#1140332 apt: missing dependency: apt update fails without ca-certificates installed

Package:
apt
Source:
apt
Description:
commandline package manager
Submitter:
Manuel Vögele
Date:
2026-06-18 13:43:02 UTC
Severity:
normal
#1140332#5
Date:
2026-06-18 12:00:30 UTC
From:
To:
Dear Maintainer,

*** Reporter, please consider answering these questions, where appropriate ***

   * What led up to the situation?
   * What exactly did you do (or not do) that was effective (or
     ineffective)?
   * What was the outcome of this action?
   * What outcome did you expect instead?

*** End of the template - remove these template lines ***
#1140332#10
Date:
2026-06-18 12:10:43 UTC
From:
To:
* What led up to the situation?
   To keep our installations minimal, we uninstall all packages from our system that we don't explicitly need. As it turns out none of the packages we selected for the given system depends on ca-certificates, so this got uninstalled as well.

* What exactly did you do (or not do) that was effective (or ineffective)?
   Running apt update (as well as apt install) fails if ca-certificates is not installed

* What was the outcome of this action?
# apt update
Ign:1 https://security.debian.org/debian-security trixie-security InRelease
Ign:2 https://deb.debian.org/debian trixie InRelease
Ign:3 https://deb.debian.org/debian trixie-updates InRelease
Ign:1 https://security.debian.org/debian-security trixie-security InRelease
Ign:3 https://deb.debian.org/debian trixie-updates InRelease
Ign:2 https://deb.debian.org/debian trixie InRelease
Ign:1 https://security.debian.org/debian-security trixie-security InRelease
Ign:2 https://deb.debian.org/debian trixie InRelease
Ign:3 https://deb.debian.org/debian trixie-updates InRelease
Err:1 https://security.debian.org/debian-security trixie-security InRelease
   SSL connection failed: error:0A000086:SSL routines::certificate verify failed / Success [IP: 2a04:4e42:400::644 443]
Err:3 https://deb.debian.org/debian trixie-updates InRelease
   SSL connection failed: error:0A000086:SSL routines::certificate verify failed / Success [IP: 2a04:4e42:8e::644 443]
Err:2 https://deb.debian.org/debian trixie InRelease
   SSL connection failed: error:0A000086:SSL routines::certificate verify failed / Success [IP: 2a04:4e42:8e::644 443]
All packages are up to date.
Warning: Failed to fetch https://deb.debian.org/debian/dists/trixie/InRelease  SSL connection failed: error:0A000086:SSL routines::certificate verify failed / Success [IP: 2a04:4e42:8e::644 443]
Warning: Failed to fetch https://deb.debian.org/debian/dists/trixie-updates/InRelease  SSL connection failed: error:0A000086:SSL routines::certificate verify failed / Success [IP: 2a04:4e42:8e::644 443]
Warning: Failed to fetch https://security.debian.org/debian-security/dists/trixie-security/InRelease  SSL connection failed: error:0A000086:SSL routines::certificate verify failed / Success [IP: 2a04:4e42:400::644 443]
Warning: Some index files failed to download. They have been ignored, or old ones used instead.
#1140332#15
Date:
2026-06-18 13:41:17 UTC
From:
To:
That's user error.

Well only if you use an https source.

apt Recommends ca-certificates, as such the requirement is perfectly
captured (required by default-ish, but can be optionally removed)