I'm trying to update my Solaris 11.3 x86 system. The system hasSun/Oracle software on it, including Sun Developer Studio and Sun SSH server. It does not have other software on it, and I don't have anything in /usr/local.

I'm catching this error:

$ sudo pkg update
Creating Plan (Package planning:  1/10): -
pkg update: Chain was rooted in an untrusted self-signed certificate.
The package involved is pkg://solaris/consolidation/ddt/[email protected],0.5.11-

According to Packaging and Delivering Software With the Image Packaging System | Untrusted Self-Signed Certificate, the docs say it is because of using a self-signed OpenSSL certificate. Another similar page is Troubleshooting Signed Packages, but it rehashes the earlier page and adds nothing new. The Oracle docs on updating a package is at Updating a Package but it does not appear to provide the information I need.

The Sun article lacks step-by-step instructions to clear the issue. I'm trying to get Solaris to trust the Sun certificate but I can't get beyond usage errors:

$ sudo pkg set-publisher --approve-ca-cert  solaris/consolidation/ddt/ddt-incorporation
pkg set-publisher: requires a publisher name
    pkg set-publisher [-Ped] [-k ssl_key] [-c ssl_cert]
        [-g origin_to_add|--add-origin=origin_to_add ...]
        [-G origin_to_remove|--remove-origin=origin_to_remove ...]


$ sudo pkg set-publisher --approve-ca-cert  solaris/consolidation/ddt/ddt-incorporation sun
pkg set-publisher: Could not find /export/home/jwalton/solaris/consolidation/ddt/ddt-incorporation

I've tried other combinations, like prepending pkg:// and using the full name but the problems persist.

How do I get beyond this error?

  • Have you tried using the full path to solaris/consolidation/ddt/ddt-incorporation? Commented Aug 29, 2018 at 10:18
  • FWIW, I get the same error here when trying to update a Solaris virtualbox VM with nothing fancy on it. Suggesting Oracle have messed up something somewhere. Commented Aug 29, 2018 at 10:29
  • 1
    It's probably a matter of going through the steps described at docs.oracle.com/cd/E37838_01/html/E60977/gmpdi.html Commented Aug 29, 2018 at 10:59

6 Answers 6


It's not self-signed, but it's not signed by a certificate authority that the Solaris 11.3 GA version knows about. Support for the new certificate authority is one of the reasons you need to first update to Solaris 11.3 SRU 23 or later before you can upgrade to Solaris 11.4, as documented in the upgrade instructions.

  • So does this effectively mean that people without a support contract (i.e. no access to the SRU releases) can't upgrade from Solaris 11.3 to 11.4, and instead must do a clean install?
    – Tanz87
    Commented Sep 7, 2018 at 9:03
  • @Tanz87 unfortunately, that is correct.
    – alanc
    Commented Sep 9, 2018 at 21:35

I think I know exactly what you're trying to do, but you'll also fail at the next step which is where I'm up to.

pkg(1) stashes a copy of the certificate chain in /var/pkg/publisher/(publisher name)/certs, so you'll have the signing and root certificate in /var/pkg/publisher/solaris/certs. Copy the root certificate to the CA certificate directory in /etc/certs/CA/ and then pkg(1) will trust the certificate chain.

In my case, it's as easy as

cp /var/pkg/publisher/solaris/certs/370b6b4fba7b0ad472465ffe9377f8f6040b2cfd /etc/certs/CA/temp-solaris-object-signing.pem
svcadm restart system/ca-certificates

The next hurdle you'll find is that pkg://solaris/system/[email protected],5.11- has an origin root-image dependency on pkg:/system/[email protected] (see https://docs.oracle.com/cd/E53394_01/html/E54820/dependtypes.html#PKDEVglumq for details about pkg dependencies). There is probably a very good reason that is there...

EDIT: the rest of what you're probably trying to do is...

If you choose to ignore that giant red flag, and don't mind your Solaris 11.3 system becoming unsupportable (probably because you don't have a support contract in order to download 11.3SRU23), you can do something like:

pkgrecv -s /path/to/solaris11_4 -d /var/tmp/sol114 --raw pkg://solaris/system/[email protected],5.11-
vi /var/tmp/sol114/system%2Fcore-os/11.4%2C5.11-*

Remove the dependency:

depend fmri=pkg:/system/[email protected] root-image=true type=origin

Publish back to your local repo:

pkgsend publish -s /path/to/solaris11_4 -d /var/tmp/sol114/system%2Fcore-os/11.4%2C5.11- /var/tmp/sol114/system%2Fcore-os/11.4%2C5.11-
pkgrepo -s /path/to/solaris11_4 rebuild

Then run the upgrade.

You need to ensure that /var/tmp is completely empty before upgrading because it seems to create a new ZFS dataset for /var/tmp during the upgrade, otherwise it seems to work fine with a couple of fixable errors. YMMV, I tested this on an old T4-2 SPARC system (not x86), so I don't know if there are other quirks around GRUB upgrades etc.


this will fix error

cp /var/pkg/publisher/solaris/certs/370b6b4fba7b0ad472465ffe9377f8f6040b2cfd /etc/certs/CA/temp-solaris-object-signing.pem

svcadm restart system/ca-certificates
  • Welcome to the site, and thank you for your contribution. Perhaps you could edit your post to add some explanation how these steps will solve the problem?
    – AdminBee
    Commented May 26, 2021 at 8:32

The following command will install 11.3 sru21 which will install new CA. DDT-incorporation is a diagnostic package which has explorer etc..

pkg update --reject ddt-incorporation --accept [email protected]

Later you can install the individual package if required or subsequent pkg update will not fail. pkg install ddt-incorporation

  • You are apparently showing a command that is obviously not a valid command — it has unquoted parentheses (and not in an allowed configuration).  What do you mean?  Please do not respond in comments; edit your answer to make it clearer and more complete. Commented Nov 14, 2018 at 18:25

To resolve the pkg update issue: Specify the exact version of the "package involved".

# pkg update --reject pkg://solaris/consolidation/ddt/[email protected],0.5.11- [email protected]

or simply reject it:

# pkg update consolidation/ddt/[email protected] [email protected]
pkg uninstall consolidation/ddt/ddt-incorporation support/explorer
  • In my case, after removing those two packages (support/explorer depending on ddt-incorporation), I still get the error for other packages (pkg://solaris/library/python/[email protected],5.11-, suggesting that it's not only about those packages but that we need somehow to let Solaris know about the new oracle root certificate (pkg refresh --full doesn't help). Commented Aug 29, 2018 at 10:46

You must log in to answer this question.