Ubuntu 22.04 LTS – certificate verify failed in apt and curl – Fix & Prevention

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

TLS-protected endpoints fail validation, blocking updates and outbound secure integrations.

Environment & Reproduction

Appears after expired custom CA bundles, clock drift, or TLS interception changes.

Root Cause Analysis

System trust store lacks valid issuer chain or endpoint certificates fail date validation.

Quick Triage

Check host time, CA package integrity, and certificate path diagnostics.

Step-by-Step Diagnosis

Inspect full TLS handshake and verify certificate chain against local trust anchors.

Solution – Primary Fix

Reinstall CA certificates, refresh trust database, and confirm accurate system time.

Solution – Alternative Approaches

Deploy organization root CA correctly to /usr/local/share/ca-certificates when required.

Verification & Acceptance Criteria

apt and curl complete TLS verification successfully against required endpoints.

Rollback Plan

Remove recently added custom CA entries if they break trust evaluation behavior.

Prevention & Hardening

Maintain CA lifecycle governance and monitor certificate expiry and trust-store drift.

Related Errors & Cross-Refs

Often accompanied by clock drift alerts and proxy interception misconfiguration.

Related tutorial: View the step-by-step tutorial for Ubuntu 22.04 LTS.

View all Ubuntu 22.04 LTS tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

CA trust management and TLS troubleshooting practices for Ubuntu 22.04 LTS environments.