2

we host a local mirror for Ubuntu and Debian packages.

root@apt-mirror:~# dpkg -l | grep mirror
ii  apt-mirror                            0.5.4-1                                         all          APT sources mirroring tool

Mirroring and access works fine without ssl.

root@db2:~# cat /etc/apt/sources.list.d/custom.apt-mirror.ubuntu.list
deb http://apt-mirror.custom.de/de.archive.ubuntu.com/ubuntu bionic main universe
deb http://apt-mirror.custom.de/de.archive.ubuntu.com/ubuntu bionic-security main universe
deb http://apt-mirror.custom.de/de.archive.ubuntu.com/ubuntu bionic-updates main universe

But if I want use access via https I get the following error message

OK:1 http://apt-mirror.custom.de/de.archive.ubuntu.com/ubuntu bionic-security InRelease
Ign:2 https://apt-mirror.custom.de/de.archive.ubuntu.com/ubuntu bionic InRelease
OK:3 http://apt-mirror.custom.de/de.archive.ubuntu.com/ubuntu bionic-updates InRelease
OK:4 http://apt-mirror.custom.de/repos.influxdata.com/ubuntu bionic InRelease
Fehl:5 https://apt-mirror.custom.de/de.archive.ubuntu.com/ubuntu bionic Release
  Certificate verification failed: The certificate is NOT trusted. The certificate chain uses insecure algorithm.  Could not handshake: Error in the certificate verification. [IP: XXX.XXX.XXX.XXX 443]
Paketlisten werden gelesen... Fertig
E: Das Depot »https://apt-mirror.custom.de/de.archive.ubuntu.com/ubuntu bionic Release« enthält keine Release-Datei mehr.
N: Eine Aktualisierung von solch einem Depot kann nicht auf eine sichere Art durchgeführt werden, daher ist es standardmäßig deaktiviert.
N: Weitere Details zur Erzeugung von Paketdepots sowie zu deren Benutzerkonfiguration finden Sie in der Handbuchseite apt-secure(8).

All certificates in the chain are available on the host, so an test with openssl is successfully:

root@db2:~# openssl s_client -showcerts -connect apt-mirror.custom.de:443
CONNECTED(00000005)
depth=3 C = DE, O = CUSTOM, CN = CUSTOM-Root CA
verify return:1
depth=2 C = DE, O = CUSTOM, CN = CUSTOM-Policy CA Intern
verify return:1
depth=1 C = DE, O = CUSTOM, CN = CUSTOM-Server CA Intern
verify return:1
depth=0 C = DE, ST = NRW, L = Bonn, O = CUSTOM, OU = Betrieb, CN = apt-mirror.custom.de
verify return:1
---
Certificate chain
 0 s:C = DE, ST = NRW, L = Bonn, O = CUSTOM, OU = Betrieb, CN = apt-mirror.custom.de
   i:C = DE, O = CUSTOM, CN = CUSTOM-Server CA Intern
-----BEGIN CERTIFICATE-----
MIIGCjCCA/KgAwIBAgITMwAAAX9YNM4nCd6z0QACAAABfzANBgkqhkiG9w0BAQsF
ADA8MQswCQYDVQQGEwJERTENMAsGA1UEChMEQkdIVzEeMBwGA1UEAxMVQkdIVy1T
ZXJ2ZXIgQ0EgSW50ZXJuMB4XDTE4MTAwOTA3MzgxNVoXDTIwMTAwODA3MzgxNVow
#############################
lRV91hVW9bj4KsbyC4FGfK8+fgLPwlxBD+jwje43p9ZPY9WTxwcPFtIbT3fzxygX
/wmwQRRtg3aoICE61guje3URoP/qt+KSjFBmJ6cOGJne/rVXZ5etHHfSNfNqfJR4
ZAxfVfDN70m7SjYieB0DsJfbhYFqf8uaEQvkcMPr/vVXowDrjMTRBl+1CtM+q3G5
KzZm9qKKlZjWbAeuQ8o5myeu+E6tblJTQioz1jxlcSdWG0DjcjcDcPBFDB4/Qblb
KqPiEsGU+qRiwXqNjEWgSdUenOo4PlVVNUf+CsbbsoOdFV9qfG2G/ntXXbmoSPOZ
ZWv/8tDYfV+BCYVklcw=
-----END CERTIFICATE-----
 1 s:C = DE, O = CUSTOM, CN = CUSTOM-Server CA Intern
   i:C = DE, O = CUSTOM, CN = CUSTOM-Policy CA Intern
-----BEGIN CERTIFICATE-----
MIIGdDCCBFygAwIBAgITaQAAABQg6MjMFAQ5mAAAAAAAFDANBgkqhkiG9w0BAQsF
ADA8MQswCQYDVQQGEwJERTENMAsGA1UEChMEQkdIVzEeMBwGA1UEAxMVQkdIVy1Q
b2xpY3kgQ0EgSW50ZXJuMB4XDTE4MDUyMjEyNDAwOVoXDTIzMDUyMjEyNTAwOVow
PDELMAkGA1UEBhMCREUxDTALBgNVBAoTBEJHSFcxHjAcBgNVBAMTFUJHSFctU2Vy
dmVyIENBIEludGVybjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAMtO
#############################
EkbVV9UkXWRosy8ENxfcMwynd7xQoTzTywYUazNaX9NcRPvwZZ4NfmP9Mxqru7Hj
PofizUDnpKyp521brf9b7d7tjM4cYiS1beSiraOuW+9MBsf6pnuYpORfKvCa3wEP
fNpjXPkpCU30xJadqMGR1xT0fehd0vJpXsdixcNJEDBMY+cKeGDpaYcTY1BmtUtZ
2YIXQv8BGZP6YsWJpX9odjW9I7/WS74b
-----END CERTIFICATE-----
 2 s:C = DE, O = CUSTOM, CN = CUSTOM-Policy CA Intern
   i:C = DE, O = CUSTOM, CN = CUSTOM-Root CA
-----BEGIN CERTIFICATE-----
MIIGCTCCA/GgAwIBAgIKYUYc4wAAAAAAAzANBgkqhkiG9w0BAQUFADAzMQswCQYD
VQQGEwJERTENMAsGA1UEChMEQkdIVzEVMBMGA1UEAxMMQkdIVy1Sb290IENBMB4X
DTEyMDYyNjA5MzExOVoXDTIzMDYyNjA5NDExOVowPDELMAkGA1UEBhMCREUxDTAL
#############################
s/oRVYoW20m5bN26B0jsmVA41HPFH/xfRzciRy8xi0xYoS5QDBSMEFBdloCcAdlR
u77otTQ45MhW7iJ7qefJhlGixnaYaNe8my0rKFEZdT+So46WsLjYv7iE11Dp4tbJ
abDDRyYLQJYbGBoJdeEY30RJ7LFGpNlu6Mhj7puZza58uG/2VRs/olRbo9jCuYnc
/EeOmnBXGB1caha+og==
-----END CERTIFICATE-----
 3 s:C = DE, O = CUSTOM, CN = CUSTOM-Root CA
   i:C = DE, O = CUSTOM, CN = CUSTOM-Root CA
-----BEGIN CERTIFICATE-----
MIIF7jCCA9agAwIBAgIQLjBY331L64pF+SwDb+wecDANBgkqhkiG9w0BAQUFADAz
MQswCQYDVQQGEwJERTENMAsGA1UEChMEQkdIVzEVMBMGA1UEAxMMQkdIVy1Sb290
IENBMB4XDTEyMDYyNjA4MTE0MFoXDTMwMDYyNjA4MjEzMFowMzELMAkGA1UEBhMC
##############################
DhW0PUKRBt+5qqyaHsCQJXGYqRREy/bznBQF7xV3nlRXqSlx+BoSR0PLjwgChzIj
AQWUjA0N3RYhQmb+jyRm48xJJRBXi4fVFzkh8+qQz9neF91XPqp6pHs57A44gPEj
YmlM58+4n2G90LohJT/aythka9QBjIqyLomMl4CQ5F4H+Q==
-----END CERTIFICATE-----
---
Server certificate
subject=C = DE, ST = NRW, L = Bonn, O = CUSTOM, OU = Betrieb, CN = apt-mirror.custom.de

issuer=C = DE, O = CUSTOM, CN = CUSTOM-Server CA Intern

---
No client certificate CA names sent
Peer signing digest: SHA256
Peer signature type: RSA-PSS
Server Temp Key: X25519, 253 bits
---
SSL handshake has read 6963 bytes and written 413 bytes
Verification: OK
---
New, TLSv1.2, Cipher is ECDHE-RSA-AES256-GCM-SHA384
Server public key is 2048 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
    Protocol  : TLSv1.2
    Cipher    : ECDHE-RSA-AES256-GCM-SHA384
    Session-ID: 80BBED0A0E87437094755EB7D611B8FF8ED3D94837500D84CDBDBAA4282516E9
    Session-ID-ctx:
    Master-Key: 915E404C840EC1C7EF840B618444D6BDC92FF12A2620000292E120C0F9B97FD1846A9B1F8B7835C0A8E3CE5F5AD6400D
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    TLS session ticket lifetime hint: 300 (seconds)
    TLS session ticket:
    0000 - e9 b0 15 43 aa ac 79 99-18 1e fb 60 03 5a 7a d5   ...C..y....`.Zz.
    0010 - 27 20 e2 7a 87 de ea fe-0a 32 c6 57 e3 95 09 f9   ' .z.....2.W....
    0020 - 8e dc 92 7f 80 1e 87 5f-af ad 63 70 ef e6 86 d0   ......._..cp....
    0030 - 12 f5 67 65 26 2c 4f 02-a0 a6 a1 a8 f0 53 eb c2   ..ge&,O......S..
    0040 - 2d 53 ba 95 13 50 b0 cb-a9 cf a4 4f fe b4 3c 24   -S...P.....O..<$
    0050 - 4d 46 41 f4 dd 83 b8 2f-a7 e9 01 c2 27 70 27 b8   MFA..../....'p'.
    0060 - 03 b8 20 8e 6e c1 e5 d9-30 1c 39 69 7d f7 f0 42   .. .n...0.9i}..B
    0070 - a3 39 b3 3b f2 ac fc 99-d9 75 95 d0 3e 0d d9 b4   .9.;.....u..>...
    0080 - dd c5 f0 f0 db 94 76 65-12 88 b1 00 4b 0b 88 f1   ......ve....K...
    0090 - 5e dd 4c cc 50 5d 43 f7-10 86 1e 42 ea 8f 4c b9   ^.L.P]C....B..L.
    00a0 - 30 5e b9 ec 83 78 c9 35-d7 00 9d 44 7a a2 07 be   0^...x.5...Dz...
    00b0 - 53 57 78 43 b4 dc 2c f7-76 bd e6 ac 45 f7 5b 36   SWxC..,.v...E.[6
    00c0 - 68 1a 07 f8 25 4e 4b 1e-f6 26 c8 89 3b 3a 38 1c   h...%NK..&..;:8.

    Start Time: 1580217557
    Timeout   : 7200 (sec)
    Verify return code: 0 (ok)
    Extended master secret: yes
---

I don't want to skip the verification, like it is written here: apt-accept-an-invalid-certificate

Why apt say, the chain use an insecure algorithm?

Thanks

Improve this question
4
  • Yes, all CA certificates are imported and ready, because openssl can verify the complete chain. But maybe your link helps, because the one ca certificate in the chain use sha1 as signature algorithm. This ca is updated meanwhile, so it use sha256 now.
    – BusinessTux
    Commented Jan 28, 2020 at 13:41
  • It appears apt depends on gnutls (rather than openssl). I would install gnutls-bin and use certtool instead of openssl to validate the cert chain: retrieve the chain (as you did or anyhow else) then certtool --verify-chain < chain.pem. Works for www.ubuntu.com's chain
    – A.B
    Commented Jan 28, 2020 at 13:58
  • And again, there's no RSA PSS algorithm in use right?
    – A.B
    Commented Jan 28, 2020 at 14:04
  • certtool doesn't helps, because the chain is complete Chain verification output: Verified. The certificate is trusted. Thanks for your hints
    – BusinessTux
    Commented Jan 28, 2020 at 14:17

2 Answers 2

Reset to default
1

The link PKISolutions was very usefully. After study that, I saw that the policy ca certificate was sha1 signed. And that was the insecure algorithm in the chain. The policy CA is updated last year and now it is signed with sha256. Now the chain is continuously without sha1 and apt accepts the certificate.

Improve this answer
-1

That somehow sounds paranoid. Which so -called "certificate" is at all democratically legitimate, so which is the desire to trust?

Why not deactivate all certificates and (finally) realize democracy?

Improve this answer
1

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .