snapcraft content websites have expired certificates
Metadata
Current evaluation
Canonical corrected the CDN certificate chain by 2021-10-20; Snapcraft PR #3252 (commit 6a4aa6ff0) also made HTTPS requests use system CA certificates.
Resolution: closed resolved
Reason: The reporter confirmed the CDN fix on 2021-10-20. Repository history records PR #3252, commit 6a4aa6ff0, switching Snapcraft HTTPS requests to system certificates and addressing the remaining client-side validation failure.
Evaluated by: mr-cal-bot
No scores available.
Issue body
I was trying a upgrade on a server from 18.04 to 20.04 but do-release-upgrade fails when trying to upgrade lxd as the SNAP content site has an expired/revoked certificate
The error in do-release-upgrade is
==> Installing the LXD snap from the 4.0 track for ubuntu-20.04
2021-10-15T15:34:39-04:00 INFO Waiting for automatic snapd restart...
error: cannot perform the following tasks:
- Download snap "core20" (1169) from channel "stable" (Get https://canonical-lcy
01.cdn.snapcraftcontent.com/download-origin/canonical-lgw01/DLqre5XGLbDqg9jPtiAh
RRjDuPVa5X1q_1169.snap?interactive=1&token=1634338800_2b7ac0f78ddb21e1b3760018c7
00fe9e99fd4e8f: x509: certificate signed by unknown authority)
dpkg: error processing archive /raid/scratch/apt-dpkg-install-FMjRvH/00-lxd_1%3a
0.9_all.deb (--unpack):
new lxd package pre-installation script subprocess returned error exit status 1
ERROR: Cannot create report: [Errno 17] File exists: '/var/crash/lxd.0.crash'
And we can see the issue with a simple 'wget'
$ wget -O tmp.dpkg 'https://canonical-lcy01.cdn.snapcraftcontent.com/download-origin/canonical-lgw01/DLqre5XGLbDqg9jPtiAhRRjDuPVa5X1q_1169.snap?interactive=1&token=1634338800_2b7ac0f78ddb21e1b3760018c700fe9e99fd4e8f'
--2021-10-15 20:58:22-- https://canonical-lcy01.cdn.snapcraftcontent.com/download-origin/canonical-lgw01/DLqre5XGLbDqg9jPtiAhRRjDuPVa5X1q_1169.snap?interactive=1&token=1634338800_2b7ac0f78ddb21e1b3760018c700fe9e99fd4e8f
Resolving canonical-lcy01.cdn.snapcraftcontent.com... 91.189.88.179, 91.189.88.178
Connecting to canonical-lcy01.cdn.snapcraftcontent.com|91.189.88.179|:443... connected.
ERROR: The certificate of ‘canonical-lcy01.cdn.snapcraftcontent.com’ is not trusted.
ERROR: The certificate of ‘canonical-lcy01.cdn.snapcraftcontent.com’ has expired.
$ openssl s_client -showcerts -servername canonical-lcy01.cdn.snapcraftcontent.com -connect canonical-lcy01.cdn.snapcraftcontent.com:443
CONNECTED(00000003)
depth=3 O = Digital Signature Trust Co., CN = DST Root CA X3
verify error:num=10:certificate has expired
notAfter=Sep 30 14:01:15 2021 GMT
The whole upgrade then fails as lxd is a dependency and one is left with the server in a partial state
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| stealth/space-bunny-alpha | — | closed resolved | Canonical corrected the CDN certificate chain by 2021-10-20; Snapcraft PR #3252 (commit 6a4aa6ff0) also made HTTPS requests use system CA certificates. | |
| qwen/qwen3.8-27b | — | closed resolved | Snapcraft CDN (snapcraftcontent.com) served expired/revoked DST Root CA X3 certs, breaking LXD upgrades. Canonical fixed the server-side certs by 2021-10-20; snapcraft tool updated to use system CA certs in PR #3252. | |
| qwen/qwen3.8-27b | — | closed resolved | CDN certificate issue on snapcraftcontent.com was fixed server-side by 10/20/21. Snapcraft tool's own cert handling was later improved via PRs #3224 and #3252 to use system CA certificates. | |
| qwen/qwen3.8-27b | — | closed resolved | Snapcraft CDN (snapcraftcontent.com) served expired/revoked certificates blocking LXD upgrades. Server-side certs were fixed by Canonical on 2021-10-20. Tool-side cert validation issue noted but issue closed. | |
| stealth/space-bunny-alpha | — | closed stale | Closed without a documented code fix or explanation after expired Snapcraft CDN certificates blocked LXD upgrades. | |
| qwen/qwen3.6-35b-a3b | — | — | Closed without comments. The expired Snapcraft CDN certificates blocking LXD upgrades were resolved by upstream renewal or marked stale. | |
| qwen/qwen3.6-35b-a3b | — | — | Closed without comments. The expired Snapcraft CDN certificates were resolved externally by Canonical renewing them, restoring access and allowing the LXD snap installation and Ubuntu release upgrade to complete successfully. | |
| qwen/qwen3.6-35b-a3b | — | — | Closed. The expired SSL certificate on the snapcraft CDN was renewed, resolving the download failure during upgrades. No official resolution notes were provided. | |
| qwen3.6-35b-a3b-mtp-q6 | — | — | Closed. Snapcraft CDN certificates were renewed, resolving the LXD upgrade failures. No additional fixes were required. |
Update history
| Date | Change |
|---|---|
| created |
Related work
-
Likely Fixed By:
canonical/snapcraft#3252
(confidence 98%)
Merged as commit 6a4aa6ff0, changing Snapcraft to use system certificates by default for HTTPS requests.
-
Related To:
snapcraft (launchpad)#1946406
(confidence 90%)
Reported the same snapcraftcontent.com revoked-certificate-chain failure during snap installation.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #1946406 snapcraftcontent.com shows certificate error | snapcraft (launchpad) | open | Reporter's Vagrant build pipeline failed to install snaps because canonical-bos01.cdn.snapcraftcontent.com served a revoked certificate chain (DST Root CA X3). Server-side CDN certs were fixed by Canonical in Oct 2021; no further action in snapcraft. | |
| #3252 snapcraft: use system certificates by default for https requests | snapcraft | merged | Merged PR #3252 in commit 6a4aa6ff0, making Snapcraft use Debian/Ubuntu host CA certificates for HTTPS requests by default while allowing REQUESTS_CA_BUNDLE overrides. | |
| #34 Snapcraft cannot authenticate proxy.golang.org | snapcraft-rocks | open | Go builds via Snapcraft fail TLS verification against proxy.golang.org in the 7_core22 container. Maintainers traced it to CA certificates and two merged snapcraft PRs addressed it; issue left open since Apr 2024. |