Opkg update problem - Invalid SSL certificate (Letsencrypt global root cert expiration)

[Rampler]

opkg update gets:

root@Repeater_WZ:/# opkg update
Downloading https://downloads.openwrt.org/releases/21.02.0/targets/ath79/generic/packages/Packages.gz
*** Failed to download the package list from https://downloads.openwrt.org/releases/21.02.0/targets/ath79/generic/packages/Packages.gz

Downloading https://downloads.openwrt.org/releases/21.02.0/packages/mips_24kc/base/Packages.gz
*** Failed to download the package list from https://downloads.openwrt.org/releases/21.02.0/packages/mips_24kc/base/Packages.gz

Downloading https://downloads.openwrt.org/releases/21.02.0/packages/mips_24kc/luci/Packages.gz
*** Failed to download the package list from https://downloads.openwrt.org/releases/21.02.0/packages/mips_24kc/luci/Packages.gz

Downloading https://downloads.openwrt.org/releases/21.02.0/packages/mips_24kc/packages/Packages.gz
*** Failed to download the package list from https://downloads.openwrt.org/releases/21.02.0/packages/mips_24kc/packages/Packages.gz

Downloading https://downloads.openwrt.org/releases/21.02.0/packages/mips_24kc/routing/Packages.gz
*** Failed to download the package list from https://downloads.openwrt.org/releases/21.02.0/packages/mips_24kc/routing/Packages.gz

Downloading https://downloads.openwrt.org/releases/21.02.0/packages/mips_24kc/telephony/Packages.gz
*** Failed to download the package list from https://downloads.openwrt.org/releases/21.02.0/packages/mips_24kc/telephony/Packages.gz

Collected errors:
 * opkg_download: Failed to download https://downloads.openwrt.org/releases/21.02.0/targets/ath79/generic/packages/Packages.gz, wget returned 5.
 * opkg_download: Failed to download https://downloads.openwrt.org/releases/21.02.0/packages/mips_24kc/base/Packages.gz, wget returned 5.
 * opkg_download: Failed to download https://downloads.openwrt.org/releases/21.02.0/packages/mips_24kc/luci/Packages.gz, wget returned 5.
 * opkg_download: Failed to download https://downloads.openwrt.org/releases/21.02.0/packages/mips_24kc/packages/Packages.gz, wget returned 5.
 * opkg_download: Failed to download https://downloads.openwrt.org/releases/21.02.0/packages/mips_24kc/routing/Packages.gz, wget returned 5.
 * opkg_download: Failed to download https://downloads.openwrt.org/releases/21.02.0/packages/mips_24kc/telephony/Packages.gz, wget returned 5.
root@Repeater_WZ:/#

wget gets:

root@Repeater_WZ:/# wget https://downloads.openwrt.org/releases/21.02.0/targets/ath79/generic/packages/Packages.gz
Downloading 'https://downloads.openwrt.org/releases/21.02.0/targets/ath79/generic/packages/Packages.gz'
Connecting to 2a01:4f8:251:321::2:443
Connection error: Invalid SSL certificate
root@Repeater_WZ:/#

Yesterday all was fine ..

[Doxi]

Me too, your are not alone, maybe is something about servers are down?

[hnyman]

First guess:
Probably due to letsencrypt root certificate expiration today...

See

Cert verify failed: BADCERT_EXPIRED (Letsencrypt global root cert)

Hi, At 2021-09-30 14:01:16 UTC, our openwrt devices using curl stopped working with the following error. % curl --cacert /etc/ssl/certs/ca-certificates.crt https://www.somedomain.com/ curl: (51) Cert verify failed: BADCERT_EXPIRED We logged into one of the devices and updated the ca-certificates package but no change. Does anyone know what's going on? We didn't make any changes and certs are valid on the sites we've tested against.

DST Root CA X3 Expiration (September 2021) - Let's Encrypt

[Doxi]

Executing package manager
Downloading https://downloads.openwrt.org/releases/21.02.0/targets/ramips/mt7621/packages/Packages.gz
*** Failed to download the package list from https://downloads.openwrt.org/releases/21.02.0/targets/ramips/mt7621/packages/Packages.gz

Downloading https://downloads.openwrt.org/releases/21.02.0/packages/mipsel_24kc/base/Packages.gz
*** Failed to download the package list from https://downloads.openwrt.org/releases/21.02.0/packages/mipsel_24kc/base/Packages.gz

Downloading https://downloads.openwrt.org/releases/21.02.0/packages/mipsel_24kc/luci/Packages.gz
*** Failed to download the package list from https://downloads.openwrt.org/releases/21.02.0/packages/mipsel_24kc/luci/Packages.gz

Downloading https://downloads.openwrt.org/releases/21.02.0/packages/mipsel_24kc/packages/Packages.gz
*** Failed to download the package list from https://downloads.openwrt.org/releases/21.02.0/packages/mipsel_24kc/packages/Packages.gz

Downloading https://downloads.openwrt.org/releases/21.02.0/packages/mipsel_24kc/routing/Packages.gz
*** Failed to download the package list from https://downloads.openwrt.org/releases/21.02.0/packages/mipsel_24kc/routing/Packages.gz

Downloading https://downloads.openwrt.org/releases/21.02.0/packages/mipsel_24kc/telephony/Packages.gz
*** Failed to download the package list from https://downloads.openwrt.org/releases/21.02.0/packages/mipsel_24kc/telephony/Packages.gz
Errors
Collected errors:
 * opkg_download: Failed to download https://downloads.openwrt.org/releases/21.02.0/targets/ramips/mt7621/packages/Packages.gz, wget returned 5.
 * opkg_download: Failed to download https://downloads.openwrt.org/releases/21.02.0/packages/mipsel_24kc/base/Packages.gz, wget returned 5.
 * opkg_download: Failed to download https://downloads.openwrt.org/releases/21.02.0/packages/mipsel_24kc/luci/Packages.gz, wget returned 5.
 * opkg_download: Failed to download https://downloads.openwrt.org/releases/21.02.0/packages/mipsel_24kc/packages/Packages.gz, wget returned 5.
 * opkg_download: Failed to download https://downloads.openwrt.org/releases/21.02.0/packages/mipsel_24kc/routing/Packages.gz, wget returned 5.
 * opkg_download: Failed to download https://downloads.openwrt.org/releases/21.02.0/packages/mipsel_24kc/telephony/Packages.gz, wget returned 5.
The opkg update command failed with code 6.

This is the error that i get.

[waynea]

same error for me too
and....

Downloading 'https://downloads.openwrt.org/releases/21.02.0/targets/ath79/generic/packages/Packages.g'
Connecting to 168.119.138.211:443
Connection error: Invalid SSL certificate

[apccv]

Me too.
All our routers using 21.02.0 are experiencing this.
The one using 19.07.7 and openSSL seems fine.
Error:

root@OpenWRT:/tmp# curl -v https://downloads.openwrt.org/releases/21.02.0/packages/arm_cortex-a15_neon-vfpv4/telephony/Packages.gz
*  CA signer not available for verification
curl: (77)  CA signer not available for verification

The cert is in /etc/ssl/certs/ca-certificates.crt. As the other thread for badcert-expired hints at, problem might be the wolfssl libraries.

[csharper2005]

You can temporarily use opkg with a --no-check-certificate key.

[waynea]

oooh...thank you for that tip!

[Rampler]

Or you can edit the /etc/opkg/distfeeds.conf and change all https to http

[eomanis]

I started installing 21.02 just now for the very first time, and run into this.
That timing, what are the odds? Just my luck lol

[tmomas]

Cert verify failed: BADCERT_EXPIRED (Letsencrypt global root cert)

Server side workaround on downloads.openwrt.org implemented, at least I am able to connect using a vanilla OpenWrt 21.02.0 x86/64 VM now