`rustup update` fails with a certificate error, but curl works

ilyagr · April 15, 2023, 3:57am

I have suddenly started getting errors when doing rustup update. It worked fine before. This is on Chrome OS linux.

It seems to have trouble with some certificate, but curl seems to work fine.

Any ideas on what could be wrong?

$ rustup update
info: syncing channel updates for 'beta-x86_64-unknown-linux-gnu'
error: could not download file from 'https://static.rust-lang.org/dist/channel-rust-beta.toml.sha256' to '/home/ilyagr/.local/app/rustup/tmp/n8ste_t87j1jy11u_file'
info: syncing channel updates for 'nightly-x86_64-unknown-linux-gnu'
error: could not download file from 'https://static.rust-lang.org/dist/channel-rust-nightly.toml.sha256' to '/home/ilyagr/.local/app/rustup/tmp/zdes5clkoev1tz5o_file'
info: syncing channel updates for '1.64-x86_64-unknown-linux-gnu'
error: could not download file from 'https://static.rust-lang.org/dist/channel-rust-1.64.toml.sha256' to '/home/ilyagr/.local/app/rustup/tmp/h8sfjn1fqih4kpcr_file'
info: checking for self-updates
error: could not download file from 'https://static.rust-lang.org/rustup/release-stable.toml' to '/tmp/rustup-updateWTZmyb/release-stable.toml':
  failed to make network request: error sending request for url (https://static.rust-lang.org/rustup/release-stable.toml):
    error trying to connect: error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed:ssl/statem/statem_clnt.c:1921:
      (unable to get local issuer certificate): error trying to connect: error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed:ssl/statem/statem_clnt.c:1921:
      (unable to get local issuer certificate): error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed:ssl/statem/statem_clnt.c:1921:
      (unable to get local issuer certificate): error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed:ssl/statem/statem_clnt.c:1921:

$ rustup --version
rustup 1.25.2 (17db695f1 2023-02-01)
info: This is the version for the rustup toolchain manager, not the rustc compiler.
info: The currently active `rustc` version is `rustc 1.69.0-beta.5 (734f69d95 2023-03-31)`
$ cat /etc/os-release
PRETTY_NAME="Debian GNU/Linux 11 (bullseye)"
NAME="Debian GNU/Linux"
VERSION_ID="11"
VERSION="11 (bullseye)"
VERSION_CODENAME=bullseye
ID=debian
HOME_URL="https://www.debian.org/"
SUPPORT_URL="https://www.debian.org/support"
BUG_REPORT_URL="https://bugs.debian.org/"

$ curl -L https://static.rust-lang.org/rustup/release-stable.toml
schema-version = '1'
version = '1.25.2'

$ curl -L https://static.rust-lang.org/dist/channel-rust-beta.toml.sha256
3af143d9455fb5005b8aab886cb9e9a51e3bdba626276cc24c365347abe5b4b8  channel-rust-beta.toml

ilyagr · April 15, 2023, 4:35am

I have some updates:

I found that RUSTUP_USE_CURL=1 rustup update works. A subsequent rustup update does not work.
There are some similar issues in the rustup repo, e.g. Unable to download files, certificate verify failed · Issue #1856 · rust-lang/rustup · GitHub. That's how I figured out the command above, though I still don't understand the cause of the problem and what suddenly triggered it for me.

ilyagr · April 29, 2023, 7:57pm

It seems that updating to the recently released rustup 1.26 via RUSTUP_USE_CURL=1 rustup self update fixed the problem for me.

That is, now rustup works even without RUSTUP_USE_CURL=1.