Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #159493

How to make apt-transport-https accept security.debian.org bad certificate?

Show all headers | View raw

Hello.

I intend to use a secure connection (that means at the *transport* 
level) for downloading packages and lists from the Debian repository. I 
installed apt-transport-https. There seems to be no list of mirrors that 
accept HTTPS; nonetheless, I found that some listed mirrors accept HTTPS 
(for example mirrors.kernel.org). I configured one of them in my 
"sources.list".

When I run "apt-get update", I get the following error:

-----BEGIN PASTED TEXT----
Err https://security.debian.org wheezy/updates/main Sources
   SSL: certificate subject name (debian.org) does not match target host 
name 'security.debian.org'
Err https://security.debian.org wheezy/updates/main amd64 Packages
   SSL: certificate subject name (debian.org) does not match target host 
name 'security.debian.org'
Fetched 7637 kB in 33s (231 kB/s)
W: Failed to fetch 
https://security.debian.org/dists/wheezy/updates/main/source/Sources 
SSL: certificate subject name (debian.org) does not match target host 
name 'security.debian.org'

W: Failed to fetch 
https://security.debian.org/dists/wheezy/updates/main/binary-amd64/Packages 
  SSL: certificate subject name (debian.org) does not match target host 
name 'security.debian.org'

E: Some index files failed to download. They have been ignored, or old 
ones used instead.
-----END PASTED TEXT----

There is a problem: security.debian.org has a bad certificate and there 
are no official mirrors. The certificate is only valid for 
"www.debian.org" and "debian.org", not "security.debian.org". You can 
check this with your browser by going to https://security.debian.org/.

My question is: How can I make "apt-get" accept the certificate anyway, 
but only _this_ certificate or other certificates that are otherwise 
valid but have the same subdomain mismatch error (it should reject a 
bogus certificate from an attacker)?. In addition, where is the correct 
place to report this error?.

The relevant lines in "/etc/apt/sources.list" are:

-----BEGIN PASTED TEXT----
deb https://security.debian.org/ wheezy/updates main
deb-src https://security.debian.org/ wheezy/updates main
-----END PASTED TEXT----

I know that the packages are signed. I am not looking for suggestions to 
not to use HTTPS. I can use unencrypted connections, of course, but  I 
am looking to have an added layer of security.

Regards and thanks in advance.

Back to linux.debian.user | Previous | Next — Next in thread | Find similar | Unroll thread

Thread

How to make apt-transport-https accept security.debian.org bad certificate? Mario Castelán Castro  <marioxcc.MT@yandex.com> - 2015-10-20 01:20 +0200
  Re: How to make apt-transport-https accept security.debian.org bad  certificate? Mario Castelán Castro  <marioxcc.MT@yandex.com> - 2015-10-20 02:10 +0200
    Re: How to make apt-transport-https accept security.debian.org bad  certificate? Michael Jones <mj@mikejonesey.co.uk> - 2015-10-20 10:10 +0200
      Re: How to make apt-transport-https accept security.debian.org bad  certificate? Michael Jones <mj@mikejonesey.co.uk> - 2015-10-20 10:10 +0200
        Re: How to make apt-transport-https accept security.debian.org bad  certificate? Michael Jones <mj@mikejonesey.co.uk> - 2015-10-20 22:40 +0200
          Re: How to make apt-transport-https accept security.debian.org bad  certificate? Mario Castelán Castro  <marioxcc.MT@yandex.com> - 2015-10-20 23:40 +0200
            Re: How to make apt-transport-https accept security.debian.org bad  certificate? Mario Castelán Castro  <marioxcc.MT@yandex.com> - 2015-10-21 01:10 +0200

csiph-web