My environment:

  • Linux Mint 17.3 (based on Ubuntu 14.04)
  • Emacs 25.3.1
  • The value of package-archives:

    (("gnu" . "https://elpa.gnu.org/packages/") ("melpa" . "https://melpa.org/packages/") ("marmalade" . "https://marmalade-repo.org/packages/"))

When I ran M-x list-packages, the minibuffer shows:

"Continue connecting? (No, Session only, Always)".

While a *Nework Security Manager* buffer shows up with some information, and the error:

The TLS connection to elpa.gnu.org:443 is insecure for the following reason:

certificate could not be verified

Please see the attached picture for the detail.

I could choose Session only to proceed though.

What debugging technique is available to help narrow down the issue?

enter image description here


1 Answer 1


After much digging, I believe a common cause of this is likely a combination of two things:

  1. elpa.gnu.org is misconfigured, sending its own certificate in duplicate before the issuer certificate - this counts as an out-of-order certificate problem. This can be confirmed using gnutls-cli or openssl s_client. I have notified the maintainer.
  2. A lack of functionality to re-order such out-of-order chains in GnuTLS prior to version 3. In particular, the bug is still present in 2.12.23 which is used to build EVM's Travis binaries and a common Travis build environment.

Note that there are other potential configuration and environment issues that can cause this and similar problems. Provided you have everything else set up correctly though, this seems likely.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.