Certificate Error for Repo brave-browser-apt-release.s3.brave.com

Description

Certificate verification failed when trying to update using apt-get on Ubuntu. Err:4 https://brave-browser-apt-release.s3.brave.com bionic Release Certificate verification failed: The certificate is NOT trusted. The certificate issuer is unknown. Could not handshake: Error in the certificate verification. [IP: ::ffff:146.112.61.106 443]

Steps to Reproduce

1. Add brave repo to sources.list
2. Run sudo apt-get update
3. Get error

Actual result:

Get cert error when trying to update using apt-get.

Expected result:

Actually update when using apt-get.

Reproduces how often:

Easily reproduced.

Brave version (brave://version info)

Brave | 1.1.23 Chromium: 79.0.3945.88 (Official Build) (64-bit) Revision | c2a58a36b9411c80829b4b154bfcab97e581f1f3-refs/branch-heads/3945@{#954} OS | Linux

Other Additional Information:

The cert error when attempting to go to the URL of repo:

NET::ERR_CERT_AUTHORITY_INVALID Subject: brave-browser-apt-release.s3.brave.com

Issuer: Cisco Umbrella Secondary SubCA dfw-SG

Expires on: Jan 11, 2020

Current date: Jan 8, 2020

PEM encoded chain: -----BEGIN CERTIFICATE----- MIIDdzCCAl+gAwIBAgIEXhXXlTANBgkqhkiG9w0BAQsFADBAMQ4wDAYDVQQKDAVD aXNjbzEuMCwGA1UEAwwlQ2lzY28gVW1icmVsbGEgU2Vjb25kYXJ5IFN1YkNBIGRm dy1TRzAeFw0yMDAxMDYxMzA3MjZaFw0yMDAxMTExMzA3MjZaMIGDMQswCQYDVQQG EwJVUzETMBEGA1UECAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNU2FuIEZyYW5jaXNj bzEWMBQGA1UECgwNT3BlbkROUywgSW5jLjEvMC0GA1UEAwwmYnJhdmUtYnJvd3Nl ci1hcHQtcmVsZWFzZS5zMy5icmF2ZS5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IB DwAwggEKAoIBAQDTbvCpq+tRX0ND1wsYdLHZZkLOD66DATbS60/JgGVUNb9zV5W4 FeWctINkYB//2uklUZ8ktt5UC1pwRuoa5KWXjqXzndInsJVdJUtA6MiV1UaciRMP 8dMFWvrWfK0RBife1eA2fe1b+fKeGNlPOBCW5XZqaQ1p/A6A9OeMXFklRJTr93eG +3KppykYwosWfeYfSln04vS4wTbTjZX6LiTbZteS/nP1BIJ/4Q45RTioRIy362DN B2uzM+ltplMJh/W+8Q/kcQseJX7W+dto/FTniXT0CqouGmVGim1FekYSSLJTbTHD 1AxEfpLpKAuJ15Bh2D0KiOiNlUPB9BV1fl4RAgMBAAGjNTAzMDEGA1UdEQQqMCiC JmJyYXZlLWJyb3dzZXItYXB0LXJlbGVhc2UuczMuYnJhdmUuY29tMA0GCSqGSIb3 DQEBCwUAA4IBAQAyBXgtOJqO0m/S/Ju3Asq5HFkFWdwOAentyBM8ol7bp6tkJ14D bxDHVZnYKzMapVXzxVDqiIUwUm5BVTfk+80+R5gsyyR7etZi7Pz5Q3vMskpZGCMQ 9Ihh4w+AmTPpkbVe1lbe8yg5IobZBGK7AmF1qipRIDYuKYMFOInUUjVJgg7d5qnS jhU9/wjnygDRUlLorD/gcXIdhq70m+wSnbJamnwX/At/MPVt9R5k80WqHY2veGJf paHt2ic/qoafsHDDeUQRd1d48spUULT1ZJ2BwAQ1ER1xawhX1hogom/zgXMxlnfN b6+QeL65hZ/G7koUXHzq45SkJxl/jjTkUxWK -----END CERTIFICATE----- -----BEGIN CERTIFICATE----- MIIEJzCCAw+gAwIBAgIRANneUZPYX0NIjR5UolwU07swDQYJKoZIhvcNAQELBQAw cTELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNhbGlmb3JuaWExFjAUBgNVBAcMDVNh biBGcmFuY2lzY28xDjAMBgNVBAoMBUNpc2NvMSUwIwYDVQQDDBxDaXNjbyBVbWJy ZWxsYSBQcmltYXJ5IFN1YkNBMB4XDTIwMDEwNzA1MjIyMVoXDTIwMDExODA1MjIy MVowQDEOMAwGA1UECgwFQ2lzY28xLjAsBgNVBAMMJUNpc2NvIFVtYnJlbGxhIFNl Y29uZGFyeSBTdWJDQSBkZnctU0cwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEK AoIBAQDTbvCpq+tRX0ND1wsYdLHZZkLOD66DATbS60/JgGVUNb9zV5W4FeWctINk YB//2uklUZ8ktt5UC1pwRuoa5KWXjqXzndInsJVdJUtA6MiV1UaciRMP8dMFWvrW fK0RBife1eA2fe1b+fKeGNlPOBCW5XZqaQ1p/A6A9OeMXFklRJTr93eG+3KppykY wosWfeYfSln04vS4wTbTjZX6LiTbZteS/nP1BIJ/4Q45RTioRIy362DNB2uzM+lt plMJh/W+8Q/kcQseJX7W+dto/FTniXT0CqouGmVGim1FekYSSLJTbTHD1AxEfpLp KAuJ15Bh2D0KiOiNlUPB9BV1fl4RAgMBAAGjgeowgecwEgYDVR0TAQH/BAgwBgEB /wIBADAOBgNVHQ8BAf8EBAMCAYYwHQYDVR0OBBYEFMyv1Omq+mUAxnWxPmuAU0sL nCJWMB8GA1UdIwQYMBaAFEVf9ZtxMyWpwE48AkTPPOhGBhbEMIGABggrBgEFBQcB AQR0MHIwIwYIKwYBBQUHMAGGF2h0dHA6Ly9vY3NwLm9wZW5kbnMuY29tMEsGCCsG AQUFBzAChj9odHRwOi8vY2FjZXJ0cy5vcGVuZG5zLmNvbS9EOURFNTE5M0Q4NUY0 MzQ4OEQxRTU0QTI1QzE0RDNCQi5jcnQwDQYJKoZIhvcNAQELBQADggEBAJtFnDtg Ne6UdkjJuZD+7tQ+l/2hKQVqzPXjuwZiklaMezdkRq0rZ6PNcxWQvzYQD4ISUXcC qE12RsaOtRjhyoljjeAaPR9P693i+g5YHhSEaDBwRNzaOZkUO5DEe/8cbc2kVBR+ Y9ZS96qmXBREuQAcNii5F0bbmv9SNmDdrmA82D6hNCvxpX+6+ut2O+6mv/6pGoNJ SooSCUF7JVafaAQtL8czJ+FrfEKv4LrpqxmR+yWpur5/oaTXSCUgxInqF431SstY 2O/Se4KQEO8Yapsb3HbLcQyRQTYvhkSU91DTrZu/m+5uh1IrnuWUld5yMpJEaMiK sGpxfF4ZB6DN2SE= -----END CERTIFICATE----- -----BEGIN CERTIFICATE----- MIIEuzCCA6OgAwIBAgIJAcQ3zFeNvKYVMA0GCSqGSIb3DQEBCwUAMDExDjAMBgNV BAoTBUNpc2NvMR8wHQYDVQQDExZDaXNjbyBVbWJyZWxsYSBSb290IENBMB4XDTE5 MDUyMTE5NTMxOFoXDTI0MDUyMTE5NTMxOFowcTELMAkGA1UEBhMCVVMxEzARBgNV BAgMCkNhbGlmb3JuaWExFjAUBgNVBAcMDVNhbiBGcmFuY2lzY28xDjAMBgNVBAoM BUNpc2NvMSUwIwYDVQQDDBxDaXNjbyBVbWJyZWxsYSBQcmltYXJ5IFN1YkNBMIIB IjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAuFEhA5TkN8CiGmW7XjaUbuve U274v0kt6hRW8UUakmbyLnkI4d/BBQrGW71LYiT2QH4UaoYuihTXjuyAlzDxJ9OQ Vje2NB9RdE3FcUCISeW5GrQs7vF2xFrjs2TGgG4ZXjE/8WymgFZP50nsTJYf7VqL 1r6Brs59DAbbQ1rVvsz/DFxoE3ruFagSFcOF07/watUxFrAPV+S/kK6Nb5TqrI1j 32hK6i49ujavDcbbb12aozwdoyPSyhs4cB0sCXFHK/yEdaE4CNXEAH8EjKUuj6O2 QUvRtBGM480688BId0T0ws3q+hSzRiVJ+dYCr3iufmTrAMhVwc+EzGjlEfLyXwID AQABo4IBlDCCAZAwDgYDVR0PAQH/BAQDAgGGMBIGA1UdEwEB/wQIMAYBAf8CAQEw UgYDVR0gBEswSTBHBgorBgEEAQkVAR0AMDkwNwYIKwYBBQUHAgEWK2h0dHA6Ly93 d3cuY2lzY28uY29tL3NlY3VyaXR5L3BraS9wb2xpY2llcy8wHQYDVR0OBBYEFEVf 9ZtxMyWpwE48AkTPPOhGBhbEMEwGA1UdHwRFMEMwQaA/oD2GO2h0dHA6Ly93d3cu Y2lzY28uY29tL3NlY3VyaXR5L3BraS9jcmwvY2lzY291bWJyZWxsYXJvb3QuY3Js MIGHBggrBgEFBQcBAQR7MHkwSQYIKwYBBQUHMAKGPWh0dHA6Ly93d3cuY2lzY28u Y29tL3NlY3VyaXR5L3BraS9jZXJ0cy9jaXNjb3VtYnJlbGxhcm9vdC5jZXIwLAYI KwYBBQUHMAGGIGh0dHA6Ly9wa2ljdnMuY2lzY28uY29tL3BraS9vY3NwMB8GA1Ud IwQYMBaAFENzAN4kukAaQFQsfXzVAEiJDHCkMA0GCSqGSIb3DQEBCwUAA4IBAQC6 P7ugvpQSkNxrzY1ZM0Nd9Q3LaoTERS4ItcxMsswFPl7ID/3Vk3v3ZT6KgtCZ+Nh0 MUgZztLATHf42ZppdSkdMf1HfCmLSWORz/eK+fZxztE63M1EGiZJoe8qFKT9z6qx iDD989jyjY74sYfiSo5nbhcb5meUrUO6MQvOO5pUnlhWsDiBUg+yBzyfVoLnGRlY 2t7UZVTUz5kbBNFieTIt86yaYAumgOqriz/dCgQltFySbOkrgg/PN7cRv3IWm84C uKQ9prsXbXLLbl8U+bGRH119prl3zJyRnQ0D+ursCqUnIfziBdKv7yLsupGDGt+Q oqLzmkMPYE+WZmEi+3j5 -----END CERTIFICATE-----

Miscellaneous Information:

brave-browser-apt-release.s3.brave.com.txt

[jsandiego]

My DNS no longer resolves to the IP address that was giving me the issue, so it is no longer an issue for me.

[wknapik]

@cdphan there are no images for Mint 22 at hub.docker.com, but in a Mint 21 container the instructions from brave.com/linux appear to be working fine. Could this be a local issue? Have you tried following the official installation instructions again? Is the system clock set up correctly? Does reinstalling ca-certificates change anything?