SSL peer certificate or SSH remote key was not OK

[byroniac]

I'm on Ubuntu 22.10, setup Flathub according to the Setup guide, but when I go to install:

flatpak install --assumeyes org.freefilesync.FreeFileSync

I get the following error and I am stuck at that point:

Error: While downloading https://kparal.fedorapeople.org/mirror/freefilesync/FreeFileSync_11.29_Linux.tar.gz: While fetching https://kparal.fedorapeople.org/mirror/freefilesync/FreeFileSync_11.29_Linux.tar.gz: [60] SSL peer certificate or SSH remote key was not OK error: Failed to install org.freefilesync.FreeFileSync: While downloading https://kparal.fedorapeople.org/mirror/freefilesync/FreeFileSync_11.29_Linux.tar.gz: While fetching https://kparal.fedorapeople.org/mirror/freefilesync/FreeFileSync_11.29_Linux.tar.gz: [60] SSL peer certificate or SSH remote key was not OK

[kparal]

Thanks for the report. I see that more people have this problem on Ubuntu-based distros: https://freefilesync.org/forum/viewtopic.php?t=9969 https://freefilesync.org/forum/viewtopic.php?t=9966

The installation works just fine on Fedora 37, and I even tried two-years old Fedora 33 (directly from a Live image, non-updated) and it works fine as well. OpenSUSE Tumbleweed (latest) works fine too. This only seems to effect Ubuntu and derivatives. I can replicate the issue on Ubuntu 22.10 (containing flatpak-1.14.0-2) running in a VM. Here's a verbose output:

$ flatpak --verbose install org.freefilesync.FreeFileSync
F: No installations directory in /etc/flatpak/installations.d. Skipping
F: Opening system flatpak installation at path /var/lib/flatpak
F: Opening user flatpak installation at path /home/kparal/.local/share/flatpak
Looking for matches\u2026
F: Fetching summary index file for remote \u2018flathub\u2019
F: Loading https://dl.flathub.org/repo/summary.idx using curl
F: Received 2737 bytes
F: Loading https://dl.flathub.org/repo/summaries/980b5cf0f8f5e4fd6f30a3ce9d2a18ffa3a9b26dfb1a7583ff2557d8d7772ab3.idx.sig using curl
F: Received 592 bytes
F: Fetching indexed summary delta de5a793fe2ba0373d28bda5fcf1d5581f4315c23b1a11bfc383aca3c51c61470-ea16afca97382b7a034bda5253f0de83111722ece37b8aece9651f00ad5d100e.delta for remote \u2018flathub\u2019
F: Loading https://dl.flathub.org/repo/summaries/de5a793fe2ba0373d28bda5fcf1d5581f4315c23b1a11bfc383aca3c51c61470-ea16afca97382b7a034bda5253f0de83111722ece37b8aece9651f00ad5d100e.delta using curl
F: Received 2218 bytes
F: Fetching summary index file for remote \u2018flathub\u2019
F: Loading https://dl.flathub.org/repo/summary.idx using curl
F: Received 2737 bytes
F: Loaded indexed summary file ea16afca97382b7a034bda5253f0de83111722ece37b8aece9651f00ad5d100e from cache for remote \u2018flathub\u2019
F: Transaction: install flathub:app/org.freefilesync.FreeFileSync/x86_64/stable[*]
F: Looking for remote metadata updates for flathub
F: marking op install:app/org.freefilesync.FreeFileSync/x86_64/stable resolved to cf075c0520d80fdf6fef39685f4d771405efd45616051e2f79ff4541d5617be1
F: Updating dependency org.gnome.Platform/x86_64/43 of org.freefilesync.FreeFileSync/x86_64/stable
F: Transaction: update flathub:runtime/org.gnome.Platform/x86_64/43[$old]
F: marking op update:runtime/org.gnome.Platform/x86_64/43 resolved to 2e472987d6fb03324dcc9b19e75ee96b3a87918dd8649f9eb64009d6d9007ea4
F: Transaction: install/update flathub:runtime/org.gnome.Platform.Locale/x86_64/43[/cs, /en]
F: Transaction: install/update flathub:runtime/org.freedesktop.Platform.GL.default/x86_64/22.08[*]
F: Transaction: install/update flathub:runtime/org.freedesktop.Platform.GL.default/x86_64/22.08-extra[*]
F: Transaction: install/update flathub:runtime/org.gtk.Gtk3theme.Yaru/x86_64/3.22[*]
F: Transaction: install/update flathub:runtime/org.freedesktop.Platform.openh264/x86_64/2.2.0[*]
F: Transaction: install/update flathub:runtime/org.freefilesync.FreeFileSync.Locale/x86_64/stable[/cs, /en]
F: marking op install/update:runtime/org.freefilesync.FreeFileSync.Locale/x86_64/stable resolved to ca3bee04e3b8a5ee546e4d054825c5cc5c115587eed148899c1d500930f8160e
F: marking op install/update:runtime/org.freedesktop.Platform.openh264/x86_64/2.2.0 resolved to 435b1135f46af01c742f7680e92a2ca2b63ef7f5cb6b75030caff3cdd80481a9
F: marking op install/update:runtime/org.gtk.Gtk3theme.Yaru/x86_64/3.22 resolved to 4b1e043544efb4a6d0278a3a2deaede9f6ff61034589bdb380054121aa098952
F: marking op install/update:runtime/org.freedesktop.Platform.GL.default/x86_64/22.08-extra resolved to 72e97388da174b6feda564f6c6472de36d424297578d6eaa0ced553219030f71
F: marking op install/update:runtime/org.freedesktop.Platform.GL.default/x86_64/22.08 resolved to a3b2d7eb081e95c99dd2beafc30dfbe4fd5faef80660048543f1fee188108ab6
F: marking op install/update:runtime/org.gnome.Platform.Locale/x86_64/43 resolved to 76de00bc41749526c39a5d47c2c45df75a2cb0970990ab402114d7afff3eb624

org.freefilesync.FreeFileSync permissions:
    ipc network pulseaudio  x11 file access [1] dbus access [2]

    [1] host, xdg-run/gvfs, xdg-run/gvfsd
    [2] org.gtk.vfs.*

 1.     org.freefilesync.FreeFileSync   stable  i   flathub < 35,9\u00a0MB

Proceed with these changes to the system installation? [Y/n]: 
Installing\u2026
F: Calling system helper: GetRevokefsFd
F: Calling system helper: GetRevokefsFd
F: flatpak_dir_pull: Using commit cf075c0520d80fdf6fef39685f4d771405efd45616051e2f79ff4541d5617be1 for pull of ref app/org.freefilesync.FreeFileSync/x86_64/stable from remote flathub
Installing\u2026                        0%  0 bytes/s
Installing\u2026 \u2588                      5%
F: Loading https://kparal.fedorapeople.org/mirror/freefilesync/FreeFileSync_11.29_Linux.tar.gz using curl
F: Calling system helper: CancelPull
F: Calling system helper: CancelPull
Error: While downloading https://kparal.fedorapeople.org/mirror/freefilesync/FreeFileSync_11.29_Linux.tar.gz: While fetching https://kparal.fedorapeople.org/mirror/freefilesync/FreeFileSync_11.29_Linux.tar.gz: [60] SSL peer certificate or SSH remote key was not OK
error: Failed to install org.freefilesync.FreeFileSync: While downloading https://kparal.fedorapeople.org/mirror/freefilesync/FreeFileSync_11.29_Linux.tar.gz: While fetching https://kparal.fedorapeople.org/mirror/freefilesync/FreeFileSync_11.29_Linux.tar.gz: [60] SSL peer certificate or SSH remote key was not OK

This line is interesting:

F: Loading https://kparal.fedorapeople.org/mirror/freefilesync/FreeFileSync_11.29_Linux.tar.gz using curl

But when using curl (or wget) manually in a terminal, I can download the archive just fine (and also through Firefox).

I have no expertise with SSL, but I assume this must either a problem in flatpak (it seems be to using a bundled curl which doesn't accept the fedorapeople.org certificate, while system tools do), or in Ubuntu itself. I'll try to raise this issue against flatpak.

[kparal]

Reported against flatpak here: https://github.com/flatpak/flatpak/issues/5253

If the problem doesn't see any movement in some time, I can try to figure out different file hosting (assuming this problem doesn't affect all sites but just some).

[byroniac]

Reported against flatpak here: flatpak/flatpak#5253

If the problem doesn't see any movement in some time, I can try to figure out different file hosting (assuming this problem doesn't affect all sites but just some).

Thank you, so much! I guess it isn't a huge deal as I can always use the .tgz. But I was completely stuck.

[markinson24]

As I opened the thread "FreeFileSync 11.29: unacceptable TLS certificate in Linux Mint 21.1" and, in particular, in the FreeFileSync forum I wrote "In few words, it seems the issue is only under Linux Mint 21.1 (Ubuntu 22.04), not even in Linux Mint 20.3 (Ubuntu 20.04 based). Otherwise I really don't if there is something at repository level ... do you think this could be important to report under Github?", now I'm interesting to understand any develop. Thanks you all for your attention. Cheers!

[kparal]

Those of you proficient with the command line, can you try the test build available in #97? It downloads directly from freefilesync.org, hopefully that might work on Ubuntu and its derivates.

[byroniac]

Those of you proficient with the command line, can you try the test build available in #97? It downloads directly from freefilesync.org, hopefully that might work on Ubuntu and its derivates.

Works for me on Ubuntu 22.10 (Hyper-V)!

[kparal]

@byroniac Can you try the build from #99? We can't use the FFS upstream archive due to issues mentioned in #97 and #98, so I switched archive hosting to Github.

[byroniac]

@byroniac Can you try the build from #99? We can't use the FFS upstream archive due to issues mentioned in #97 and #98, so I switched archive hosting to Github.

Worked in my Ubuntu 22.10 VM (I uninstalled previous and did the CLI install). Thanks.

[kparal]

Thanks, I pushed it to the beta branch and will leave it there for a while for testing, then push it stable.

[kparal]

This should be fixed by 7e50e50d3ed. Please reopen if it happens again.

[markinson24]

So, waiting for stable release in "stable" repository/branch ... if I understand well ...

[markinson24]

I upgraded my version via "Update Manager" to 12.0 version and everything went well! More, now it's available by repository under "Software Manager" this 12.0 version. Thank you all for attention. Cheers!