X509: certificate signed by unknown authority

LXD
1

downloading image fails recently below.

# lxc init images:ubuntu/22.04 vm000 --vm
Creating vm000
Error: Failed instance creation: Get "https://sgp1lxdmirror01.do.letsbuildthe.cloud/images/ubuntu/jammy/amd64/default/20230402_07:42/lxd.tar.xz": tls: failed to verify certificate: x509: certificate signed by unknown authority

what’s going here?

2

@stgraber, is that a hiccup due to the newly added image mirrors?

3

Can’t tell, the error is truncated.

4

https://sgp1lxdmirror01.do.letsbuildthe.cloud/images/ get me a valid certificate here.

5

Been working fine for me on the fra server

6

What lxd version is this?

7

I just remembered that a trust root for Let’s Encrypt expired in September 2021 and caused issues for some people; maybe devices without the appropriate updates would have problems with the new mirrors for that reason.

8 
# lxd --version 
5.12

5.1.2 is running.

# curl https://cloud-images.ubuntu.com/releases/streams/v1/index.json -o /dev/null 
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100 27438  100 27438    0     0  25796      0  0:00:01  0:00:01 --:--:-- 25811

# curl https://sgp1lxdmirror01.do.letsbuildthe.cloud/releases/streams/v1/index.json -o /dev/null 
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0
curl: (60) SSL certificate problem: unable to get local issuer certificate
More details here: https://curl.se/docs/sslcerts.html

curl failed to verify the legitimacy of the server and therefore could not
establish a secure connection to it. To learn more about this situation and
how to fix it, please visit the web page mentioned above.

still getting ssl certificate problem at mirorr site…

9

What operating system are you running LXD on? Is it fully updated with the most recent trusted root certificates?

You may want to ensure that the root certificates mentioned here are trusted by your system: https://letsencrypt.org/certificates/

10

Thanks for everyone to confirm!
After investigations on my side, mirror site “sgp1lxdmirror01.do.letsbuildthe.cloud” didn’t work on any nodes inside of our firewall. That site matched in our firewall rules.
We work this out. it’s perfectly fine for now. Thanks again.

1 Like