Bug 1980910

Description of problem:
Attempting to use an https source for the install.img results in the installation hanging because it cannot verify the ssl certificate due to:

[   11.753820] dracut-initqueue[1203]: curl: (77) error setting certificate file: /etc/pki/tls/certs/ca-bundle.crt


Version-Release number of selected component (if applicable):


How reproducible:

100% if using https source


Steps to Reproduce:
1. Use virt install to attempt to install from the odcs composes
WORK_DIR=$(pwd)
MIRROR="https://odcs.stream.centos.org/test/latest-CentOS-Stream/compose"
DISK_SIZE=10


virt-install \
    --transient \
    --name=centos-9-stream \
    --ram=4096 \
    --arch=x86_64 \
    --cpu=host \
    --vcpus=4 \
    --os-variant=rhel8.0 \
    --extra-args="ipv6.disable=1 inst.text console=tty0 console=ttyS0,115200 rd_NO_PLYMOUTH" \
    --disk="${WORK_DIR}/centos-9-stream.img,size=${DISK_SIZE},sparse=true,format=qcow2" \
    --location="${MIRROR}/BaseOS/x86_64/os" \
    --serial=pty \
    --nographics


Actual results:

Install haults because it cannot fetch the install.img

[   10.239528] dracut-initqueue[1071]: Warning: can't find installer main image path in .treeinfo
[   10.264253] dracut-initqueue[1209]:   % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
[   10.266804] dracut-initqueue[1209]:                                  Dload  Upload   Total   Spent    Left  Speed
  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0
[   10.327793] dracut-initqueue[1209]: curl: (77) error setting certificate file: /etc/pki/tls/certs/ca-bundle.crt
[   10.333588] dracut-initqueue[1203]: Warning: Downloading 'https://odcs.stream.centos.org/test/latest-CentOS-Stream/compose/BaseOS/x86_64/os/images/install.img' failed!
[   10.361152] dracut-initqueue[1219]:   % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
[   10.361407] dracut-initqueue[1219]:                                  Dload  Upload   Total   Spent    Left  Speed
  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0
[   10.418645] dracut-initqueue[1219]: curl: (77) error setting certificate file: /etc/pki/tls/certs/ca-bundle.crt
[   10.435797] dracut-initqueue[1213]: Warning: Downloading 'https://odcs.stream.centos.org/test/latest-CentOS-Stream/compose/BaseOS/x86_64/os/LiveOS/squashfs.img' failed!
[   10.436456] dracut-initqueue[1071]: Warning: anaconda: failed to fetch stage2 from https://odcs.stream.centos.org/test/latest-CentOS-Stream/compose/BaseOS/x86_64/os
<info>  [1625860137.9996] policy: set-hostname: set hostname to 'localhost.localdomain' (no hostname found)
[  148.798622] dracut-initqueue[1071]: Warning: dracut-initqueue: timeout, still waiting for following initqueue hooks:
[  148.805771] dracut-initqueue[1071]: Warning: /lib/dracut/hooks/initqueue/finished/devexists-\x2fdev\x2froot.sh: "[ -e "/dev/root" ]"
[  148.813008] dracut-initqueue[1071]: Warning: /lib/dracut/hooks/initqueue/finished/nm.sh: "[ -f /tmp/nm.done ]"
[  148.819697] dracut-initqueue[1071]: Warning: /lib/dracut/hooks/initqueue/finished/wait_for_settle.sh: "[ -f /tmp/settle.done ]"
[  148.829479] dracut-initqueue[1071]: Warning: dracut-initqueue: starting timeout scripts
...SNIP...
[  219.804591] dracut-initqueue[1071]: Warning: /lib/dracut/hooks/initqueue/finished/wait_for_settle.sh: "[ -f /tmp/settle.done ]"
[  219.808806] dracut-initqueue[1071]: Warning: dracut-initqueue: starting timeout scripts
[  219.809385] dracut-initqueue[1071]: Warning: Could not boot.
         Starting Dracut Emergency Shell...
Warning: /dev/root does not exist

Generating "/run/initramfs/rdsosreport.txt"


Entering emergency mode. Exit the shell to continue.
Type "journalctl" to view system logs.
You might want to save "/run/initramfs/rdsosreport.txt" to a USB stick or /boot
after mounting them and attach it to a bug report.


Press Enter for maintenance
(or press Control-D to continue): 



Expected results:

install.img should be downloaded and the installation should continue.

Additional info:

If you configure a passthrough proxy (e.g. via nginx) that handles the http/https transition the installation works fine.