spacewalk-repo-sync fails with Error code: Curl error 60

This document (000020802) is provided subject to the disclaimer at the end of this document.

Environment

SUSE Manager Server 4.x

Situation

Syncing of patches using SUSE Manager Server starts to fail from one day to the next. Errors similar to the following can be found in the respective log file for a channel in /var/log/rhn/reposync/:

2022/10/04 03:34:33 +02:00 Command: ['/usr/bin/spacewalk-repo-sync', '--channel', 'sle-module-server-applications15-sp3-updates-x86_64', '--type', 'yum', '--non-interactive']
2022/10/04 03:34:33 +02:00 Sync of channel started.
2022/10/04 03:34:33 +02:00 RepoMDError: Cannot access repository.
Repository 'sle-module-server-applications15-sp3-updates-x86_64' is invalid.
[sle-module-server-applications15-sp3-updates-x86_64|https://updates.suse.com/SUSE/Updates/SLE-Module-Server-Applications/15-SP3/x86_64/update/[TOKEN]&proxy=http%3A//[PROXYADDRESS]%3A[PROXYPORT] Valid metadata not found at specified URL
History:
- [|] Error trying to read from 'https://updates.suse.com/SUSE/Updates/SLE-Module-Server-Applications/15-SP3/x86_64/update/[TOKEN]&proxy=http%3A//[PROXYADDRESS]%3A[PROXYPORT]'
- Download (curl) error for 'https://updates.suse.com/SUSE/Updates/SLE-Module-Server-Applications/15-SP3/x86_64/update/content[TOKEN]&proxy=http%3A//[PROXYADDRESS]%3A[PROXYPORT]':
Error code: Curl error 60
Error message: SSL certificate problem: self signed certificate in certificate chain

Please check if the URIs defined for this repository are pointing to a valid repository.
Skipping repository 'sle-module-server-applications15-sp3-updates-x86_64' because of the above error.
Could not refresh the repositories because of errors.

Resolution

Please check whether the proxy responsible for outgoing internet connections breaks up the SSL certificate for inspection purposes and add an exception rule to pass the original certificate through as this may lead to situations as described above.

Cause

The gateway proxy breaks up the SSL certificate for inspection and decrypts the traffic with an internal certificate. This way the certificate does not match the one of the repository and returns a SSL certificate problem.

Disclaimer

This Support Knowledgebase provides a valuable tool for SUSE customers and parties interested in our products and solutions to acquire information, ideas and learn from one another. Materials are provided for informational, personal or non-commercial use within your organization and are presented "AS IS" WITHOUT WARRANTY OF ANY KIND.