snapcraft cannot connect through a transparent SSL proxy
Metadata
Current evaluation
Snapcraft 7.5.5/8.3.1 rejects a system-trusted MITM proxy CA; setting REQUESTS_CA_BUNDLE works, but the report remains untriaged.
Suggested action: needs triage
Reason: The report provides a consistent CERTIFICATE_VERIFY_FAILED error, affected versions 7.5.5 and 8.3.1, and a working REQUESTS_CA_BUNDLE workaround. However, there are no labels, maintainer comments, or exact failing command, and the corresponding report #4935 is also unanswered.
Evaluated by: mr-cal-bot
Impact:
58
Quick Win:
22
Complexity:
52
Confidence:
89
Actionability:
78
Issue body
Problem Description
If there is a transparent MITM proxy between the client machine and the Snapcraft servers, the snapcraft binary is unable to connect and complains of a certificate error:
[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1007)
This is after the CA for the proxy is trusted by the system, and picked up by other system tools, eg. apt.
Currently, there is no flag to instruct snapcraft to use the system's CA certificate store to connect through that transparent proxy.
The workaround is to set an environment variable for python `requests` that forces the use of the system trusted certificate bundle.
`export REQUESTS_CA_BUNDLE=/etc/ssl/certs/ca-certificates.crt`
Snapcraft should have an option (or default) to pick up this CA bundle, without needing to use such a large hammer that can affect other software on the system as well.
$ lsb_release -a
No LSB modules are available.
Distributor ID: Ubuntu
Description: Ubuntu 24.04 LTS
Release: 24.04
Codename: noble
$ snapcraft --version
snapcraft 8.3.1
Also seen on 7.5.5
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| stealth/space-bunny-alpha |
Impact:
58
Quick Win:
22
Complexity:
52
Confidence:
89
Actionability:
78
|
needs triage | Snapcraft 7.5.5/8.3.1 rejects a system-trusted MITM proxy CA; setting REQUESTS_CA_BUNDLE works, but the report remains untriaged. | |
| stealth/space-bunny-alpha |
Impact:
48
Quick Win:
19
Complexity:
43
Confidence:
88
Actionability:
70
|
needs triage | Snapcraft 8.3.1 and 7.5.5 reject host-installed proxy CAs behind transparent SSL proxies despite system trust; a global bundle workaround exists, but the report remains untriaged. | |
| qwen3.6-35b-a3b-mtp-q6 |
Impact:
55
Quick Win:
30
Staleness:
75
Complexity:
45
Confidence:
50
Support Request:
15
|
needs triage | snapcraft fails with SSL CERTIFICATE_VERIFY_FAILED behind transparent MITM proxies; no system CA store option exists. Open 772 days, 0 comments, no labels, no maintainer engagement. | |
| qwen/qwen3.6-35b-a3b |
Staleness:
95
Complexity:
60
Confidence:
80
Support Request:
20
|
needs triage | Untriaged report from 729 days ago requesting native system CA bundle support for transparent SSL proxies. Currently requires a Python environment variable workaround. No maintainer interaction or labels present. | |
| qwen/qwen3.6-35b-a3b |
Staleness:
90
Complexity:
40
Confidence:
75
Support Request:
20
|
needs triage | SSL certificate verification fails when snapcraft runs behind a transparent MITM proxy due to missing system CA store support. The issue is untriaged, has no maintainer comments, and has been inactive for over two years. | |
| qwen3.6-35b-a3b-mtp-q6 |
Staleness:
95
Complexity:
35
Confidence:
85
Support Request:
10
|
needs triage | snapcraft fails to connect through transparent SSL proxies due to certificate verification errors. The issue is unlabelled, has zero maintainer comments, and has been inactive for nearly two years, awaiting initial triage. |
Update history
| Date | Change |
|---|---|
| created |
Related work
-
Duplicate Of:
snapcraft#4935
(confidence 96%)
Same title and affected Snapcraft versions; it appears to be the GitHub counterpart of this Launchpad report.
-
Related To:
snapcraft#3252
(confidence 86%)
An earlier change made system certificates the default for HTTPS requests, but failures reported against much later 7.5.5 and 8.3.1 show that this behavior later became incomplete or regressed.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #4935 snapcraft cannot connect through a transparent SSL proxy | snapcraft | open | Snapcraft 7.5.5/8.3.1 was reported to reject a system-trusted MITM proxy CA for host commands such as whoami; it remains untriaged and unanswered. | |
| #34 Snapcraft cannot authenticate proxy.golang.org | snapcraft-rocks | open | Go builds via Snapcraft fail TLS verification against proxy.golang.org in the 7_core22 container. Maintainers traced it to CA certificates and two merged snapcraft PRs addressed it; issue left open since Apr 2024. |