yum SSL certificate validation fails

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

yum update fails with SSL peer verification errors, blocking security patching.

Environment & Reproduction

RHEL 7 host behind SSL inspection proxy or with outdated CA trust store.

Root Cause Analysis

Missing CA chain, MITM proxy certificate not trusted, or incorrect sslverify settings.

Quick Triage

Run curl -Iv to repo URL and inspect certificate issuer and validity dates.

Step-by-Step Diagnosis

Review yum repo sslcacert fields, update-ca-trust status, and clock sync via chronyd.

Solution – Primary Fix

Install correct CA chain, run update-ca-trust, and keep sslverify enabled for security.

Solution – Alternative Approaches

Use internal mirror signed by enterprise PKI if outbound TLS interception is mandatory.

Verification & Acceptance Criteria

yum makecache and yum update complete without SSL warnings or verification failures.

Rollback Plan

Restore previous trust anchors and repo configuration if new CA bundle causes breakage.

Prevention & Hardening

Track certificate expiry and trust-store changes with scheduled compliance checks.

Related Errors & Cross-Refs

SSL certificate problem, peer cert cannot be authenticated, curl#60.

Related tutorial: View the step-by-step tutorial for rhel-7.

View all rhel-7 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

RHEL certificate management docs, yum SSL options, enterprise PKI integration notes.