SSL: CERTIFICATE_VERIFY_FAILED certificate verify failed (_ssl.c:852)

Question

Dockerfile i have below for y-ppa-manager package installation.

FROM ubuntu:18.04
RUN add-apt-repository ppa:webupd8team/y-ppa-manager
RUN apt-get update -y
RUN apt-get install -y y-ppa-manager

But during docker image build time it fails with below errors.

RUN add-apt-repository ppa:webupd8team/y-ppa-manager
---> Running in 2474e6f3252a
Y PPA Manager
Info: http://www.webupd8.org/2010/11/y-ppa-manager-easily-search-add-remove.html
This PPA is for Y PPA Manager and also includes the latest YAD for the supported Ubuntu versions (YAD is a dependency for Y PPA Manager): http://sourceforge.net/p/yad-dialog/
More info: https://launchpad.net/~webupd8team/+archive/ubuntu/y-ppa-manager
'Error reading https://keyserver.ubuntu.com/pks/lookup?op=get&options=mr&exact=on&search=0x7B2C3B0889BF5709A105D03AC2518248EEA14886: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:852)'
The command '/bin/sh -c add-apt-repository ppa:webupd8team/y-ppa-manager' returned a non-zero code: 1

For this error [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:852) have already installed company proxy certificate on host machine.

Do I have to add certificate inside container?

Any idea what I'm missing here? Any help would be helpful. Thanks.

score 1 · Accepted Answer · edited Sep 27 '22 at 05:58

1

I tried to reproduce your issue with the following Dockerfile

FROM ubuntu:18.04
If you need a proxy server e.g. at 192.168.0.1:3128
#RUN echo 'Acquire::http::proxy "http://192.168.0.1:3128/";' > /etc/apt/apt.conf.d/05proxy
#RUN echo 'Acquire::https::proxy "http://192.168.0.1:3128/";' >> /etc/apt/apt.conf.d/05proxy
RUN apt-get update
RUN apt-get install --no-install-recommends --yes software-properties-common
Add the local proxy certificate inside container
ADD Proxy-Certificate.crt /usr/local/share/ca-certificates/Proxy-Certificate.crt 
RUN update-ca-certificates
RUN add-apt-repository ppa:webupd8team/y-ppa-manager
RUN apt-get update
RUN apt-get install --yes y-ppa-manager

...

0 added, 0 removed; done.
Running hooks in /etc/ca-certificates/update.d...
done.
--> d62ad9911de
STEP 4/6: RUN add-apt-repository ppa:webupd8team/y-ppa-manager
 Y PPA Manager

Info: http://www.webupd8.org/2010/11/y-ppa-manager-easily-search-add-remove.html

This PPA is for Y PPA Manager and also includes the latest YAD for the supported Ubuntu versions (YAD is a dependency for Y PPA Manager): http://sourceforge.net/p/yad-dialog/
 More info: https://launchpad.net/~webupd8team/+archive/ubuntu/y-ppa-manager
Get:1 http://ppa.launchpad.net/webupd8team/y-ppa-manager/ubuntu bionic InRelease [15.4 kB]
Hit:2 http://archive.ubuntu.com/ubuntu bionic InRelease
Hit:3 http://security.ubuntu.com/ubuntu bionic-security InRelease
Hit:4 http://archive.ubuntu.com/ubuntu bionic-updates InRelease

...

And it worked... Is it possible, that you did not use the official base image ubuntu:18.04?

edited Sep 27 '22 at 05:58

user4948798

149

answered Sep 23 '22 at 07:59

Simon Sudler

3,931
3
21
34

I too using the same base image FROM ubuntu:18.04 However on my particular system it doesn't work. – user4948798 Sep 23 '22 at 08:15
can you try the provided dockerfile? If it works, you should add our full dockerfile – Simon Sudler Sep 23 '22 at 09:21
Have tried with your dockerfile still i'm facing the same problem. – user4948798 Sep 23 '22 at 09:32
Are you using some sort of a proxy? – Simon Sudler Sep 23 '22 at 09:39
Yes we have corporate internet proxy server at present i'm working with our network admin department members. – user4948798 Sep 23 '22 at 10:10
Check this answer: https://askubuntu.com/questions/1014973/apt-update-could-not-handshake-an-unexpected-tls-packet-was-received/1014978#1014978 typically the HTTPS proxy is set wrong. See my update – Simon Sudler Sep 23 '22 at 12:44
With these lines in Dockerfile i could able to get rid of those errors ADD Proxy-Certificate.crt /usr/local/share/ca-certificates/Proxy-Certificate.crt RUN update-ca-certificates Thanks a lot for your continues support. – user4948798 Sep 24 '22 at 05:34
Does that mean, you are happy with the provided answer? – Simon Sudler Sep 26 '22 at 06:30
Yes that's right. – user4948798 Sep 26 '22 at 09:32
would you mind to mark the answer as correct? – Simon Sudler Sep 26 '22 at 12:03

SSL: CERTIFICATE_VERIFY_FAILED certificate verify failed (_ssl.c:852)

1 Answers1

If you need a proxy server e.g. at 192.168.0.1:3128

Add the local proxy certificate inside container