Some https sites are signed by a cert that can be verified through a chain of certs up to one that comes with the distribution. Many different sites just have their own cert, not verifiable by a well-known authority. Some DNF users are running their repos on such servers and currently that fails ("Cannot download repomd.xml: Cannot download repodata/repomd.xml"). DNF has a switch for these situations (sslverify=false) that should instruct librepo to disable the ssl verification (the connection is still encrypted but can not be authenticated and with this switch we say 'thats ok'), but there doesn't seem to be a setting to enable this in librepo. Tomas, could you please provide one? Additionaly, the error message could be improved to say something like 'ssl verification failed', but there's no requirement for that so that's more up to you for now.
Fixed in HEAD: https://github.com/Tojaj/librepo/commit/51d32c6cd88ba0139c32793183fd6a236c1ef456 https://github.com/Tojaj/librepo/commit/dbbb485d038641d8c379571485888328ccc872ae New options LRO_SSLVERIFYPEER and LRO_SSLVERIFYHOST were added LRO_SSLVERIFYPEER - This option determines whether librepo verifies the authenticity of the peer's certificate. This trust is based on a chain of digital signatures, rooted in certification authority (CA) certificates. LRO_SSLVERIFYHOST - This option determines whether librepo verifies that the server cert is for the server it is known as. By default both options are enabled
Thanks Tomas, the two options looks like the right thing to do. Will integrate with DNF as soon as this is in a Fedora build, though no rushing.
librepo-1.7.3-1.fc20 has been submitted as an update for Fedora 20. https://admin.fedoraproject.org/updates/librepo-1.7.3-1.fc20
Package librepo-1.7.3-1.fc20: * should fix your issue, * was pushed to the Fedora 20 testing repository, * should be available at your local mirror within two days. Update it with: # su -c 'yum update --enablerepo=updates-testing librepo-1.7.3-1.fc20' as soon as you are able to. Please go to the following url: https://admin.fedoraproject.org/updates/FEDORA-2014-6052/librepo-1.7.3-1.fc20 then log in and leave karma (feedback).
librepo-1.7.3-1.fc20 has been pushed to the Fedora 20 stable repository. If problems still persist, please make note of it in this bug report.