Can't auto-update Tails

Question

I booted up Tails 2.4 and was greeted with:

Error while checking for upgrades

Running upgrade manually in terminal reveals errors:

amnesia@amnesia:~$ tails-upgrade-frontend-wrapper
localuser:tails-upgrade-frontend being added to access control list
Prototype mismatch: sub Tails::MirrorPool::assert ($;$) vs none at /usr/share/perl5/Tails/MirrorPool.pm line 28.
Prototype mismatch: sub Tails::IUK::Frontend::assert ($;$) vs none at /usr/share/perl5/Tails/IUK/Frontend.pm line 42.
Error while checking for upgrades
<b><b>Could not determine whether an upgrade is available from our website.</b>

Check your network connection, and restart Tails to try upgrading again.

If the problem persists, go to file:///usr/share/doc/tails/website/doc/upgrade/error/check.en.html</b>

For debugging information, execute the following command: sudo tails-debugging-info

** (zenity:7650): WARNING **: Couldn't register with accessibility bus: Did not receive a reply. Possible causes include: the remote application did not send a reply, the message bus security policy blocked the reply, the reply timeout expired, or the network connection was broken.
Gtk-Message: GtkDialog mapped without a transient parent. This is discouraged.
Error while checking for upgrades
<b><b>Could not determine whether an upgrade is available from our website.</b>

Check your network connection, and restart Tails to try upgrading again.

If the problem persists, go to file:///usr/share/doc/tails/website/doc/upgrade/error/check.en.html</b>

For debugging information, execute the following command: sudo tails-debugging-info
exit code: 2816

stdout:


stderr:
Could not download 'https://tails.boum.org/upgrade/v1/Tails/2.4/i386/stable/upgrades.yml', request failed (Peer certificate cannot be authenticated with given CA certificates): server certificate verification failed. CAfile: /usr/local/etc/ssl/certs/tails.boum.org-CA.pem CRLfile: none
 at /usr/bin/tails-iuk-get-upgrade-description-file line 21.
 at /usr/bin/tails-upgrade-frontend line 22.
localuser:tails-upgrade-frontend being removed from access control list

How to upgrade without complete manual reinstallation?

Answer 1

Problem is with certificates:

Could not download 'https://tails.boum.org/upgrade/v1/Tails/2.4/i386/stable/upgrades.yml',
request failed (Peer certificate cannot be authenticated with given CA certificates):
server certificate verification failed. CAfile: /usr/local/etc/ssl/certs/tails.boum.org-CA.pem 

https://tails.boum.org switched to Let’s Encrypt certificate authority and these new certificates are missing in versions less then 2.7.

You can fix it by downloading Lets encrypt certs:

1. go to https://letsencrypt.org/certificates/
2. open one of the Active Intermediate Certificates -> Let’s Encrypt Authority X3 (IdenTrust cross-signed)
3. open the tails.boum.org-CA.pem and overwrite its content with the Let's encrypt cert.

sudo nano /usr/local/etc/ssl/certs/tails.boum.org-CA.pem (You will need to set up administration password before)

Then re-run tails-upgrade-frontend-wrapper.

Repeat until Tails 2.7 is installed.

Answer 2

When you (or someone else) has a more recent tails, you can upgrade your stick from the newer running Tails. Just use the Tails Installer. It does not download the tails from the network, but uses the running tails.

Hint: Plug in the older tails only after the Tails Installer was started.