0

Sometime between Jan 14 and Feb 10, 2021 there was a change that started breaking our pi-gen build which installs docker as a custom stage.

The error message in the build comes from the shell script hosted on https://get.docker.com/.

+ sh -c curl -fsSL "https://download.docker.com/linux/raspbian/gpg" | apt-key add -qq - >/dev/null
curl: (60) SSL certificate problem: unable to get local issuer certificate
More details here: https://curl.haxx.se/docs/sslcerts.html

curl failed to verify the legitimacy of the server and therefore could not
establish a secure connection to it. To learn more about this situation and
how to fix it, please visit the web page mentioned above.

It appears that the amazon CA root certificate that docker.com uses is not in the ca-certificates database. We added the docker cert chain to ca-certificates as a step before running the docker install script but that did not help:

+ sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p'
+ openssl s_client -connect download.docker.com:443
depth=3 C = US, ST = Arizona, L = Scottsdale, O = "Starfield Technologies, Inc.", CN = Starfield Services Root Certificate Authority - G2
verify error:num=20:unable to get local issuer certificate
verify return:1
depth=2 C = US, O = Amazon, CN = Amazon Root CA 1
verify return:1
depth=1 C = US, O = Amazon, OU = Server CA 1B, CN = Amazon
verify return:1
depth=0 CN = *.docker.com
verify return:1
DONE
+ sudo cp docker.crt /usr/local/share/ca-certificates
+ sudo update-ca-certificates
Updating certificates in /etc/ssl/certs...
1 added, 0 removed; done.
Running hooks in /etc/ca-certificates/update.d...
done.
+ command -v docker
+ echo 'Installing docker'
Installing docker
+ sh
+ wget -qO- https://get.docker.com/
# Executing docker install script, commit: 3d8fe77c2c46c5b7571f94b42793905e5b3e42e4
+ sh -c apt-get update -qq >/dev/null
+ sh -c DEBIAN_FRONTEND=noninteractive apt-get install -y -qq apt-transport-https ca-certificates curl >/dev/null
+ sh -c curl -fsSL "https://download.docker.com/linux/raspbian/gpg" | apt-key add -qq - >/dev/null
curl: (60) SSL certificate problem: unable to get local issuer certificate
More details here: https://curl.haxx.se/docs/sslcerts.html

curl failed to verify the legitimacy of the server and therefore could not
establish a secure connection to it. To learn more about this situation and
how to fix it, please visit the web page mentioned above.

Adding directly the latest Amazon root cert to the ca-certificates db also did not help:

+ curl -kfsSL https://www.amazontrust.com/repository/AmazonRootCA1.pem --output /usr/local/share/ca-certificates/amazon.crt
+ sudo update-ca-certificates
Updating certificates in /etc/ssl/certs...
1 added, 0 removed; done.

Ultimately we had to use curl's -k (--insecure) option as a workaround, which is not ideal as it skips the SSL/TLS certificate validation step. That lets our pi-gen script pass again, but we still have not addressed the root cause, which is why the docker.com digital certificate chain is not validated.

+ sh -c 'curl -kfsSL "https://download.docker.com/linux/raspbian/gpg" | apt-key add -qq - >/dev/null'

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.