Certificates in yum

[mpolo]

My organization just moved to using a zscaler proxy system. Basically, I have to use a .pac file in Firefox to get onto the proxy, which directs me to a series of two Flash pages, one to input my username, one for the password.

After reading through the .pac file, I was able to get some command-line things to work by specifying the proxy given at the end. However, this server uses an SSL certificate that is not emitted by an authority, but rather directly by our organization. In Firefox, I had to import this certificate to enable https:// browsing.

Is there any way to "import" this certificate so that yum can use it? Because yum freezes with the error:

Could not get metalink https://mirrors.fedoraproject.org/metalink?repo=fedora-13&arch=x86_64 error was
14: Peer cert cannot be verified or peer cert invalid

Thanks for any help!

[Discov3ry]

I wonder if instead of using mirrors you could use the baseurl, which is non-ssl. Try uncommenting the #baseurl line in /etc/yum.repos.d/fedora.repo and commenting out the 'mirrorlist' line.

[mpolo]

That seems to be working. Thanks for the idea!

(Although I still wonder if there is an answer to the original question...)

[Discov3ry]

Yeah, I forgot to mention that it only seems like a temporary workaround, your original issue is still in place. This could very well be a bug that yum doesn't honor self-signed certs.

[PabloTwo]

See 'man yum.conf'

sslcacert Path to the directory containing the databases of the certificate authorities yum should
use to verify SSL certificates. Defaults to none - uses system default

sslverify Boolean - should yum verify SSL certificates/hosts at all. Defaults to True

sslclientcert Path to the SSL client certificate yum should use to connect to repos/remote sites
Defaults to none.

proxy URL to the proxy server that yum should use.

proxy_username username to use for proxy

proxy_password password for this proxy

[mpolo]

Great. I was now able to use the mirrors. Thanks a lot!

[summermonsoon]

hello

how did you solved the problem

[shade0o]

Getting same problem with f16 now. some information would be nice

[code933k]

Getting same problem with f16 now. some information would be nice

They suggested clearly (man yum.conf):
Edit your

/etc/yum.conf

file, adding

sslverify=False

This is a temporary workaround. Don't forget to remove, comment or switch to

True

that line after a while as this step voids proper server checking and is a security risk.