# Certificate verification failed
**URL:** https://discourse.vtk.org/t/certificate-verification-failed/11385
**Category:** Support
**Created:** [May 5, 2023, 2:32pm UTC](https://discourse.vtk.org/t/certificate-verification-failed/11385 "2023-05-05T14:32:46Z")
**Posts on this page:** 12
**Page:** 1
### Author:  [@automata](https://discourse.vtk.org/u/automata)
#### Post date: [May 5, 2023, 2:32pm UTC](https://discourse.vtk.org/t/certificate-verification-failed/11385/1 "2023-05-05T14:32:46Z")
While trying to install vtk-osmesa, we are getting the following error:
```auto
Err:5 https://apt.kitware.com/ubuntu bionic Release
Certificate verification failed: The certificate is NOT trusted. The received OCSP status response is invalid. Could not handshake: Error in the certificate verification. [IP: 66.194.253.25 443]
```
We are running the exact same commands from the documentation at [https://apt.kitware.com/](https://apt.kitware.com/). To reproduce, in a fresh Ubuntu 18.04 image:
```auto
docker run -it ubuntu:18.04 /bin/bash
apt-get update
apt-get install -y gpg wget
wget -O - https://apt.kitware.com/keys/kitware-archive-latest.asc 2>/dev/null | gpg --dearmor - | tee /usr/share/keyrings/kitware-archive-keyring.gpg >/dev/null
echo 'deb [signed-by=/usr/share/keyrings/kitware-archive-keyring.gpg] https://apt.kitware.com/ubuntu/ bionic main' | tee /etc/apt/sources.list.d/kitware.list >/dev/null
apt-get update
```
We also tested with Ubuntu 20.04 image, same issue.
Both gpg file and sources.list file have content:
I understand this is more related with kitware project, but given that many users depend on their build for vtk, I believe it’s still on context.
Please let me know how can we can contribute on further investigation and fix.
---
### Author:  [@mwestphal](https://discourse.vtk.org/u/mwestphal)
#### Post date: [May 5, 2023, 2:36pm UTC](https://discourse.vtk.org/t/certificate-verification-failed/11385/2 "2023-05-05T14:36:38Z")
There seems to be a network issue for a few hours. I’m just an engineer at Kitware but I’m impacted too. We will let you know when it is fixed.
@ben.boeckel
---
### Author:  [@automata](https://discourse.vtk.org/u/automata)
#### Post date: [May 5, 2023, 2:42pm UTC](https://discourse.vtk.org/t/certificate-verification-failed/11385/3 "2023-05-05T14:42:31Z")
Thank you for the quick reply Mathieu!
Do you believe we could mirror the repository ourselves to have a plan B on those cases? Any guidance/documents would be much appreciated. Thanks in advance.
---
### Author:  [@mwestphal](https://discourse.vtk.org/u/mwestphal)
#### Post date: [May 5, 2023, 2:43pm UTC](https://discourse.vtk.org/t/certificate-verification-failed/11385/4 "2023-05-05T14:43:55Z")
Sure, but no idea how to do that 🙂
---
### Author:  [@mwestphal](https://discourse.vtk.org/u/mwestphal)
#### Post date: [May 5, 2023, 3:36pm UTC](https://discourse.vtk.org/t/certificate-verification-failed/11385/5 "2023-05-05T15:36:58Z")
Hi @automata
Installing `ca-certificates` package should help with the issue until it is fixed.
Best,
---
### Author:  [@brad.king](https://discourse.vtk.org/u/brad.king)
#### Post date: [May 5, 2023, 3:58pm UTC](https://discourse.vtk.org/t/certificate-verification-failed/11385/6 "2023-05-05T15:58:49Z")
Installing `wget` should also install `ca-certificates`.
@automata I just ran through your instructions again and I do not see the certificate error anymore. Do you still see it?
---
### Author:  [@automata](https://discourse.vtk.org/u/automata)
#### Post date: [May 5, 2023, 6:49pm UTC](https://discourse.vtk.org/t/certificate-verification-failed/11385/7 "2023-05-05T18:49:02Z")
Hello @brad.king and @mwestphal, we are able to build the images again, it seems the network errors got fixed.
I’ll try to add ca-certificates like suggested. Maybe it will be interesting to update the documentation on [https://apt.kitware.com/](https://apt.kitware.com/) about that.
Thank you.
---
### Author:  [@brad.king](https://discourse.vtk.org/u/brad.king)
#### Post date: [May 8, 2023, 1:47pm UTC](https://discourse.vtk.org/t/certificate-verification-failed/11385/8 "2023-05-08T13:47:51Z")
@automata great. Meanwhile we found and fixed the problem with the OCSP check. We also updated the instructions on `apt.kitware.com` to explicitly mention the `ca-certificates` package.
---
### Author:  [@automata](https://discourse.vtk.org/u/automata)
#### Post date: [May 9, 2023, 5:20pm UTC](https://discourse.vtk.org/t/certificate-verification-failed/11385/9 "2023-05-09T17:20:28Z")
@brad.king that’s really great news! Thank you so much for the quick responses and fixes!
---
### Author:  [@automata](https://discourse.vtk.org/u/automata)
#### Post date: [May 9, 2023, 5:23pm UTC](https://discourse.vtk.org/t/certificate-verification-failed/11385/10 "2023-05-09T17:23:20Z")
@brad.king while on it, do you have any suggestions and guidance on how to mirror `apt.kitware.com`? We are interested in making sure we can have some plan B when problems like that happen. Thank you in advance.
---
### Author:  [@brad.king](https://discourse.vtk.org/u/brad.king)
#### Post date: [May 9, 2023, 5:29pm UTC](https://discourse.vtk.org/t/certificate-verification-failed/11385/11 "2023-05-09T17:29:30Z")
`apt.kitware.com` was originally meant for use by humans to install a recent CMake on Ubuntu LTS versions. I don’t think we can guarantee download performance and uptime at a level needed for widespread use in CI jobs. Instead such jobs can download from the [CMake Releases page on GitHub](https://github.com/Kitware/CMake/releases), which is backed by a CDN. CMake’s own CI jobs do this using code [here](https://gitlab.kitware.com/cmake/cmake/-/blob/v3.26.3/.gitlab/ci/cmake.sh). Projects like [get\_cmake](https://github.com/Crascit/get_cmake) can help.
---
### Author:  [@automata](https://discourse.vtk.org/u/automata)
#### Post date: [May 9, 2023, 5:49pm UTC](https://discourse.vtk.org/t/certificate-verification-failed/11385/12 "2023-05-09T17:49:04Z")
@brad.king that’s really helpful! We’ll check those suggestions and try to setup our CI to follow it. Thank you!