Certificate signed by unknown authority

[bob]

Hi. I’m trying to do a system update with yay, but getting a certificate error. Can someone help me please?

yay output is:

==> yay
[sudo] password for bob: 
:: Synchronising package databases...
 endeavouros is up to date
 core is up to date
 extra is up to date
 multilib is up to date
:: Searching AUR for updates...
:: Searching databases for updates...
 -> 1 error occurred:
	* request failed: Get "https://aur.archlinux.org/rpc?arg%5B%5D=endeavouros-skel-default&arg%5B%5D=endeavouros-skel-xfce4&arg%5B%5D=khotkeys&arg%5B%5D=kpeoplevcard&arg%5B%5D=kquickcharts5&arg%5B%5D=krunner5&arg%5B%5D=units&type=info&v=5": tls: failed to verify certificate: x509: certificate signed by unknown authority

Possibly related: running update mirrors either gives

or

==> Warning about https://mirror.alpix.eu/endeavouros/repo/$repo/$arch:
    Connection failed.
    Continuing.

[eso]

@bob
I’m not sure but try
sudo pacman -S ca-certificates

[flyingcakes]

You might also have to run sudo update-ca-trust after installing ca-certificates.

Also, a sanity check: is your system time correct?

What is the ouptut of dig +short aur.archlinux.com?

[bob]

@eso / @flyingcakes No dice I’m afraid.

@flyingcakes

dig +short aur.archlinux.com

Output is 3.64.163.50
System time is correct.

[eso]

with me the same. How about
sudo update-ca-trust

[bob]

@eso sudo update-ca-trust did not seem to help. Do I have to install ca-certificates first?

[eso]

I used google mostly. As Pebcak wrote here in a similar case:
sudo cp /etc/pacman.d/mirrorlist /etc/pacman.d/mirrorlist_old

reflector --latest 5 --sort rate --download-timeout 120 | sudo tee /etc/pacman.d/mirrorlist

sudo pacman -Syyu

[bob]

@eso That gives me:

error: failed to retrieve mirrorstatus data: URLError: <urlopen error [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1000)>

[bob]

Fixed the issue. All my VirtualBox VMs were set to use NAT. For some reason it appears that the corporate certificates required to access https were not being picked up by the VM, even though NAT has been fine in the past. Switching from NAT to Bridged Adapter has fixed the issue.