package ca-certificates 20180409 failed to install/upgrade: installed ca-certificates package post-installation script subprocess returned error exit status 1

[Josh]

I got an automated crash report that asked me to submit this bug.

ProblemType: Package
DistroRelease: Ubuntu 18.04
Package: ca-certificates 20180409
ProcVersionSignature: Ubuntu 4.15.0-15.16-generic 4.15.15
Uname: Linux 4.15.0-15-generic x86_64
ApportVersion: 2.20.9-0ubuntu6
Architecture: amd64
Date: Wed Apr 18 10:58:11 2018
ErrorMessage: installed ca-certificates package post-installation script subprocess returned error exit status 1
InstallationDate: Installed on 2018-03-21 (33 days ago)
InstallationMedia: Ubuntu 18.04 LTS "Bionic Beaver" - Alpha amd64 (20180314)
PackageArchitecture: all
Python3Details: /usr/bin/python3.6, Python 3.6.5, python3-minimal, 3.6.5-3
PythonDetails: /root/Error: command ['which', 'python'] failed with exit code 1:, Error: [Errno 2] No such file or directory: "/root/Error: command ['which', 'python'] failed with exit code 1:": "/root/Error: command ['which', 'python'] failed with exit code 1:", unpackaged
RelatedPackageVersions:
 dpkg 1.19.0.5ubuntu2
 apt 1.6.1
SourcePackage: ca-certificates
Title: package ca-certificates 20180409 failed to install/upgrade: installed ca-certificates package post-installation script subprocess returned error exit status 1
UpgradeStatus: No upgrade log present (probably fresh install)

[Steve Beattie (sbeattie)]

Hi Josh,

Thanks for reporting this error. The upgrade is failing with the following in the dpkg log:

  Setting up ca-certificates (20180409) ...
  Updating certificates in /etc/ssl/certs...
  rehash: skipping duplicate certificate ZscalerRCA.crt
  dpkg: error processing package ca-certificates (--configure):
   installed ca-certificates package post-installation script subprocess returned error exit status 1

Can you report the output of running the command 'dpkg -S ZscalerRCA.crt'? That will report what package is providing the duplicate ZscalerRCA.crt certificate.

Thanks!

[Josh (jerquiaga)]

Hi Steve,

The ZscalerRCA.crt is one I added manually for our corporate proxy, it isn't installed via a package.

[Josh (jerquiaga)]

Hi Steve,

It's possible that this may just be a quirk of my system. A long time ago I was adding root certs to /etc/ssl/certs, which was hit or miss. Now I'm adding them in /usr/local/share/ca-certificates/ which seems to be much more effective. I've removed the certs from /etc/ssl/certs, which should resolve the package error. Not sure if there is a way to test that though. Reinstall the package?

[Josh (jerquiaga)]

Hi Steve,

Reinstalling the package seemed to work without a problem. We can close this as not a bug.

[Steve Beattie (sbeattie)]

Hi Josh,

Thanks for following up. I'm going to mark this as a duplicate bug of bug 1764848, because ca-certificates installation/upgrades should not be failing if there's a duplicate certificate available.

Thanks again for the report!