Cannot install mssql-tools-18 on Ubuntu - Certificate not trusted (22.04) or not signed (24.04)

[JMeisnerEpicor]

Describe the issue Cannot install mssql-tools-18 on Ubuntu 24.04

When did the issue occur? Nov. 7th 2024

If applicable, what package did you attempt to install, and from which repo? mssql-tools18

Steps to Reproduce Ubuntu directions from microsoft: https://learn.microsoft.com/en-us/sql/linux/sql-server-linux-setup-tools?view=sql-server-ver16&tabs=ubuntu-install

Actual Result

• using 24.04 with the command from the microsoft site running sudo apt-get update using the below command gives a signature couldn't be trusted error

sudo curl https://packages.microsoft.com/config/ubuntu/24.04/prod.list | sudo tee /etc/apt/sources.list.d/mssql-release.list

Get:1 https://packages.microsoft.com/ubuntu/24.04/prod noble InRelease [3600 B] Err:1 https://packages.microsoft.com/ubuntu/24.04/prod noble InRelease The following signatures couldn't be verified because the public key is not available: NO_PUBKEY EB3E94ADBE1229CF Hit:2 http://security.ubuntu.com/ubuntu noble-security InRelease Hit:3 http://archive.ubuntu.com/ubuntu noble InRelease Hit:4 http://archive.ubuntu.com/ubuntu noble-updates InRelease Hit:5 http://archive.ubuntu.com/ubuntu noble-backports InRelease Reading package lists... Done W: GPG error: https://packages.microsoft.com/ubuntu/24.04/prod noble InRelease: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY EB3E94ADBE1229CF E: The repository 'https://packages.microsoft.com/ubuntu/24.04/prod noble InRelease' is not signed. N: Updating from such a repository can't be done securely, and is therefore disabled by default. N: See apt-secure(8) manpage for repository creation and user configuration details.

• using 22.04 url from the microsoft site apt-get update will update successfully

sudo apt-get update Hit:1 http://archive.ubuntu.com/ubuntu noble InRelease Hit:2 http://security.ubuntu.com/ubuntu noble-security InRelease Hit:3 http://archive.ubuntu.com/ubuntu noble-updates InRelease Hit:4 http://archive.ubuntu.com/ubuntu noble-backports InRelease Hit:5 https://packages.microsoft.com/ubuntu/22.04/prod jammy InRelease Reading package lists... Done

However it wont install mssql-tools18

$ sudo apt-get install mssql-tools18 Reading package lists... Done Building dependency tree... Done Reading state information... Done The following additional packages will be installed: libltdl7 libodbc2 libodbcinst2 msodbcsql18 odbcinst unixodbc unixodbc-common Suggested packages: odbc-postgresql tdsodbc The following NEW packages will be installed: libltdl7 libodbc2 libodbcinst2 msodbcsql18 mssql-tools18 odbcinst unixodbc unixodbc-common 0 upgraded, 8 newly installed, 0 to remove and 8 not upgraded. Need to get 1242 kB of archives. After this operation, 1151 kB of additional disk space will be used. Do you want to continue? [Y/n] y Get:1 http://archive.ubuntu.com/ubuntu noble/main amd64 libltdl7 amd64 2.4.7-7build1 [40.3 kB] Get:2 http://archive.ubuntu.com/ubuntu noble-updates/main amd64 libodbc2 amd64 2.3.12-1ubuntu0.24.04.1 [158 kB] Get:3 http://archive.ubuntu.com/ubuntu noble-updates/main amd64 unixodbc-common all 2.3.12-1ubuntu0.24.04.1 [8806 B] Get:4 http://archive.ubuntu.com/ubuntu noble-updates/main amd64 libodbcinst2 amd64 2.3.12-1ubuntu0.24.04.1 [30.7 kB] Get:5 http://archive.ubuntu.com/ubuntu noble-updates/main amd64 odbcinst amd64 2.3.12-1ubuntu0.24.04.1 [9672 B] Get:6 http://archive.ubuntu.com/ubuntu noble-updates/universe amd64 unixodbc amd64 2.3.12-1ubuntu0.24.04.1 [27.5 kB] Get:7 https://packages.microsoft.com/ubuntu/22.04/prod jammy/main amd64 msodbcsql18 amd64 18.4.1.1-1 [755 kB] Ign:8 https://packages.microsoft.com/ubuntu/22.04/prod jammy/main amd64 mssql-tools18 amd64 18.4.1.1-1 Ign:8 https://packages.microsoft.com/ubuntu/22.04/prod jammy/main amd64 mssql-tools18 amd64 18.4.1.1-1 Ign:8 https://packages.microsoft.com/ubuntu/22.04/prod jammy/main amd64 mssql-tools18 amd64 18.4.1.1-1 Err:8 https://packages.microsoft.com/ubuntu/22.04/prod jammy/main amd64 mssql-tools18 amd64 18.4.1.1-1 Certificate verification failed: The certificate is NOT trusted. The certificate issuer is unknown. Could not handshake: Error in the certificate verification. [IP: 20.242.16.222 443] Fetched 1030 kB in 9s (112 kB/s) E: Failed to fetch https://pmc-geofence.trafficmanager.net/ubuntu/22.04/prod/pool/main/m/mssql-tools18/mssql-tools18_18.4.1.1-1_amd64.deb?geofence=true Certificate verification failed: The certificate is NOT trusted. The certificate issuer is unknown. Could not handshake: Error in the certificate verification. [IP: 20.242.16.222 443] E: Unable to fetch some archives, maybe run apt-get update or try with --fix-missing?

Expected Result It should install with a valid certificate regardless of the version used

Additional context fresh install of Ubuntu from windows store using WSL

[mbearup]

@JMeisnerEpicor Thanks for reporting these issues.

• Regarding ubuntu 24.04, the instructions are out-of-date. We'll take an action item to get that fixed. The Debian community discourages storing the pubkey in /etc/apt/trusted.gpg.d as that's reserved for OS keys. Instead, the community recommendation, which we adhere to in newer Ubuntu releases, is to use the signed-by directive. If you look at the prod.list file, you'll see that it expects the key to be at /usr/share/keyrings/microsoft-prod.gpg. If you move the key to that location, this should work.
• Regarding the cert error on Ubuntu 22.04, I can only suspect that a proxy is interfering with the connection. I can see in the Get:7 line that you're successfully connecting to packages.microsoft.com. But you're getting a cert issue with pmc-geofence.trafficmanager.net Both certs are issued by the same CA (DigiCert Global Root G2), which is included in ca-certificates, so if your client trusts one site, it should trust the other as well. Consider running curl https://pmc-geofence.trafficmanager.net/ or openssl s_client -connect pmc-geofence.trafficmanager.net:443 to get more detail on the TLS handshake.

[JMeisnerEpicor]

Excellent, thank you!