idle.
72%