3

I'm using SLES 2015 behind a firewall. All of my outgoing communications go over a proxy; specifically, zypper tries to use the proxy when I write, say,

zypper search-packages foo

but the proxy provides its own SSL certificate instead of the actual target site, essentially running a "man in the middle" attack :-P ... and so I get:

SSL verification failed: unable to get local issuer certificate
Certificate issuer: /C=US/O=Foo Inc./CN=Foo Inc. External Root CA 2.1
Certificate subject: /C=US/O=Foo Inc./OU=Whatever/CN=Foo Inc. CA 2.1
Could not search for the package: OpenSSL::SSL::SSLError: SSL_connect returned=1 errno=0 state=error: certificate verify failed (unable to get local issuer certificate)

I want to avoid this failing certificate verification; and I'm guessing the easiest way is to just not verify any certs. How do I turn the verification off?

Additional info:

# zypper repos
Warning: No repositories defined.
Use the 'zypper addrepo' command to add one or more repositories.
4
  • 1
    According to en.opensuse.org/SDB:Zypper_manual_%28plain%29, you might use ssl_verify=no in repo URI. Commented Feb 26, 2020 at 16:26
  • @AlexBaranowski: There are no repo files in /etc/zypp/repos.d... where do I put that ssl_verify=no?
    – einpoklum
    Commented Feb 26, 2020 at 16:38
  • Can you include following output: zypper repos and then zypper repos failing_repo_name ? Commented Feb 27, 2020 at 9:48
  • @AlexBaranowski: See edit.
    – einpoklum
    Commented Feb 27, 2020 at 11:19

1 Answer 1

7

You have to add the option ssl_verify=no to the baseurl parameter. So if you do not want to check the URL of the offical sources you can use:

# WARNING: Use this option only if you know what you do
baseurl=https://download.opensuse.org/distribution/leap/15.2/repo/oss/?ssl_verify=no
1
  • No longer experiencing this issue, but I think this did the trick
    – einpoklum
    Commented Nov 27, 2023 at 9:25

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .