winget-cli: InternetOpenUrl() failed - 0x80072f05 : unknown error
Brief description of your issue
Looks like https://cdn.winget.microsoft.com/cache/source.msix does not come with a valid SSL certificate:
Steps to reproduce
winget upgrade --all --verbose
Expected behavior
it should just work
Actual behavior
see screenshot.
Environment
Windows Package Manager v1.4.10173
Copyright (c) Microsoft Corporation. All rights reserved.
Windows: Windows.Desktop v10.0.19045.2486
System Architecture: X64
Package: Microsoft.DesktopAppInstaller v1.19.10173.0
Logs: %LOCALAPPDATA%\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\LocalState\DiagOutputDir
User Settings: %LOCALAPPDATA%\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\LocalState\settings.json
Links
---------------------------------------------------------------------------
Privacy Statement https://aka.ms/winget-privacy
License Agreement https://aka.ms/winget-license
Third Party Notices https://aka.ms/winget-3rdPartyNotice
Homepage https://aka.ms/winget
Windows Store Terms https://www.microsoft.com/en-us/storedocs/terms-of-sale
About this issue
- Original URL
- State: closed
- Created a year ago
- Reactions: 30
- Comments: 25 (8 by maintainers)
Hey all. We’re working on getting the certificate renewed.
You can add a source like https://winget.azureedge.net/cache using the command below.
sudo winget source add -n winget https://winget.azureedge.net/cache. https://learn.microsoft.com/en-us/windows/package-manager/winget/sourceLooks like the certificate for https://cdn.winget.microsoft.com/cache expired about 1.5 hours ago.
Root Cause
While our certificate was being properly auto renewed, the new certificate was not being loaded into the CDN endpoints. After discussing with our Azure infrastructure team, we were informed that autorotation is not supported with our specific configuration. Additionally, it does not appear that any monitoring was in place to check the certificate that was actually in use on the endpoint for validity.
Our planned path forward
In consultation with the Azure Front Door team – we have determined that the Azure Front Door CDN does support certificate autorotation. We will beging working on changes to our Azure Front Door CDN so that autorotation is supported. We will also add monitoring to verify that the certificates have been configured on the CDN endpoints.
The new certificate has been imported. We’re waiting for the provisioning to complete.
The expectation is 6 - 8 hours for full propagation.
according to the certificate transparency logs it should have already been renewed 3 times, most recently in november 2022… but none of those renewed certificates were actually picked up by the server. If the certificate files on disk were changed, was the server process restarted to re-read the certificate files? Was it even restarted for scheduled updates?
You can always run
winget source reset --force(as admin) to get back to defaults.Since we haven’t had any new reports of certificate problems, I’m going to go ahead and close this issue now.
seems to be working now.
@denelon, what’s the action taken to ensure this does not happen again?
That error message also needs to be fixed. What a terrible terrible error message
@denelon Red alert.
powershell do not need sudo if you are admin account. just first remove then re-add
We’re going to do a root cause on Monday. The certificate was issued in November, and it was published to the secret store, but it didn’t get configured on the endpoints. I’m not sure yet if it was code that we wrote not doing the right thing, or something else.
Seconded here:
The served certificate is here, fingerprint
F0:AA:13:A5:24:3B:AC:A6:00:3E:75:FA:59:5E:2F:20:36:54:BC:B6:09:BD:B2:71:CC:ED:98:60:93:FB:D7:95:cdn-winget-microsoft-com.pem.txt