bsclifton
commented
4 years ago cc: @mbacchi @mihaiplesa @fmarier
Closed jsandiego closed 4 years ago
bsclifton
commented
4 years ago cc: @mbacchi @mihaiplesa @fmarier
fmarier
commented
4 years ago Strange, I just updated my browser successfully using the apt repo.
[IP: ::ffff:146.112.61.106 443]
This suggests you're trying to access the repo over IPv6. However, from my machine, I can't see an IPv6 for that hostname:
$ dig AAAA brave-browser-apt-release.s3.brave.com
; <<>> DiG 9.11.3-1ubuntu1.11-Ubuntu <<>> AAAA brave-browser-apt-release.s3.brave.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 58278
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 65494
;; QUESTION SECTION:
;brave-browser-apt-release.s3.brave.com. IN AAAA
;; ANSWER SECTION:
brave-browser-apt-release.s3.brave.com. 81 IN CNAME u2.shared.global.fastly.net.
;; Query time: 12 msec
;; SERVER: 127.0.0.53#53(127.0.0.53)
;; WHEN: Wed Jan 08 11:17:24 PST 2020
;; MSG SIZE rcvd: 108There seems to be something wrong with DNS somewhere. I don't think you're connecting to the right server.
Can you try forcing one of the IPv4 addresses for that hostname in your /etc/hosts to see if you get a different result?
e.g. 151.101.2.217 brave-browser-apt-release.s3.brave.com
jsandiego
commented
4 years ago Looks like OpenDNS blocked the IP that brave-browser-apt-release.s3.brave.com resolved to for me:
[2075]jsandiego ~: sudo systemd-resolve -4 brave-browser-apt-release.s3.brave.com
brave-browser-apt-release.s3.brave.com: 146.112.61.106
-- Information acquired via protocol DNS in 17.4ms.
-- Data is authenticated: no
Using the IP you provided allowed me to update.
fmarier
commented
4 years ago Ah yes, OpenDNS mistakenly blocked us yesterday: https://www.reddit.com/r/BATProject/comments/ela2o0/bravecom_sites_being_blocked_by_opendns/
They have apparently rolled out a fix on their end, but DNS caching being what it is, it might take another day to clear up.
rebron
commented
4 years ago @jsandiego Is this still an issue for you?
jsandiego
commented
4 years ago My DNS no longer resolves to the IP address that was giving me the issue, so it is no longer an issue for me.
mbacchi
commented
4 years ago Closing, reopen if necessary.
cdphan
commented
1 year ago Hi there,
I am seeing this error messageagain, running Linux Mint 22.02. Don't know whether it is a same issue on OpenDNS. Is there a ticket opened / reopned. I am using Public Library network, and was able to upgrade brave browser before without any issue until couple weeks ago..
Hit:1 http://mirror.math.ucdavis.edu/ubuntu focal InRelease
Hit:2 http://mirror.math.ucdavis.edu/ubuntu focal-updates InRelease
Hit:3 http://mirror.math.ucdavis.edu/ubuntu focal-backports InRelease
Ign:4 http://packages.linuxmint.com uma InRelease
Ign:5 https://brave-browser-apt-release.s3.brave.com stable InRelease
Hit:6 http://security.ubuntu.com/ubuntu focal-security InRelease
Hit:7 http://packages.linuxmint.com uma Release
Hit:8 https://dl.google.com/linux/chrome/deb stable InRelease
Err:9 https://brave-browser-apt-release.s3.brave.com stable Release
Certificate verification failed: The certificate is NOT trusted. The certificate issuer is unknown. Could not handshake: Error in the certificate verification. [IP: 65.8.158.8 443]
cat /etc/hosts 127.0.0.1 localhost 127.0.1.1 vq2-HP-EliteBook-Folio-9470m
::1 ip6-localhost ip6-loopback fe00::0 ip6-localnet ff00::0 ip6-mcastprefix ff02::1 ip6-allnodes ff02::2 ip6-allrouters
$ dig AAAA brave-browser-apt-release.s3.brave.com
; <<>> DiG 9.16.1-Ubuntu <<>> AAAA brave-browser-apt-release.s3.brave.com ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 43317 ;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 65494 ;; QUESTION SECTION: ;brave-browser-apt-release.s3.brave.com. IN AAAA
;; ANSWER SECTION: brave-browser-apt-release.s3.brave.com. 300 IN CNAME d9owkidwx4k9e.cloudfront.net.
;; Query time: 48 msec ;; SERVER: 127.0.0.53#53(127.0.0.53) ;; WHEN: Thu Oct 06 20:01:08 PDT 2022 ;; MSG SIZE rcvd: 109
Thank you
wknapik
commented
1 year ago @cdphan there are no images for Mint 22 at hub.docker.com, but in a Mint 21 container the instructions from brave.com/linux appear to be working fine. Could this be a local issue? Have you tried following the official installation instructions again? Is the system clock set up correctly? Does reinstalling ca-certificates change anything?
GuiltySpark7
commented
11 months ago @cdphan, I just came across the same problem in LM 21.2 ( i assume your 22.02 was a typo as LM 22 isn't out yet) on a public library wifi. Switching to data changed the error message from the same as the OP to a Notification:
N: Skipping acquisition of configured file 'main/binary-i386/Packages', as repository 'https://brave-browser-apt-release.s3.brave.com stable InRelease' doesn't support architecture 'i386'
Which i solved by changing my /etc/apt/sources.list.d/brave-browser-release.list to specify ARM64 architecture as i have a 64bit machine and i386 is 32 bit, so my brave-browser-release.list now looks like:
deb [arch=amd64 signed-by=/usr/share/keyrings/brave-browser-archive-keyring.gpg] https://brave-browser-apt-release.s3.brave.com/ stable main
I'm not sure if the i386 architecture bit is related but i thought i would include all my steps incase it was a compound of problems. My knowledge is limited so i don't pretend to understand the whole picture.
Summary: if on LM22 on public wifi, try changing from public Wifi, If you are getting 'i386' notification then edit the apt source list file as above. Useful link to take you through that step by step is:
https://itsfoss.com/repository-doesnt-support-architecture-i386/
wknapik
commented
11 months ago @GuiltySpark7 I'm afraid I can't reproduce any of the issues by following the instructions from brave.com/linux in a linuxmintd/mint21-amd64 container.
Issues specific to a network would be best discussed with its maintainer. If you share the output of openssl s_client -connect brave-browser-apt-release.s3.brave.com:443 -servername brave-browser-apt-release.s3.brave.com -showcerts </dev/null we could see what certificate you're seeing and maybe spot an issue there.
As for the architecture - I also didn't run into this. Per https://wiki.debian.org/Multiarch/HOWTO, you can check your currently selected architecture with dpkg --print-architecture and other available architectures with dpkg --print-foreign-architectures. Architectures can be added/removed via dpkg --add-architecture/dpkg --remove-architecture.
GuiltySpark7
commented
11 months ago @wknapik impressively fast reply. Sorry I should have been more clear, I solved my problem and wanted to share my solution as my problem lead me to this thread and reading cdphans post I was not the first so I reckoned I wouldn't be the last. It might be a simple solution of changing network for many who visit and I wanted to deflect them from a potentially unnecessary rabbit hole (that I went down). I understand that a conversation with the library network maintainer might help but this is clearly a common problem and also good luck finding such a person, I am in a van, outside a library which is opened 3 hours a week 9-12 on a Friday xD
I think the architecture was a default problem thing twith changing folders that is explained in https://itsfoss.com/repository-doesnt-support-architecture-i386/
DONE
And on mobile phone data:
DONE
[3]+ Stopped sudo notepad /etc/apt/sources.list.d/brave-browser-release.list
I can still recreate the warning message if I try sudo apt update on the Library Wifi, but no message if i am on phone data
wknapik
commented
11 months ago @GuiltySpark7 the s_client outputs you shared for the library network and your phone are identical. They're also different to what I'm getting. You seem to be getting a certificate issued by Fortinet, while one issued by Amazon would be expected.
I'm guessing the outputs being the same on both networks might be a copy/paste mistake?
In any case, it seems like either some local configuration is causing this (perhaps a custom DNS, or VPN), or the network administrator might be doing something unusual.
The IPs brave-browser-apt-release.s3.brave.com resolves to are not static, but it should look something like this
% host brave-browser-apt-release.s3.brave.com
brave-browser-apt-release.s3.brave.com is an alias for d9owkidwx4k9e.cloudfront.net.
d9owkidwx4k9e.cloudfront.net has address 18.172.170.35
d9owkidwx4k9e.cloudfront.net has address 18.172.170.34
d9owkidwx4k9e.cloudfront.net has address 18.172.170.73
d9owkidwx4k9e.cloudfront.net has address 18.172.170.41
%If it doesn't for you, that would confirm my speculation above.
GuiltySpark7
commented
11 months ago @wknapik Ahh yes you are right, a copy and paste error, sorry not sure how i managed that. when I am on phone data and able to update fine, I get a certificate from amazon
I haven't messed around with my DNS or VPN that i am aware of and all that I am changing is whether my phone (acting as hotspot) uses the Library WiFi or Data. My thoughts lean towards "administrator might be doing something unusual." But i don't know nearly as much as you. Thanks a lot for deepening my understanding and taking time, the internet is a better place for the likes of you.
I am satisfied :)
wknapik
commented
11 months ago Thank you for the kind words @GuiltySpark7 :) It does look like the library is doing something weird. To anyone who finds this issue in the future - if you're seeing similar symptoms, it's likely a similar problem and changing networks (including by getting on a VPN) will likely resolve it.
mschfh
commented
6 months ago Fortinet is a firewall vendor, some of the products include SSL/TLS inspection, which can be configured per-category (e.g. to allow virus scanning for "Software Download" sites).
Their database lookup shows the following changes:
Oct 21, 2022 @ 09:30:09 PDT updated as Freeware and Software Downloads
Jan 04, 2024 @ 17:35:13 PST updated as Information Technology
@GuiltySpark7 is this still an issue?
GuiltySpark7
commented
6 months ago sorry I will probably not be back to the same library for many months. I have not seen it as a error in a while though. Might be because I have changed country (Original error found at Canadian library, I am now in Spain). I might be back in Canada in the next few months, if I manage to replicate the error I will post here, If there is radio silence then the error is not happening
Description
Certificate verification failed when trying to update using apt-get on Ubuntu.
Err:4 https://brave-browser-apt-release.s3.brave.com bionic Release Certificate verification failed: The certificate is NOT trusted. The certificate issuer is unknown. Could not handshake: Error in the certificate verification. [IP: ::ffff:146.112.61.106 443]Steps to Reproduce
sudo apt-get updateActual result:
Get cert error when trying to update using apt-get.
Expected result:
Actually update when using apt-get.
Reproduces how often:
Easily reproduced.
Brave version (brave://version info)
Brave | 1.1.23 Chromium: 79.0.3945.88 (Official Build) (64-bit) Revision | c2a58a36b9411c80829b4b154bfcab97e581f1f3-refs/branch-heads/3945@{#954} OS | Linux
Other Additional Information:
The cert error when attempting to go to the URL of repo:
NET::ERR_CERT_AUTHORITY_INVALID Subject: brave-browser-apt-release.s3.brave.com
Issuer: Cisco Umbrella Secondary SubCA dfw-SG
Expires on: Jan 11, 2020
Current date: Jan 8, 2020
PEM encoded chain: -----BEGIN CERTIFICATE----- MIIDdzCCAl+gAwIBAgIEXhXXlTANBgkqhkiG9w0BAQsFADBAMQ4wDAYDVQQKDAVD aXNjbzEuMCwGA1UEAwwlQ2lzY28gVW1icmVsbGEgU2Vjb25kYXJ5IFN1YkNBIGRm dy1TRzAeFw0yMDAxMDYxMzA3MjZaFw0yMDAxMTExMzA3MjZaMIGDMQswCQYDVQQG EwJVUzETMBEGA1UECAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNU2FuIEZyYW5jaXNj bzEWMBQGA1UECgwNT3BlbkROUywgSW5jLjEvMC0GA1UEAwwmYnJhdmUtYnJvd3Nl ci1hcHQtcmVsZWFzZS5zMy5icmF2ZS5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IB DwAwggEKAoIBAQDTbvCpq+tRX0ND1wsYdLHZZkLOD66DATbS60/JgGVUNb9zV5W4 FeWctINkYB//2uklUZ8ktt5UC1pwRuoa5KWXjqXzndInsJVdJUtA6MiV1UaciRMP 8dMFWvrWfK0RBife1eA2fe1b+fKeGNlPOBCW5XZqaQ1p/A6A9OeMXFklRJTr93eG +3KppykYwosWfeYfSln04vS4wTbTjZX6LiTbZteS/nP1BIJ/4Q45RTioRIy362DN B2uzM+ltplMJh/W+8Q/kcQseJX7W+dto/FTniXT0CqouGmVGim1FekYSSLJTbTHD 1AxEfpLpKAuJ15Bh2D0KiOiNlUPB9BV1fl4RAgMBAAGjNTAzMDEGA1UdEQQqMCiC JmJyYXZlLWJyb3dzZXItYXB0LXJlbGVhc2UuczMuYnJhdmUuY29tMA0GCSqGSIb3 DQEBCwUAA4IBAQAyBXgtOJqO0m/S/Ju3Asq5HFkFWdwOAentyBM8ol7bp6tkJ14D bxDHVZnYKzMapVXzxVDqiIUwUm5BVTfk+80+R5gsyyR7etZi7Pz5Q3vMskpZGCMQ 9Ihh4w+AmTPpkbVe1lbe8yg5IobZBGK7AmF1qipRIDYuKYMFOInUUjVJgg7d5qnS jhU9/wjnygDRUlLorD/gcXIdhq70m+wSnbJamnwX/At/MPVt9R5k80WqHY2veGJf paHt2ic/qoafsHDDeUQRd1d48spUULT1ZJ2BwAQ1ER1xawhX1hogom/zgXMxlnfN b6+QeL65hZ/G7koUXHzq45SkJxl/jjTkUxWK -----END CERTIFICATE----- -----BEGIN CERTIFICATE----- MIIEJzCCAw+gAwIBAgIRANneUZPYX0NIjR5UolwU07swDQYJKoZIhvcNAQELBQAw cTELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNhbGlmb3JuaWExFjAUBgNVBAcMDVNh biBGcmFuY2lzY28xDjAMBgNVBAoMBUNpc2NvMSUwIwYDVQQDDBxDaXNjbyBVbWJy ZWxsYSBQcmltYXJ5IFN1YkNBMB4XDTIwMDEwNzA1MjIyMVoXDTIwMDExODA1MjIy MVowQDEOMAwGA1UECgwFQ2lzY28xLjAsBgNVBAMMJUNpc2NvIFVtYnJlbGxhIFNl Y29uZGFyeSBTdWJDQSBkZnctU0cwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEK AoIBAQDTbvCpq+tRX0ND1wsYdLHZZkLOD66DATbS60/JgGVUNb9zV5W4FeWctINk YB//2uklUZ8ktt5UC1pwRuoa5KWXjqXzndInsJVdJUtA6MiV1UaciRMP8dMFWvrW fK0RBife1eA2fe1b+fKeGNlPOBCW5XZqaQ1p/A6A9OeMXFklRJTr93eG+3KppykY wosWfeYfSln04vS4wTbTjZX6LiTbZteS/nP1BIJ/4Q45RTioRIy362DNB2uzM+lt plMJh/W+8Q/kcQseJX7W+dto/FTniXT0CqouGmVGim1FekYSSLJTbTHD1AxEfpLp KAuJ15Bh2D0KiOiNlUPB9BV1fl4RAgMBAAGjgeowgecwEgYDVR0TAQH/BAgwBgEB /wIBADAOBgNVHQ8BAf8EBAMCAYYwHQYDVR0OBBYEFMyv1Omq+mUAxnWxPmuAU0sL nCJWMB8GA1UdIwQYMBaAFEVf9ZtxMyWpwE48AkTPPOhGBhbEMIGABggrBgEFBQcB AQR0MHIwIwYIKwYBBQUHMAGGF2h0dHA6Ly9vY3NwLm9wZW5kbnMuY29tMEsGCCsG AQUFBzAChj9odHRwOi8vY2FjZXJ0cy5vcGVuZG5zLmNvbS9EOURFNTE5M0Q4NUY0 MzQ4OEQxRTU0QTI1QzE0RDNCQi5jcnQwDQYJKoZIhvcNAQELBQADggEBAJtFnDtg Ne6UdkjJuZD+7tQ+l/2hKQVqzPXjuwZiklaMezdkRq0rZ6PNcxWQvzYQD4ISUXcC qE12RsaOtRjhyoljjeAaPR9P693i+g5YHhSEaDBwRNzaOZkUO5DEe/8cbc2kVBR+ Y9ZS96qmXBREuQAcNii5F0bbmv9SNmDdrmA82D6hNCvxpX+6+ut2O+6mv/6pGoNJ SooSCUF7JVafaAQtL8czJ+FrfEKv4LrpqxmR+yWpur5/oaTXSCUgxInqF431SstY 2O/Se4KQEO8Yapsb3HbLcQyRQTYvhkSU91DTrZu/m+5uh1IrnuWUld5yMpJEaMiK sGpxfF4ZB6DN2SE= -----END CERTIFICATE----- -----BEGIN CERTIFICATE----- MIIEuzCCA6OgAwIBAgIJAcQ3zFeNvKYVMA0GCSqGSIb3DQEBCwUAMDExDjAMBgNV BAoTBUNpc2NvMR8wHQYDVQQDExZDaXNjbyBVbWJyZWxsYSBSb290IENBMB4XDTE5 MDUyMTE5NTMxOFoXDTI0MDUyMTE5NTMxOFowcTELMAkGA1UEBhMCVVMxEzARBgNV BAgMCkNhbGlmb3JuaWExFjAUBgNVBAcMDVNhbiBGcmFuY2lzY28xDjAMBgNVBAoM BUNpc2NvMSUwIwYDVQQDDBxDaXNjbyBVbWJyZWxsYSBQcmltYXJ5IFN1YkNBMIIB IjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAuFEhA5TkN8CiGmW7XjaUbuve U274v0kt6hRW8UUakmbyLnkI4d/BBQrGW71LYiT2QH4UaoYuihTXjuyAlzDxJ9OQ Vje2NB9RdE3FcUCISeW5GrQs7vF2xFrjs2TGgG4ZXjE/8WymgFZP50nsTJYf7VqL 1r6Brs59DAbbQ1rVvsz/DFxoE3ruFagSFcOF07/watUxFrAPV+S/kK6Nb5TqrI1j 32hK6i49ujavDcbbb12aozwdoyPSyhs4cB0sCXFHK/yEdaE4CNXEAH8EjKUuj6O2 QUvRtBGM480688BId0T0ws3q+hSzRiVJ+dYCr3iufmTrAMhVwc+EzGjlEfLyXwID AQABo4IBlDCCAZAwDgYDVR0PAQH/BAQDAgGGMBIGA1UdEwEB/wQIMAYBAf8CAQEw UgYDVR0gBEswSTBHBgorBgEEAQkVAR0AMDkwNwYIKwYBBQUHAgEWK2h0dHA6Ly93 d3cuY2lzY28uY29tL3NlY3VyaXR5L3BraS9wb2xpY2llcy8wHQYDVR0OBBYEFEVf 9ZtxMyWpwE48AkTPPOhGBhbEMEwGA1UdHwRFMEMwQaA/oD2GO2h0dHA6Ly93d3cu Y2lzY28uY29tL3NlY3VyaXR5L3BraS9jcmwvY2lzY291bWJyZWxsYXJvb3QuY3Js MIGHBggrBgEFBQcBAQR7MHkwSQYIKwYBBQUHMAKGPWh0dHA6Ly93d3cuY2lzY28u Y29tL3NlY3VyaXR5L3BraS9jZXJ0cy9jaXNjb3VtYnJlbGxhcm9vdC5jZXIwLAYI KwYBBQUHMAGGIGh0dHA6Ly9wa2ljdnMuY2lzY28uY29tL3BraS9vY3NwMB8GA1Ud IwQYMBaAFENzAN4kukAaQFQsfXzVAEiJDHCkMA0GCSqGSIb3DQEBCwUAA4IBAQC6 P7ugvpQSkNxrzY1ZM0Nd9Q3LaoTERS4ItcxMsswFPl7ID/3Vk3v3ZT6KgtCZ+Nh0 MUgZztLATHf42ZppdSkdMf1HfCmLSWORz/eK+fZxztE63M1EGiZJoe8qFKT9z6qx iDD989jyjY74sYfiSo5nbhcb5meUrUO6MQvOO5pUnlhWsDiBUg+yBzyfVoLnGRlY 2t7UZVTUz5kbBNFieTIt86yaYAumgOqriz/dCgQltFySbOkrgg/PN7cRv3IWm84C uKQ9prsXbXLLbl8U+bGRH119prl3zJyRnQ0D+ursCqUnIfziBdKv7yLsupGDGt+Q oqLzmkMPYE+WZmEi+3j5 -----END CERTIFICATE-----
Miscellaneous Information:
brave-browser-apt-release.s3.brave.com.txt