0

I am trying install a RPM from an url directly from anaconda kickstart (CentOS7) %post phase but I encountered an interesting error:

``` + rpm -Uvh https://dl.fedoraproject.org/pub/epel/epel-release-latest-7.noarch.rpm curl: (60) Peer's certificate issuer has been marked as not trusted by the user. More details here: http://curl.haxx.se/docs/sslcerts.html

curl performs SSL certificate verification by default, using a "bundle" of Certificate Authority (CA) public keys (CA certs). If the default bundle file isn't adequate, you can specify an alternate file using the --cacert option. If this HTTPS server uses a certificate signed by a CA represented in the bundle, the certificate verification probably failed due to a problem with the certificate (it might be expired, or the name might not match the domain name in the URL). If you'd like to turn off curl's verification of the certificate, use the -k (or --insecure) option. error: skipping https://dl.fedoraproject.org/pub/epel/epel-release-latest-7.noarch.rpm - transfer failed ```

Running the same command after system reboots works well but inside post it fails and opposed to curl which has a -k parameter, I found no option to give to rpm.

This is double weird because this address is not supposed to have an invalid SSL certificate anyway.

I know that I could split this into two commands, one curl that downloads the file and another one to install the rpm.

Still, I am looking for a beter solution, one line one.

Update

My first attempt was to add epel-release inside the list of packages but this raised and error:

You have specified that the package 'epel-release' should be installed.  This
package does not exist.  Would you like to ignore this package and continue with
installation?

Please respond 'yes' or 'no':
sorin
  • 7,668
  • 24
  • 75
  • 100
  • 1
    Why are you trying to do this? Just add `epel-release` to the `%packages` list. – Michael Hampton Dec 05 '18 at 18:41
  • @MichaelHampton I updated the answer. Still the questing is still valid, why the SSL certificate is not valid at install time. – sorin Dec 05 '18 at 18:54
  • 2
    Are you sure you're installing CentOS? It most certainly does include the `epel-release` package as a convenience. It has for years now. I suspect you've got bigger problems than the original one about being unable to verify the TLS certificate. – Michael Hampton Dec 05 '18 at 19:05
  • 1
    Are you in a corporate environment? At my job all HTTP requests are intercepted by a proxy, including HTTPS. When that happens a certificate is presented that doesn't match the real cert from remote host. Instead I get a certificate from the proxy. Unless that certificate has been trusted already, it will cause handshake errors like this. – apocalysque Dec 06 '18 at 09:49

1 Answers1

1

These SSL erros were caused by the presense of http_proxy environment variable which made rpm use a proxy.

Once I installed the custom CA certificate, this was sorted.

sorin
  • 7,668
  • 24
  • 75
  • 100