When I run M-x list-packages I get the following error with Marmalade after updating to Emacs 25.

Certificate information
Issued by:          COMODO RSA Domain Validation Secure Server CA
Issued to:          Domain Control Validated
Hostname:           marmalade-repo.org
Public key:         RSA, signature: RSA-SHA256
Protocol:           TLS1.2, key: ECDHE-RSA, cipher: AES-256-GCM, mac: AEAD
Security level:     Medium
Valid:              From 2015-07-12 to 2018-07-11

The TLS connection to marmalade-repo.org:443 is insecure for the
following reasons:

the certificate was signed by an unknown and therefore untrusted authority
certificate could not be verified

Relevant .emacs code: (full .emacs here)

(require 'package)
(add-to-list 'package-archives
         '("melpa" . "http://melpa.org/packages/") t)
(add-to-list 'package-archives
         '("gnu" . "http://elpa.gnu.org/packages/") t)
(add-to-list 'package-archives
         '("marmalade" . "http://marmalade-repo.org/packages/") t)

;; bootstrap use-package
;; https://github.com/jwiegley/use-package/
(unless (package-installed-p 'use-package)
  (package-install 'use-package))
(eval-when-compile (require 'use-package))

I've also tried to solve it with gnutils-cli suggestion: $ gnutls-cli --tofu marmalade-repo.org but couldn't make it work yet. Any ideas?

$ gnutls-cli --tofu marmalade-repo.org
gnutls-cli --tofu marmalade-repo.org                                                                              
Processed 173 CA certificate(s).                                                                                                      
Resolving 'marmalade-repo.org:443'...                                                                                                 
Connecting to ''...                                                                                                    
- Certificate type: X.509                                                                                                             
- Got a certificate list of 1 certificates.                                                                                           
- Certificate[0] info:                                                                                                                
 - subject `CN=marmalade-repo.org,OU=PositiveSSL,OU=Domain Control Validated', issuer `CN=COMODO RSA Domain Validation Secure Server C
A,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB', serial 0x5f7ce5cf6602297b4cbd14639b670e7d, RSA key 2048 bits, signed usin
g RSA-SHA256, activated `2015-07-12 00:00:00 UTC', expires `2018-07-11 23:59:59 UTC', SHA-1 fingerprint `6e080a477d14631d2edf839de582a
        Public Key ID:                                                                                                                
        Public key's random art:                                                                                                      
                +--[ RSA 2048]----+
                |      . +oo      |
                |     . o . .     |
                |      o   o      |
                |     . . o       |
                |     . .S        |
                |      o.E=       |
                |     . o= o      |
                |      O.==       |
                |    .*=X+.       |

- Status: The certificate is NOT trusted. The certificate issuer is unknown.
*** PKI verification of server certificate failed...
- Description: (TLS1.2)-(ECDHE-RSA-SECP256R1)-(AES-256-GCM)
- Session ID: 53:BF:2F:D2:86:74:BD:BC:85:A8:67:12:0B:39:7A:12:EA:2F:91:1F:8E:06:5E:94:7F:20:11:4F:FC:51:60:8F
- Ephemeral EC Diffie-Hellman parameters
 - Using curve: SECP256R1
 - Curve size: 256 bits
- Key Exchange: ECDHE-RSA
- Server Signature: RSA-SHA256
- Cipher: AES-256-GCM
- Compression: NULL
- Options: safe renegotiation,
- Handshake was completed

- Simple Client Mode:

*** Fatal error: The TLS connection was non-properly terminated.
*** Server has terminated the connection abnormally.

Related unsolved issue: Server TLS configuration is broken and vulnerable #144

  • No git commits in months and an expired TLS certificate are an indication that marmalade is dead. I would advice removing it as package repository. – Flow Jan 7 at 10:31

The server configuration on marmalade.org is broken: It does not serve the intermediate certificate it is using. This has been pointed out in half a dozen of issues now at https://github.com/nicferrier/elmarmalade -- I can discern no action.

So one can say that marmalade is defunct.

Unfortunately, I also don't know yet how to make the Emacs package manager work again in the presence of this error.


I got this to work by downloading the PEM file for [Intermediate CA #2] COMODO RSA Organization Validation Secure Server CA (SHA-2) into ~/etc/tls/certificates/comodo.rsa.ca.intermediate.crt and adding the following to .emacs:

  (require 'gnutls)
  (add-to-list 'gnutls-trustfiles

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.