Amazon Linux 2 Yum Fails with curl#60 SSL Certificate Error When Installing Nginx via amazon-linux-extras

Question

I'm trying to install `nginx1` using `amazon-linux-extras` on an Amazon Linux 2 EC2 instance, but I keep encountering `yum` errors related to SSL certificates.

#### ✅ What I've Tried (but didn't work):
1. Verified security group rules – set inbound/outbound to allow all traffic.
2. Downloaded certificates via `curl` and updated CA certs manually.
3. Cleaned yum cache using `yum clean all` and `rm -rf /var/cache/yum`.
4. Checked system time (it's correct).
5. Tried enabling/disabling repos and using `--skip-broken`.

#### ❌ Error Message:

```shell
sudo yum update
Loaded plugins: extras_suggestions, langpacks, priorities, update-motd
Could not retrieve mirrorlist https://amazonlinux-2-repos-us-east-1.s3.dualstack.us-east-1.amazonaws.com/2/core/latest/x86_64/mirror.list error was
14: curl#60 - "SSL certificate problem: unable to get local issuer certificate"
https://amazonlinux-2-repos-us-east-1.s3.dualstack.us-east-1.amazonaws.com/2/core/latest/x86_64/mirror.list/repodata/repomd.xml?instance_id=i-07aeade126af274bd&region=us-east-1: [Errno 14] curl#60 - "SSL certificate problem: unable to get local issuer certificate"
Trying other mirror.

One of the configured repositories failed (Amazon Linux 2 core repository),
 and yum doesn't have enough cached data to continue. At this point the only
 safe thing yum can do is fail. There are a few ways to work "fix" this:

1. Contact the upstream for the repository and get them to fix the problem.

2. Reconfigure the baseurl/etc. for the repository, to point to a working
        upstream. This is most often useful if you are using a newer
        distribution release than is supported by the repository (and the
        packages for the previous distribution release still work).

3. Run the command with the repository temporarily disabled
            yum --disablerepo=amzn2-core ...

4. Disable the repository permanently, so yum won't use it by default. Yum
        will then just ignore the repository until you permanently enable it
        again or use --enablerepo for temporary usage:

yum-config-manager --disable amzn2-core
        or
            subscription-manager repos --disable=amzn2-core

5. Configure the failing repository to be skipped, if it is unavailable.
        Note that yum will try to contact the repo. when it runs most commands,
        so will have to try and fail each time (and thus. yum will be be much
        slower). If it is a very temporary problem though, this is often a nice
        compromise:

yum-config-manager --save --setopt=amzn2-core.skip_if_unavailable=true

failure: repodata/repomd.xml from amzn2-core: [Errno 256] No more mirrors to try.
https://amazonlinux-2-repos-us-east-1.s3.dualstack.us-east-1.amazonaws.com/2/core/latest/x86_64/mirror.list/repodata/repomd.xml?instance_id=i-07aeade126af274bd&region=us-east-1: [Errno 14] curl#60 - "SSL certificate problem: unable to get local issuer certificate"
```

This happens when trying to update packages or install anything via `yum`.

---

### 💭 Any suggestions to resolve this SSL cert issue or fix the repository access?  
Would appreciate a workaround or long-term fix.

re:Post Agent · Answer

This issue appears to be related to SSL certificate problems when your Amazon Linux 2 instance is trying to access the package repositories. Here are some suggestions to resolve this:

1. Update your system's CA certificates:
   Run the following commands to update the CA certificates:
   ```
   sudo yum install -y ca-certificates
   sudo update-ca-trust force-enable
   sudo update-ca-trust extract
   ```

2. Check if your system time is correct:
   Although you mentioned checking the system time, it's worth double-checking as incorrect system time can cause SSL certificate validation failures. Use the following command to verify:
   ```
   date
   ```
   If it's incorrect, you can sync it using:
   ```
   sudo chronyd -q
   ```

3. Verify DNS resolution:
   Ensure that your instance can resolve domain names correctly. Try pinging a known domain:
   ```
   ping amazon.com
   ```

4. Check your VPC settings:
   Ensure that your VPC has DNS hostnames and DNS resolution enabled. You can check this in the VPC console.

5. Try using a different mirror:
   You can try changing the mirror in your yum configuration. Edit the file `/etc/yum.repos.d/amzn2-core.repo` and change the baseurl to a different region's mirror.

6. As a last resort, you could temporarily disable SSL verification for yum:
   Edit `/etc/yum.conf` and add `sslverify=false` under the `[main]` section. However, this is not recommended for security reasons and should only be used as a temporary measure.

If none of these solutions work, you may need to contact AWS support for further assistance, as there might be an issue with your specific instance or the Amazon Linux 2 repositories.

Remember to revert any temporary changes once you've resolved the issue to ensure your system remains secure.  
**Sources**  
[Amazon Linux 2 09/25/2018 release notes - Amazon Linux 2](https://docs.aws.amazon.com/AL2/latest/relnotes/relnotes-9-25-2018.html)  
[Amazon Linux 2 version 2.0.20210813.1 release notes - Amazon Linux 2](https://docs.aws.amazon.com/AL2/latest/relnotes/relnotes-20210813.html)  
[Amazon Linux 2 version 2.0.20210701.0 release notes - Amazon Linux 2](https://docs.aws.amazon.com/AL2/latest/relnotes/relnotes-20210701.html)

Amazon Linux 2 Yum Fails with curl#60 SSL Certificate Error When Installing Nginx via amazon-linux-extras

✅ What I've Tried (but didn't work):

❌ Error Message:

💭 Any suggestions to resolve this SSL cert issue or fix the repository access?

Add your answer

Relevant content