FIX: DEBIAN/RASPBIAN Jessie (8.3) - curl error: unable get local issuer certificate

[peonmodel]

on raspberry pi 2 Model B, raspbian jessie 4.1

i encountered this issue after the the command meteor/meteor --version

It's the first time you've run Meteor from a git checkout.
I will download a kit containing all of Meteor's dependencies.

curl: (60) SSL certificate problem: unable to get local issuer certificate
More details here: http://curl.haxx.se/docs/sslcerts.html

curl performs SSL certificate verification by default, using a "bundle" of Certificate Authority (CA) public keys (CA certs). If the default bundle file isn't adequate, you can specify an alternate file using the --cacert option.
If this HTTPS server uses a certificate signed by a CA represented in the bundle, the certificate verification probably failed due to a problem with the certificate (it might be expired, or the name might not match the domain name in the URL). If you'd like to turn off curl's verification of the certificate, use the -k (or --insecure) option.

gzip: stdin: not in gzip format
tar: Child returned status 1
tar: Error is not recoverable: exiting now
Failed to install dependency kit.

how may i resolve this? i am quite new to this

---

EDITED BY TOM FREUDENBERG

See current solution described beginning with comment-184304724

[TPXP]

Try installing/upgrading the package ca-certificates with your favourite package manager then launch again meteor. It should be able to connect correctly to the server with the new certificates. Also make sure the date and time of the system is correct, it can cause issues with https connections (expired/not yet valid certificate....)

[daronco]

I have the same problem in a Raspberry Pi 2 Model B with Jessie 4.1 (release date 2016-02-09).
It was installed yesterday and all packages are up-to-date, including ca-certificates. The system time is also correct.

The issue happens when downloading dev_bundle_Linux_armv7l_0.5.16.tar.gz from the domain https://akamai.bintray.com/4c/.... Doesn't happen if I try to curl the same URL from my Ubuntu 15.10.

Tried updating the certificates as described here and here, but no success yet.

So I went for the easy solution for now and just added -k to all curl commands in meteor/meteor.

[TomFreudenberg]

Hey guys,

may that be a temporary problem on akamai or bintray?

I can't reproduce this issue.

I am testing on my NOT YET UPDATED jessie image from december:

curl -v -O https://dl.bintray.com/4commerce-technologies-ag/meteor-universal/arm_dev_bundles/dev_bundle_Linux_armv7l_0.5.16.tar.gz

The responding location for akamai ressource is:

https://akamai.bintray.com/4c/4c414d176a05fd325c7d0210fd8afc4477174526?__gda__=exp=1455535325~hmac=1d5481df6f0827f556f295a51a0da21fa98a0f4e9c6bfb815f27b0739fb1276b&response-content-disposition=attachment%3Bfilename%3D%22dev_bundle_Linux_armv7l_0.5.16.tar.gz%22&response-content-type=application%2Fgzip

when I run then:

curl -O https://akamai.bintray.com/4c/4c414d176a05fd325c7d0210fd8afc4477174526?__gda__=exp=1455535325~hmac=1d5481df6f0827f556f295a51a0da21fa98a0f4e9c6bfb815f27b0739fb1276b&response-content-disposition=attachment%3Bfilename%3D%22dev_bundle_Linux_armv7l_0.5.16.tar.gz%22&response-content-type=application%2Fgzip

everything went fine, even on running meteor --version

Could you please check again on your side if this has been fixed due to updates on akamai or bintray side.

Thanks for feedback
Tom

[TomFreudenberg]

Pretty cool or isn't but after running

apt-get update
apt-get dist-upgrade
apt-get autoremove --purge
apt-get clean

on my raspi, same error as decribed :-(

Pretty bad!

I will try to figure out whats happened

Cheers
Tom

[TomFreudenberg]

Well, I did a fresh Linux Debian 8 (jessie) installation and get the same certification error.

So the last debian package updates has dropped too much or bintray / akamai needs to fix their certificates.

I will open an issue on their side

[TomFreudenberg]

Ok, this is not a problem from akamai nor bintray, current debian stable is faulty.

See discussion at: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=812708

[TomFreudenberg]

FIX UNTIL FIXED BY DEBIAN / RASPBIAN

You have to remove the buggy ca-certificates package and replace it with a previously running and valid package (see raspbian jessie pool). In case that removal will conflict due some other packages you need to enforce this action. But get the former package first:

cd /tmp

curl -L -O "https://archive.raspbian.org/raspbian/pool/main/c/ca-certificates/ca-certificates_20130119+deb7u1_all.deb"

Please check, that this deb file was downloaded correctly before proceeding with removal:

sudo dpkg -P --force-all ca-certificates

Now make a fresh installation with the download package

sudo dpkg -i /tmp/ca-certificates_20130119+deb7u1_all.deb

After that your curl is functional again.

[TomFreudenberg]

@peonmodel @daronco

Could you please check if that procedure will help

Thanks for some comment
Tom

[peonmodel]

thanks, the procedure helps, i no longer have the curl error
i now see

Unreleased, running from a checkout at f1f2df7

btw, just to check, how long is it supposed to take when running create hello-world on raspberry pi 2 model B?
mine has been stuck at Updating package catalog for 25 mins, is it normal?