[From nobody Sun Apr  5 12:35:07 2026
Received: (at 1022199-done) by bugs.debian.org; 5 Apr 2026 11:33:37 +0000
X-Spam-Checker-Version: SpamAssassin 4.0.1-bugs.debian.org_2005_01_02
 (2024-03-25) on buxtehude.debian.org
X-Spam-Level: 
X-Spam-Status: No, score=-7.2 required=4.0 tests=BAYES_00,DKIM_SIGNED,
 DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,HAS_BUG_NUMBER,
 RCVD_IN_VALIDITY_CERTIFIED_BLOCKED,RCVD_IN_VALIDITY_RPBL_BLOCKED,
 RCVD_IN_VALIDITY_SAFE_BLOCKED,SPF_HELO_NONE,SPF_NONE autolearn=ham
 autolearn_force=no version=4.0.1-bugs.debian.org_2005_01_02
X-Spam-Bayes: score:0.0000 Tokens: new, 19; hammy, 149; neutral, 26; spammy,
 0. spammytokens: hammytokens:0.000-+--XDebbugsCc,
 0.000-+--X-Debbugs-Cc, 0.000-+--followupfor, 0.000-+--followup-for,
 0.000-+--FollowupFor
Return-path: <ametzler@bebt.de>
Received: from vsrv21575.customer.vlinux.de ([31.15.64.248]:40150)
 by buxtehude.debian.org with esmtps
 (TLS1.3:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256)
 (Exim 4.96) (envelope-from <ametzler@bebt.de>) id 1w9LjU-00FKOC-1q
 for 1022199-done@bugs.debian.org; Sun, 05 Apr 2026 11:33:37 +0000
DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=bebt.de;
 s=d2; h=In-Reply-To:Content-Transfer-Encoding:Content-Type:MIME-Version:
 References:Message-ID:Subject:To:From:Date:From:Sender:Reply-To:Subject:Date:
 Message-ID:To:Cc:MIME-Version:Content-Type:Content-Transfer-Encoding:
 Content-ID:Content-Description:In-Reply-To:References;
 bh=HjXrUUFAc9TWugNrG2u46+Rg+K/+8WJIL+w4CoqYOs4=; b=O3QfFBBAlv9Q2qfIxQ/sYP0w8W
 uPjf/avIeKDapEbiN3dCwh9gl5vjrjmvzHBgS6stCiolm1oShNgPSjHhxgXKjw3P5x/lvr4YBVHpf
 tXYiRgRNIqKQqPKkx1deV7t2MRjN3qarw/k6ZdVhK4z5IC9xKe+YfigUQBzENcZFudHKNRdE9pOlH
 ejUKMYs9Lntt6bAHdsdNNN5HT00nQvrt9ETw6wXdIBNFp3Dn2ZtT9Ny3SP1fkLx7OGSBpPJAhwu3g
 uZ79c+aueephDfANGaPLqlxjkJmtqG7jDf1cw7UiGmONt3i+n0UOpGjBWn5BaAM0w9qChiO20UBsJ
 n3iBIelQ==;
Received: from [41.66.122.156] (helo=argenau.bebt.de)
 by vsrv21575.customer.vlinux.de with esmtpsa (TLS1.3) tls
 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.99.1)
 (envelope-from <ametzler@bebt.de>) id 1w9LjO-00000002urm-23DW;
 Sun, 05 Apr 2026 11:33:31 +0000
Received: from [::1] (helo=argenau.bebt.de)
 by argenau.bebt.de with esmtps (TLS1.3) tls
 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.99.1)
 (envelope-from <ametzler@bebt.de>) id 1w9LjN-000000001Gc-2rNf;
 Sun, 05 Apr 2026 13:33:28 +0200
Date: Sun, 5 Apr 2026 13:33:27 +0200
From: Andreas Metzler <ametzler@bebt.de>
To: =?iso-8859-1?Q?Martin-=C9ric?= Racine <martin-eric.racine@iki.fi>,
 1022199-done@bugs.debian.org
Subject: Re: Bug#1022199: apt: 'apt-get update' fails on repository with
 snakeoil certificate
Message-ID: <adJIh_rpN_b85rFx@argenau.bebt.de>
References: <1967d7f0-8a94-d7ee-687f-5e745e10f890@aiticon.com>
 <177538405751.112322.9695804009043664462.reportbug@p8b75.internal>
MIME-Version: 1.0
Content-Type: text/plain; charset=iso-8859-1
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
In-Reply-To: <177538405751.112322.9695804009043664462.reportbug@p8b75.internal>

On 2026-04-05 Martin-Éric Racine <martin-eric.racine@iki.fi> wrote:
> Package: apt
> Version: 3.0.3
> Followup-For: Bug #1022199
> X-Debbugs-Cc: martin-eric.racine@iki.fi

> I still experience a similar issue when doing 'apt-get update' with sources that include a local repository signed with a snakeoil certificate.

> Err:1 https://repos.internal/debian unstable InRelease
>   SSL connection failed: error:0A000086:SSL routines::certificate verify failed / Success [IP: 172.16.1.1 443]

> -- System Information:
[...]
> Versions of packages apt depends on:
[...]
> ii  libssl3t64              3.5.5-1~deb13u1
[...]

Thanks for the reminder to close this *gnutls* bug - apt has switched to
OpenSSL in Dec 2024.

Given the original bug was about a complety different software stack I
suggest reopening a new one if this is reproducible.

cu Andreas]