I am trying install a RPM from an url directly from anaconda kickstart (CentOS7) %post phase but I encountered an interesting error:

``` + rpm -Uvh https://dl.fedoraproject.org/pub/epel/epel-release-latest-7.noarch.rpm curl: (60) Peer's certificate issuer has been marked as not trusted by the user. More details here: http://curl.haxx.se/docs/sslcerts.html

curl performs SSL certificate verification by default, using a "bundle" of Certificate Authority (CA) public keys (CA certs). If the default bundle file isn't adequate, you can specify an alternate file using the --cacert option. If this HTTPS server uses a certificate signed by a CA represented in the bundle, the certificate verification probably failed due to a problem with the certificate (it might be expired, or the name might not match the domain name in the URL). If you'd like to turn off curl's verification of the certificate, use the -k (or --insecure) option. error: skipping https://dl.fedoraproject.org/pub/epel/epel-release-latest-7.noarch.rpm - transfer failed ```

Running the same command after system reboots works well but inside post it fails and opposed to curl which has a -k parameter, I found no option to give to rpm.

This is double weird because this address is not supposed to have an invalid SSL certificate anyway.

I know that I could split this into two commands, one curl that downloads the file and another one to install the rpm.

Still, I am looking for a beter solution, one line one.


My first attempt was to add epel-release inside the list of packages but this raised and error:

You have specified that the package 'epel-release' should be installed.  This
package does not exist.  Would you like to ignore this package and continue with

Please respond 'yes' or 'no':
  • 1
    Why are you trying to do this? Just add epel-release to the %packages list. – Michael Hampton Dec 5 '18 at 18:41
  • @MichaelHampton I updated the answer. Still the questing is still valid, why the SSL certificate is not valid at install time. – sorin Dec 5 '18 at 18:54
  • 2
    Are you sure you're installing CentOS? It most certainly does include the epel-release package as a convenience. It has for years now. I suspect you've got bigger problems than the original one about being unable to verify the TLS certificate. – Michael Hampton Dec 5 '18 at 19:05
  • 1
    Are you in a corporate environment? At my job all HTTP requests are intercepted by a proxy, including HTTPS. When that happens a certificate is presented that doesn't match the real cert from remote host. Instead I get a certificate from the proxy. Unless that certificate has been trusted already, it will cause handshake errors like this. – apocalysque Dec 6 '18 at 9:49

These SSL erros were caused by the presense of http_proxy environment variable which made rpm use a proxy.

Once I installed the custom CA certificate, this was sorted.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.