The certificate for deb.nodesource seems to be expired

[caioaamaral]

- Environment: Docker (ubuntu:bionic image)

- Issue: When trying to install Node.js v14.x following these instructions , if fails during apt-get update:

## Confirming "bionic" is supported...

+ curl -sLf -o /dev/null 'https://deb.nodesource.com/node_14.x/dists/bionic/Release'

## Adding the NodeSource signing key to your keyring...

+ curl -s https://deb.nodesource.com/gpgkey/nodesource.gpg.key | gpg --dearmor | tee /usr/share/keyrings/nodesource.gpg >/dev/null

## Creating apt sources list file for the NodeSource Node.js 14.x repo...

+ echo 'deb [signed-by=/usr/share/keyrings/nodesource.gpg] https://deb.nodesource.com/node_14.x bionic main' > /etc/apt/sources.list.d/nodesource.list
+ echo 'deb-src [signed-by=/usr/share/keyrings/nodesource.gpg] https://deb.nodesource.com/node_14.x bionic main' >> /etc/apt/sources.list.d/nodesource.list

## Running `apt-get update` for you...

+ apt-get update
Ign:1 https://deb.nodesource.com/node_14.x bionic InRelease
Err:2 https://deb.nodesource.com/node_14.x bionic Release
  Certificate verification failed: The certificate is NOT trusted. The certificate chain uses expired certificate.  Could not handshake: Error in the certificate verification. [IP: 201.0.222.9 443]
Hit:3 http://security.ubuntu.com/ubuntu bionic-security InRelease
Hit:4 http://archive.ubuntu.com/ubuntu bionic InRelease
Hit:5 http://ppa.launchpad.net/brightbox/ruby-ng/ubuntu bionic InRelease
Hit:6 http://archive.ubuntu.com/ubuntu bionic-updates InRelease
Hit:7 http://archive.ubuntu.com/ubuntu bionic-backports InRelease
Hit:8 https://packagecloud.io/github/git-lfs/ubuntu bionic InRelease
Reading package lists...
E: The repository 'https://deb.nodesource.com/node_14.x bionic Release' does not have a Release file.
Error executing command, exiting
The command '/bin/bash -o pipefail -c curl -fsSL https://deb.nodesource.com/setup_14.x | bash - &&   apt-get install -y --no-install-recommends nodejs &&   npm i -g xunit-viewer &&   rm -rf /var/lib/apt/lists/*' returned a non-zero code: 1

[snowman2]

Same for RPM:

$ curl -fsSL https://rpm.nodesource.com/setup_12.x | bash -
curl: (60) SSL certificate problem: certificate has expired
More details here: https://curl.haxx.se/docs/sslcerts.html
curl failed to verify the legitimacy of the server and therefore could not
establish a secure connection to it. To learn more about this situation and
how to fix it, please visit the web page mentioned above.

UPDATE: Fixed with yum update ca-certificates

[vguaglione]

Same

[frostme]

same issue as well

[igsu]

We are aware of the situation and are actively working to fix it, thank you for your patience.

[d10sfan]

Same issue here, I was able to fix a similar problem on my own server with the following command:

sudo certbot certonly --nginx -d [domain] --dry-run --preferred-chain="ISRG Root X1"

That was from here: https://community.letsencrypt.org/t/help-thread-for-dst-root-ca-x3-expiration-september-2021/149190/283

[FlorentMasson]

On the client (Ubuntu), doing this prior to install allowed me to pass through the certificate error:
sudo apt install ca-certificates

Edit: might need apt update first

[ubugnu]

The "September 30" syndrome?

[emzeidan]

On the client, doing this prior to install allowed me to pass through the certificate error: sudo apt install ca-certificates

Unfortunately that did not work in my case since I was already at latest.

[afshinm]

curl -fsSLk https://rpm.nodesource.com/setup_12.x | bash - could be a good short-term solution (-k disables the client-side SSL verification).

[nandonespolo]

apt update not working, same issue:
Creating gitversion file Get:1 http://security.debian.org/debian-security stretch/updates InRelease [53.0 kB] Ign:2 http://deb.debian.org/debian stretch InRelease Get:3 http://deb.debian.org/debian stretch-updates InRelease [93.6 kB] Get:4 http://deb.debian.org/debian stretch Release [118 kB] Get:5 http://deb.debian.org/debian stretch Release.gpg [3177 B] Get:6 https://download.docker.com/linux/debian stretch InRelease [44.8 kB] Get:7 http://security.debian.org/debian-security stretch/updates/main amd64 Packages [718 kB] Ign:8 https://deb.nodesource.com/node_10.x stretch InRelease Err:9 https://deb.nodesource.com/node_10.x stretch Release server certificate verification failed. CAfile: /etc/ssl/certs/ca-certificates.crt CRLfile: none Get:10 http://deb.debian.org/debian stretch/main amd64 Packages [7080 kB] Get:11 https://download.docker.com/linux/debian stretch/stable amd64 Packages [15.9 kB] Reading package lists... E: The repository 'https://deb.nodesource.com/node_10.x stretch Release' does no longer have a Release file.

[dgarbus]

For Debian buster, updating the libgnutls30 package appears to fix the certificate verification.

apt-get update; apt-get install libgnutls30

[gonzaloaune]

Along with this problem, if I bypass the SSL problem, still I can't install in Amazon Linux 1 getting an error like:

## Your distribution, identified as "system-release-2018.03-0.2.noarch", is not currently supported, please contact NodeSource at https://github.com/nodesource/distributions/issues if you think this is incorrect or would like your distribution to be considered for support

Whereas it was working 2 hours ago.

[needcaffeine]

Same. I got past the SSL issue with curl -fsSLk http://deb.nodesource.com/setup_12.x | bash but now I see:

## Your distribution, identified as "stretch", is not currently supported, please contact NodeSource at https://github.com/nodesource/distributions/issues if you think this is incorrect or would like your distribution to be considered for support

[victorlcampos]

@gonzaloaune,
same here

Problem with Amazon Linux 1

[uberdog]

@dgarbus 's solution above (install libgnutls30) worked for me on Debian Stretch.

[ProfessorLaw]

Hello there.
Updating ca-certificates on my base Docker image fixed the issue in my pipelines.
Hope this helps !

[drochgenius]

For Debian buster, updating the libgnutls30 package appears to fix the certificate verification.

apt-get update; apt-get install libgnutls30

This solution worked for us.

[kronion]

For those wondering why updating ca-certificates solves the problem, the old Lets Encrypt root certificate expired, and you need to download a new one.

In an up-to-date browser, you should be able to load this page without a problem: https://deb.nodesource.com/setup_12.x
But not on a server with out-of-date certificates:

$ curl https://deb.nodesource.com/setup_12.x
curl: (60) SSL certificate problem: certificate has expired
More details here: http://curl.haxx.se/docs/sslcerts.html

curl performs SSL certificate verification by default, using a "bundle"
 of Certificate Authority (CA) public keys (CA certs). If the default
 bundle file isn't adequate, you can specify an alternate file
 using the --cacert option.
If this HTTPS server uses a certificate signed by a CA represented in
 the bundle, the certificate verification probably failed due to a
 problem with the certificate (it might be expired, or the name might
 not match the domain name in the URL).
If you'd like to turn off curl's verification of the certificate, use
 the -k (or --insecure) option.

[simneu]

Following this exact message (removing the bad cert and forcing Ubuntu to update CA certificates) hotfixed the issue and saved the night for us (Xenial): https://community.letsencrypt.org/t/help-thread-for-dst-root-ca-x3-expiration-september-2021/149190/324

[gtoews]

getting buster not supported upon installing any NodeSource repo

[quincy]

I saw this from a docker build. I added this as a workaround so apt update would work again.

RUN apt-get update ; apt-get install ca-certificates \
    && apt-get update \
    && apt-get install -y \
...

[nicolai-petrov-venngage]

As temp solutions works at Ubuntu20

---

$curl -s http://deb.nodesource.com/gpgkey/nodesource.gpg.key | apt-key add -

$ sudo sh -c "echo deb http://deb.nodesource.com/node_14.x focal main > /etc/apt/sources.list.d/nodesource.list"
$ sudo apt-get update
$ sudo apt-get install nodejs

---

I hope it will works for other distros and nodeversions
Http not https

[Ranarxhag]

Any solution for Amazon Linux 2 ? :) I still have the certificate issue and when i try to bypass it, i have the following message:
Your distribution, identified as "system-release-2-12.amzn2.x86_64", is not currently supported, please contact NodeSource at https://github.com/nodesource/distributions/issues if you think this is incorrect or would like your distribution to be considered for support

[YurkaninRyan]

I'm working through this right now, but you have to set up a .curlrc to set the -k flag on all curl calls because the script that ends up running also ends up making a curl call to the nodesource domain

[spkane]

In my image build workflow, I was able to workaround it like this:

# Workaround for: https://github.com/nodesource/distributions/issues/1266
mv /etc/apt/sources.list.d/nodesource.list /etc/apt/sources.list.d/nodesource.list.disabled
apt-get update
apt-get -y upgrade
apt-get  install -y \
    ca-certificates \
    libgnutls30 
mv /etc/apt/sources.list.d/nodesource.list.disabled /etc/apt/sources.list.d/nodesource.list

[rogerd330]

This was causing by BitBucket pipelines to fail and the following changes seem to have fixed it:

Original steps:
- curl -sL https://deb.nodesource.com/setup_12.x | bash -
- apt-get install -y nodejs

New Steps:
- apt-get update
- apt-get install -y ca-certificates libgnutls30
- echo '-k' > ~/.curlrc
- curl -sL https://deb.nodesource.com/setup_12.x | bash -
- apt-get install -y nodejs

[igsu]

FYI
https://nsrc.io/3BpQXPB

[joshxyzhimself]

FYI https://nsrc.io/3BpQXPB

Hi @igsu thanks for the update.

The article reads like a solution was found but it could and could not work.

1. Are there steps us users can do to check if we are using the correct trust chain?
2. Are there manual steps we can take to acquire and use the correct trust chain if we ended up getting the incorrect one?
3. The problem reads like it's an Akamai CDN thing (is it?), can this problem be resolved without going through Akamai if it reoccurs?
4. Are there alternative sources other than nodesource that we can rely on if this happens again in the future? (other than compiling node from source lol)

Sorry if lots of questions, just really curious, thank you 🙌

[sonerdm]

I put the below part right after base image installation and worked for me
RUN apt-get update && apt-get -y upgrade

[jmorris-dev]

We are aware of the situation and are actively working to fix it, thank you for your patience.

It's now November, this gave me significant difficulty upgrading a non-supported Ubuntu version, when is this going to be fixed?

[mathieujobin]

Anyone has a solution for Mac OSX 10.10 and 10.11 ?

Thanks

[quite]

Looks like the cert is fixed now?

[igsu]

Closing this, should be fixed now.

[jahagirdar]

On Linux mint

DISTRO="$(lsb_release -s -c)"

i.e. DISTRO=uma

Does not work,
Setting DISTRO=focal works

lsb_release -a                                                                                              ✘ 130 
LSB Version:    core-11.1.0ubuntu2-noarch:printing-11.1.0ubuntu2-noarch:security-11.1.0ubuntu2-noarch
Distributor ID: Linuxmint
Description:    Linux Mint 20.2
Release:        20.2
Codename:       uma

[Tectract]

HALP.

Cannot add PPA: '"Error reading https://launchpad.net/api/1.0/~oibaf/+archive/graphics-drivers: (60, 'server certificate verification failed. CAfile: /etc/ssl/certs/ca-certificates.crt CRLfile: none')"'.

This seems to have broken all launchpad PPAs for me. What do I do to fix it???

[mathieujobin]

@Tectract Don't use https for PPA

[AndrewRPorter]

This seems to be happening again: https://deb.nodesource.com/node_16.x/pool/

[PvanHengel]

Hi... reopen this issue? seems its expired again?

[daneren2005]

Hi... reopen this issue? seems its expired again?

Someone already opened a new issue: #1507

[kyasui]

Same here.

[gabrielcandrade]

Guys, just need to update the ca-certificates from machine. The old certificate got untrusted, when it's updated, the error get vanished:

If you are using AMI Linux 2:

sudo yum update ca-certificates

If you are using Ubuntu:

sudo apt update -y
sudo apt install libgnutls30 ca-certificates -y
sudo update-ca-certificates

[A-Unix]

For Kali linux users, try this:

cd /etc/apt/sources.list.d
after that type ls and find the list added there, after that, you need to delete that list from directory, you can use this command for the same: rm -r <list-name>

It worked for me.

Try updating again your Kali linux: apt update && apt dist-upgrade -y

Hope this helps.

[etasnadi]

Closing this, should be fixed now.

I still experience the problem.

[etasnadi]

I could finally solve the issue by uninstalling this software.

sudo apt-get remove nodejs
rm -f /etc/apt/sources.list.d/nodesource.list

Now I can update my system.