Zypper gets curl error 60 when attempting updates

This document (000019876) is provided subject to the disclaimer at the end of this document.

Environment

SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server 12

Situation

When attempting to refresh the update repositories, zypper returns a curl error 60. The error prevents updating the server. An example from SLES12 SP4 is shown below. However, the resolution can apply to other versions.

# zypper ref -s
Refreshing service 'SUSE_Linux_Enterprise_Server_12_SP4_x86_64'.
Problem retrieving the repository index file for service 'SUSE_Linux_Enterprise_Server_12_SP4_x86_64':
Download (curl) error for 'https://scc.suse.com/access/services/1610/repo/repoindex.xml?
cookies=0&credentials=SUSE_Linux_Enterprise_Server_12_SP4_x86_64':
Error code: Curl error 60
Error message: SSL certificate problem: unable to get local issuer certificate

Check if the URI is valid and accessible.
Skipping service 'SUSE_Linux_Enterprise_Server_12_SP4_x86_64' because of the above error.
Some of the services have not been refreshed because of an error.
Repository 'SLES12-SP4-12.4-0' is up to date.                                                                                   
Download (curl) error for 'https://updates.suse.com/SUSE/Products/SLE-SERVER/12-SP4/x86_64/product/repodata/repomd.xml?
gAovK3NtyXBhQ3AU8nW9oDG8722x3KczjaGXrL-eClOCmbjGpaYXTnd8Ur10cCOEacGzNNGif74hPQscEQ6_
YoVF_0Z0zuXLnr7ebYl9mA3WAZH2LuDYsuv2ytXxG60OmVn1d6RXn3NapqsFyQ':
Error code: Curl error 60
Error message: SSL certificate problem: self signed certificate in certificate chain

Abort, retry, ignore? [a/r/i/...? shows all options] (a): a
ABORT request: Aborting requested by user

If the registration is cleaned up, an attempt to re-register the server returns:

# SUSEConnect --cleanup
# SUSEConnect --regcode <your_registration_code>
Registering system to SUSE Customer Center

Announcing system to https://scc.suse.com ...
SSL verification failed: unable to get local issuer certificate
Certificate issuer: /C=US/O=Starfield Technologies, Inc./OU=Starfield Class 2 Certification Authority
Certificate subject: /C=US/ST=Arizona/L=Scottsdale/O=Starfield Technologies, Inc./CN=Starfield Services Root Certificate Authority - G2
SUSEConnect error: OpenSSL::SSL::SSLError: SSL_connect returned=1 errno=0 state=error: certificate verify failed

Resolution

Update the certificates and re-register the server.

# SUSEConnect --cleanup
# update-ca-certificates 
# SUSEConnect --regcode <your_registration_code>

Cause

In the case of SLES12 SP4 in this example, the gpg key signing file for repomd.xml had expired.

# zypper ref -s
Refreshing service 'SUSE_Linux_Enterprise_Server_12_SP4_x86_64'.
All services have been refreshed.
Repository 'SLES12-SP4-12.4-0' is up to date.                                                                                   
Retrieving repository 'SLES12-SP4-Pool' metadata -------------------------[|]
Warning: The gpg key signing file 'repomd.xml' has expired.
  Repository:       SLES12-SP4-Pool
  Key Name:         SuSE Package Signing Key <build@suse.de>
  Key Fingerprint:  FEAB5025 39D846DB 2C0961CA 70AF9E81 39DB7C82
  Key Created:      Wed 07 Dec 2016 03:57:35 AM MST
  Key Expires:      Sun 06 Dec 2020 03:57:35 AM MST (EXPIRED)
  Rpm Name:         gpg-pubkey-39db7c82-5847eb1f

Disclaimer

This Support Knowledgebase provides a valuable tool for SUSE customers and parties interested in our products and solutions to acquire information, ideas and learn from one another. Materials are provided for informational, personal or non-commercial use within your organization and are presented "AS IS" WITHOUT WARRANTY OF ANY KIND.