running apt-get update/upgrade through a proxy

Question

I'm having issues keeping a Pi up-to-date in a customers network. The pi is there for controlling a piece of equipment, and it needs to be updated once in a while, among other things to keep backward compatibility with out servers. Only, when running sudo apt-get update, this is the result:

Ign:1 https://10.1.10.10:4100/fw_user_login.html?redirect=http://archive.raspberrypi.org/debian stretch InRelease
Ign:2 https://10.1.10.10:4100/fw_user_login.html?redirect=http://raspbian.raspberrypi.org/raspbian stretch InRelease
Err:3 https://10.1.10.10:4100/fw_user_login.html?redirect=http://archive.raspberrypi.org/debian stretch Release
  SSL: certificate subject name (*.redacted.de) does not match target host name '10.1.10.10'

Goes on like this for a couple more lines. You can already see the issue: Everything in that network is proxied through some authenticated gateway to even get internet access. This doesn't seem to be an issue for most things. Curl, for example, can do https. But for some reason, when apt does a request, apparently it gets the gateways certificate instead of the certificate from its repositories.

Does anybody have an idea how I can get the Pi to update inside that network without the customer changing anything (because, of course, they won't...)?

Answer 1

These notes are for Buster - I've no Stretch boxes left behind proxies (or at home TBH) that I can check but the file structure is the same on Jessie (my music player).

I think APT ignores some of the global environment / network settings and needs to be told directly about the proxy.

For one off updates you can use something like:

sudo 'http_proxy=http://10.0.0.20:3128' apt update

Assuming the proxy is at 10.0.0.20 and port 3128

You can add user / password with http://USERNAME:PASSWORD@ followed by the IP address and / or replace http with https as needed. Obviously change the server IP and port to the correct internal values for your network - not the remote destination address.

Also, do not use a server name, only IP address, as it does not work sometimes (and I do not know why).

For a more permanent solution you can store the info in a file for APT to use:

sudo nano /etc/apt/apt.conf.d/02proxy

add

Acquire {
  HTTP::proxy "http://IP:Port";
  HTTPS::proxy "https://IP:Port";
}

For user / password details you again add them in the middle e.g.:

HTTP::proxy "http://user:password@IP:Port";

If the /etc/apt/apt.conf.d directory is not present in Stretch then try adding the info into /etc/apt/apt.conf after taking a backup of it.