SSL-errors with apk

xmpp · May 20, 2026, 6:48am

In my /etc/config I had a adblock.apk I was too lazy to diff so I thought I just move away /etc/config/adblock , remove adblock and luci-adblock package (and after that install them again so I had a clean adblock config). I either just happened to notice or I messed something up because after that I keep getting SSL errors:

root@router:~# apk update
wgetSSL verify error: certificate is self-signed or not signed by a trusted CA
ERROR: wget: exited with error 5
WARNING: updating and opening https://downloads.openwrt.org/releases/25.12.4/targets/ath79/generic/packages/packages.adb: unexpected end of file
wgetSSL verify error: certificate is self-signed or not signed by a trusted CA
ERROR: wget: exited with error 5
WARNING: updating and opening https://downloads.openwrt.org/releases/25.12.4/packages/mips_24kc/base/packages.adb: unexpected end of file
wgetSSL verify error: certificate is self-signed or not signed by a trusted CA
ERROR: wget: exited with error 5
WARNING: updating and opening https://downloads.openwrt.org/releases/25.12.4/targets/ath79/generic/kmods/6.12.87-1-bcaa08c25321cf83e5aa78ef3f965153/packages.adb: unexpected end of file
wgetSSL verify error: certificate is self-signed or not signed by a trusted CA
ERROR: wget: exited with error 5
WARNING: updating and opening https://downloads.openwrt.org/releases/25.12.4/packages/mips_24kc/luci/packages.adb: unexpected end of file
wgetSSL verify error: certificate is self-signed or not signed by a trusted CA
ERROR: wget: exited with error 5
WARNING: updating and opening https://downloads.openwrt.org/releases/25.12.4/packages/mips_24kc/packages/packages.adb: unexpected end of file
wgetSSL verify error: certificate is self-signed or not signed by a trusted CA
ERROR: wget: exited with error 5
WARNING: updating and opening https://downloads.openwrt.org/releases/25.12.4/packages/mips_24kc/routing/packages.adb: unexpected end of file
wgetSSL verify error: certificate is self-signed or not signed by a trusted CA
ERROR: wget: exited with error 5
WARNING: updating and opening https://downloads.openwrt.org/releases/25.12.4/packages/mips_24kc/telephony/packages.adb: unexpected end of file
wgetSSL verify error: certificate is self-signed or not signed by a trusted CA
ERROR: wget: exited with error 5
WARNING: updating and opening https://downloads.openwrt.org/releases/25.12.4/packages/mips_24kc/video/packages.adb: unexpected end of file
8 unavailable, 0 stale; 214 distinct packages available

Searching the forum for other users solutions I was not able to solve it.

frollic · May 20, 2026, 6:52am

does nslookup work from the router ?

is the time and date correct on the router ?

xmpp · May 20, 2026, 6:55am

Time should be fine (did date command in different terminal after each other so therefore slightly different but it's in sync)

# Router
root@router:~# date
Wed May 20 09:53:22 EEST 2026
# Linux laptop
$ date
Wed May 20 09:53:19 AM EEST 2026

root@router:~# nslookup duckduckgo.com
Server:		127.0.0.1
Address:	127.0.0.1:53

Non-authoritative answer:

Non-authoritative answer:
Name:	duckduckgo.com
Address: 40.114.177.156

xmpp · May 20, 2026, 6:58am

I tried an unattended sysupgrade with keeping config which went through but issue still persist. Ideally I'd like to solve it without a clean flash, but that would be the last resort.

I am not seeing any issues with using devices in my network, only apk-command on router giving those SSL-errors.

I can't search either:

root@router:~# apk search ssl
WARNING: opening from cache https://downloads.openwrt.org/releases/25.12.4/targets/ath79/generic/packages/packages.adb: No such file or directory
WARNING: opening from cache https://downloads.openwrt.org/releases/25.12.4/packages/mips_24kc/base/packages.adb: No such file or directory
WARNING: opening from cache https://downloads.openwrt.org/releases/25.12.4/targets/ath79/generic/kmods/6.12.87-1-bcaa08c25321cf83e5aa78ef3f965153/packages.adb: No such file or directory
WARNING: opening from cache https://downloads.openwrt.org/releases/25.12.4/packages/mips_24kc/luci/packages.adb: No such file or directory
WARNING: opening from cache https://downloads.openwrt.org/releases/25.12.4/packages/mips_24kc/packages/packages.adb: No such file or directory
WARNING: opening from cache https://downloads.openwrt.org/releases/25.12.4/packages/mips_24kc/routing/packages.adb: No such file or directory
WARNING: opening from cache https://downloads.openwrt.org/releases/25.12.4/packages/mips_24kc/telephony/packages.adb: No such file or directory
WARNING: opening from cache https://downloads.openwrt.org/releases/25.12.4/packages/mips_24kc/video/packages.adb: No such file or directory
root@router:~#

frollic · May 20, 2026, 7:01am

don't have access to any device atm, so I'm shooting from the hip; edit /etc/apk/repositories.d/distfeeds.list, try replacing HTTPS in the package repo URLs with HTTP.

ncompact · May 20, 2026, 7:02am

apk update; apk search ssl

xmpp · May 20, 2026, 7:04am

root@router:~# apk update; apk search ssl
wgetSSL verify error: certificate is self-signed or not signed by a trusted CA
ERROR: wget: exited with error 5
WARNING: updating and opening https://downloads.openwrt.org/releases/25.12.4/targets/ath79/generic/packages/packages.adb: unexpected end of file
wgetSSL verify error: certificate is self-signed or not signed by a trusted CA
ERROR: wget: exited with error 5
WARNING: updating and opening https://downloads.openwrt.org/releases/25.12.4/packages/mips_24kc/base/packages.adb: unexpected end of file
wgetSSL verify error: certificate is self-signed or not signed by a trusted CA
ERROR: wget: exited with error 5
WARNING: updating and opening https://downloads.openwrt.org/releases/25.12.4/targets/ath79/generic/kmods/6.12.87-1-bcaa08c25321cf83e5aa78ef3f965153/packages.adb: unexpected end of file
wgetSSL verify error: certificate is self-signed or not signed by a trusted CA
ERROR: wget: exited with error 5
WARNING: updating and opening https://downloads.openwrt.org/releases/25.12.4/packages/mips_24kc/luci/packages.adb: unexpected end of file
wgetSSL verify error: certificate is self-signed or not signed by a trusted CA
ERROR: wget: exited with error 5
WARNING: updating and opening https://downloads.openwrt.org/releases/25.12.4/packages/mips_24kc/packages/packages.adb: unexpected end of file
wgetSSL verify error: certificate is self-signed or not signed by a trusted CA
ERROR: wget: exited with error 5
WARNING: updating and opening https://downloads.openwrt.org/releases/25.12.4/packages/mips_24kc/routing/packages.adb: unexpected end of file
wgetSSL verify error: certificate is self-signed or not signed by a trusted CA
ERROR: wget: exited with error 5
WARNING: updating and opening https://downloads.openwrt.org/releases/25.12.4/packages/mips_24kc/telephony/packages.adb: unexpected end of file
wgetSSL verify error: certificate is self-signed or not signed by a trusted CA
ERROR: wget: exited with error 5
WARNING: updating and opening https://downloads.openwrt.org/releases/25.12.4/packages/mips_24kc/video/packages.adb: unexpected end of file
8 unavailable, 0 stale; 214 distinct packages available
WARNING: opening from cache https://downloads.openwrt.org/releases/25.12.4/targets/ath79/generic/packages/packages.adb: No such file or directory
WARNING: opening from cache https://downloads.openwrt.org/releases/25.12.4/packages/mips_24kc/base/packages.adb: No such file or directory
WARNING: opening from cache https://downloads.openwrt.org/releases/25.12.4/targets/ath79/generic/kmods/6.12.87-1-bcaa08c25321cf83e5aa78ef3f965153/packages.adb: No such file or directory
WARNING: opening from cache https://downloads.openwrt.org/releases/25.12.4/packages/mips_24kc/luci/packages.adb: No such file or directory
WARNING: opening from cache https://downloads.openwrt.org/releases/25.12.4/packages/mips_24kc/packages/packages.adb: No such file or directory
WARNING: opening from cache https://downloads.openwrt.org/releases/25.12.4/packages/mips_24kc/routing/packages.adb: No such file or directory
WARNING: opening from cache https://downloads.openwrt.org/releases/25.12.4/packages/mips_24kc/telephony/packages.adb: No such file or directory
WARNING: opening from cache https://downloads.openwrt.org/releases/25.12.4/packages/mips_24kc/video/packages.adb: No such file or directory

xmpp · May 20, 2026, 7:05am

Thanks, I could see this being potential, but it feels a little scary running without encryption. I will consider it but right now I don't want to try that, I'd rather reflash and start from scratch.

ncompact · May 20, 2026, 7:07am

are there files in this directory?

ls -l /etc/ssl/certs

frollic · May 20, 2026, 7:08am

it's for now, to fix the issue, change it back afterwards.

xmpp · May 20, 2026, 7:08am

This is obviously the problem:

root@router:~# ls -l /etc/ssl/certs
ls: /etc/ssl/certs: No such file or directory

ncompact · May 20, 2026, 7:10am

you have them here do you have the possibility to restore them?

ls -l /rom/etc/ssl/certs

xmpp · May 20, 2026, 7:11am

root@router:~# ls -l /rom/etc/ssl/certs
ls: /rom/etc/ssl/certs: No such file or directory

lleachii · May 20, 2026, 7:11am

Double posting?

xmpp · May 20, 2026, 7:12am

Okay, update runs after that yeah.

root@router:~# apk update
 [http://downloads.openwrt.org/releases/25.12.4/targets/ath79/generic/packages/packages.adb]
 [http://downloads.openwrt.org/releases/25.12.4/packages/mips_24kc/base/packages.adb]
 [http://downloads.openwrt.org/releases/25.12.4/targets/ath79/generic/kmods/6.12.87-1-bcaa08c25321cf83e5aa78ef3f965153/packages.adb]
 [http://downloads.openwrt.org/releases/25.12.4/packages/mips_24kc/luci/packages.adb]
 [http://downloads.openwrt.org/releases/25.12.4/packages/mips_24kc/packages/packages.adb]
 [http://downloads.openwrt.org/releases/25.12.4/packages/mips_24kc/routing/packages.adb]
 [http://downloads.openwrt.org/releases/25.12.4/packages/mips_24kc/telephony/packages.adb]
 [http://downloads.openwrt.org/releases/25.12.4/packages/mips_24kc/video/packages.adb]
OK: 10964 distinct packages available

frollic · May 20, 2026, 7:12am

try doing an in place upgrade using ASU or OWUT, or at least extract the package list and build a new image using firmware-selector.

there might be a HTTPS somewhere in the ASU conf file located in /etc/config.

orangepizza · May 20, 2026, 7:16am

upload this https://downloads.openwrt.org/releases/25.12.4/packages/mips_24kc/base/ca-bundle-20260223-r1.apk into your router manually then install it apk add

frollic · May 20, 2026, 7:19am

might need to add the allow-untrusted param when running apk.

(replied to the wrong person, sorry)

xmpp · May 20, 2026, 7:26am

Awesome this fixed it!

linuxlaptop$ scp ca-bundle-20260223-r1.apk router:.
ash: /usr/libexec/sftp-server: not found
scp: Connection closed
linuxlaptop$ cat ca-bundle-20260223-r1.apk | ssh router 'cat > /tmp/ca-bundle.apk'
linuxlaptop$ ssh router
root@router:~# apk add --allow-untrusted /tmp/ca-bundle.apk
(1/1) Installing ca-bundle (20260223-r1)
  Executing ca-bundle-20260223-r1.post-install
OK: 23.2 MiB in 215 packages
root@router:~# vim /etc/apk/repositories.d/distfeeds.list
root@router:~# cat /etc/apk/repositories.d/distfeeds.list
https://downloads.openwrt.org/releases/25.12.4/targets/ath79/generic/packages/packages.adb
https://downloads.openwrt.org/releases/25.12.4/packages/mips_24kc/base/packages.adb
https://downloads.openwrt.org/releases/25.12.4/targets/ath79/generic/kmods/6.12.87-1-bcaa08c25321cf83e5aa78ef3f965153/packages.adb
https://downloads.openwrt.org/releases/25.12.4/packages/mips_24kc/luci/packages.adb
https://downloads.openwrt.org/releases/25.12.4/packages/mips_24kc/packages/packages.adb
https://downloads.openwrt.org/releases/25.12.4/packages/mips_24kc/routing/packages.adb
https://downloads.openwrt.org/releases/25.12.4/packages/mips_24kc/telephony/packages.adb
https://downloads.openwrt.org/releases/25.12.4/packages/mips_24kc/video/packages.adb
root@router:~# apk update
 [https://downloads.openwrt.org/releases/25.12.4/targets/ath79/generic/packages/packages.adb]
 [https://downloads.openwrt.org/releases/25.12.4/packages/mips_24kc/base/packages.adb]
 [https://downloads.openwrt.org/releases/25.12.4/targets/ath79/generic/kmods/6.12.87-1-bcaa08c25321cf83e5aa78ef3f965153/packages.adb]
 [https://downloads.openwrt.org/releases/25.12.4/packages/mips_24kc/luci/packages.adb]
 [https://downloads.openwrt.org/releases/25.12.4/packages/mips_24kc/packages/packages.adb]
 [https://downloads.openwrt.org/releases/25.12.4/packages/mips_24kc/routing/packages.adb]
 [https://downloads.openwrt.org/releases/25.12.4/packages/mips_24kc/telephony/packages.adb]
 [https://downloads.openwrt.org/releases/25.12.4/packages/mips_24kc/video/packages.adb]
OK: 10965 distinct packages available

I still don't know why it happened. My theory is when I tried removeing adblock earlier it either pulled ca-bundle as a dependency or I added some other package by mistake that also included the ca-bundle? I've done a few unattanded sysupgrades in a row, but I don't think that would relate to this.

Either way, thank you everybody for so fast replies. Very appreciated!

frollic · May 20, 2026, 7:30am

yes, this is most likely the reason, sometimes luci gets uninstalled when you uninstall some other package too.