Fedora Account System
Red Hat Associate
Red Hat Customer
Steam client from rpmfusion stop working after upgrade ca-certificates to 2024.2.69_v8.0.401-1.fc42 version In the steam terminal output appears such message: steamwebhelper.sh[23045]: Using CEF sandbox \(try with -no-cef-sandbox if this fails\) steamwebhelper.sh[23045]: Starting steamwebhelper with Sniper steam runtime at /home/mikhail/.local/share/Steam/ubuntu12_64/steam-runtime-sniper/_v2-entry-point src/common/opensslconnection.cpp (1624) : unable to load trusted SSL root certificates src/common/opensslconnection.cpp (1624) : unable to load trusted SSL root certificates assert_20240925010634_4.dmp[23013]: Finished uploading minidump (out-of-process): success = yes assert_20240925010634_4.dmp[23013]: response: CrashID=bp-33704013-0713-43c4-b055-9e6452240924 assert_20240925010634_4.dmp[23013]: file ''/tmp/dumps/assert_20240925010634_4.dmp'', upload yes: ''CrashID=bp-33704013-0713-43c4-b055-9e6452240924'' Last good version ca-certificates package is 2024.2.68_v8.0.302-3.fc41 Reproducible: Always
Created attachment 2048551 [details] steam good output
Created attachment 2048552 [details] steam bad output
This is very likely because steam assumes certificates are in a bundle file at /etc/pki/tls/cert.pem but this update moved them into separate files in /etc/pki/tls/certs to improve startup speed of OpenSSL. Both of these are default locations where OpenSSL looks for certificates, so applications should not have to do anything to use them. It seems steam attempts to load them manually anyway, which now fails. We can't just restore the cert.pem file or the performance improvements would be gone. Steam should not load this file manually, or if it insists on loading one, should be using /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem. Can you try with an empty file at /etc/pki/tls/cert.pem and see if that helps? Also, Frantisek, Bob, we should really send a Fedora Change or at least an announcement to fedora-devel for this change.
> Can you try with an empty file at /etc/pki/tls/cert.pem and see if that helps? Unfortunately empty file is not solution. # ls /etc/pki/tls/cert.pem ls: cannot access '/etc/pki/tls/cert.pem': No such file or directory # touch /etc/pki/tls/cert.pem # ls /etc/pki/tls/cert.pem ==== steamwebhelper.sh[95969]: Using CEF sandbox \(try with -no-cef-sandbox if this fails\) steamwebhelper.sh[95969]: Starting steamwebhelper with Sniper steam runtime at /home/mikhail/.local/share/Steam/ubuntu12_64/steam-runtime-sniper/_v2-entry-point src/common/opensslconnection.cpp (1624) : unable to load trusted SSL root certificates src/common/opensslconnection.cpp (1624) : unable to load trusted SSL root certificates assert_20240925122621_4.dmp[95937]: Finished uploading minidump (out-of-process): success = yes assert_20240925122621_4.dmp[95937]: response: CrashID=bp-6f7af83e-1b6c-4e4f-b61d-37dbd2240925
Hello Mikhail, Thanks for you report. The following should temporarily fix the issues for now: ln -s /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem /etc/pki/tls/cert.pem Would you be willing to file a bug to rpmfusion steam bugzilla and refer them to this work in progress document: https://fedoraproject.org/wiki/Changes/dropingOfCertPemFile Regards, Frantisek
Mikhail nvm the filing of the bug with the rpmfustion steam package, I will do that.
The change that has caused this was reverted
The needinfo request[s] on this closed bug have been removed as they have been unresolved for 120 days
Again after upgrade ca-certificates to 2024.2.69_v8.0.401-7.fc43 version Steam client from rpmfusion stop working! mikhail@primary-ws ~> steam --console steam.sh[21467]: Running Steam on fedora 43 64-bit steam.sh[21467]: STEAM_RUNTIME is enabled automatically setup.sh[21518]: Steam runtime environment up-to-date! steam.sh[21467]: Log already open steam.sh[21467]: Steam client's requirements are satisfied CProcessEnvironmentManager is ready, 6 preallocated environment variables. [2025-07-29 11:21:09] Startup - updater built Jul 24 2025 23:28:47 [2025-07-29 11:21:09] Startup - Steam Client launched with: '/home/mikhail/.local/share/Steam/ubuntu12_32/steam' '-srt-logger-opened' '--console' [2025-07-29 11:21:09] Opted in to client beta 'publicbeta' via beta file You are in the 'publicbeta' client beta. src/common/opensslconnection.cpp (1636) : unable to load trusted SSL root certificates src/common/opensslconnection.cpp (1636) : unable to load trusted SSL root certificates 07/29 11:21:09 minidumps folder is set to /tmp/dumps 07/29 11:21:09 Init: Installing breakpad exception handler for appid(steam)/version(1753403107)/tid(21570) CProcessEnvironmentManager is ready, 6 preallocated environment variables. [2025-07-29 11:21:09] Process started with command-line: '/home/mikhail/.local/share/Steam/ubuntu12_32/steam' '-child-update-ui' '-child-update-ui-socket' '8' '-srt-logger-opened' '--console' 07/29 11:21:09 minidumps folder is set to /tmp/dumps [2025-07-29 11:21:09] Using update UI: console 07/29 11:21:09 Init: Installing breakpad exception handler for appid(steam)/version(0)/tid(21571) [2025-07-29 11:21:09] Create window assert_20250729112109_3.dmp[21575]: Uploading dump (out-of-process) /tmp/dumps/assert_20250729112109_3.dmp [2025-07-29 11:21:09] Loading cached metrics from disk (/home/mikhail/.local/share/Steam/package/steam_client_metrics.bin) [2025-07-29 11:21:09] Using the following download hosts for Public, Realm steamglobal [2025-07-29 11:21:09] 1. https://client-update.akamai.steamstatic.com, /, Realm 'steamglobal', weight was 400, source = 'update_hosts_cached.vdf' [2025-07-29 11:21:09] 2. https://client-update.fastly.steamstatic.com, /, Realm 'steamglobal', weight was 900, source = 'update_hosts_cached.vdf' [2025-07-29 11:21:09] 3. https://client-update.steamstatic.com, /, Realm 'steamglobal', weight was 1, source = 'baked in' 07/29 11:21:09 minidumps folder is set to /tmp/dumps [2025-07-29 11:21:09] Verifying installation... [2025-07-29 11:21:09] Verifying file sizes only [2025-07-29 11:21:09] Set percent complete: 0 [2025-07-29 11:21:09] Set percent complete: -1 [2025-07-29 11:21:09] Set status message: Verifying installation... [----] Verifying installation... [2025-07-29 11:21:09] Verification complete UpdateUI: skip show logo [2025-07-29 11:21:09] Destroy window Steam logging initialized: directory: /home/mikhail/.local/share/Steam/logs [2025-07-29 11:21:09] Shutdown /usr/share/themes/Adwaita/gtk-2.0/main.rc:733: error: unexpected identifier 'direction', expected character '}' /usr/share/themes/Adwaita/gtk-2.0/hacks.rc:28: error: invalid string constant "normal_entry", expected valid string constant assert_20250729112109_3.dmp[21575]: Finished uploading minidump (out-of-process): success = yes assert_20250729112109_3.dmp[21575]: response: CrashID=bp-2a3c5b1f-206d-4826-b05d-8fc442250728 assert_20250729112109_3.dmp[21575]: file ''/tmp/dumps/assert_20250729112109_3.dmp'', upload yes: ''CrashID=bp-2a3c5b1f-206d-4826-b05d-8fc442250728'' XRRGetOutputInfo Workaround: initialized with override: 0 real: 0xf62f3090 XRRGetCrtcInfo Workaround: initialized with override: 0 real: 0xf62f1800 07/29 11:21:10 minidumps folder is set to /tmp/dumps 07/29 11:21:10 Init: Installing breakpad exception handler for appid(steamsysinfo)/version(1753403107)/tid(21595) Running query: 1 - GpuTopology Response: gpu_topology { gpus { id: 1 name: "AMD Radeon RX 7900 XTX (RADV NAVI31)" vram_size_bytes: 25753026560 driver_id: k_EGpuDriverId_MesaRadv driver_version_major: 25 driver_version_minor: 2 driver_version_patch: 99 luid: 0 } gpus { id: 2 name: "AMD Radeon Graphics (RADV RAPHAEL_MENDOCINO)" vram_size_bytes: 19581616128 driver_id: k_EGpuDriverId_MesaRadv driver_version_major: 25 driver_version_minor: 2 driver_version_patch: 99 luid: 0 } gpus { id: 3 name: "llvmpipe (LLVM 20.1.8, 256 bits)" vram_size_bytes: 3221225472 driver_id: k_EGpuDriverId_MesaLLVMPipe driver_version_major: 25 driver_version_minor: 2 driver_version_patch: 99 luid: 0 } default_gpu_id: 1 } Exit code: 0 Saving response to: /tmp/steamkHkFhe - 183 bytes steamwebhelper.sh[21612]: Starting steamwebhelper under bootstrap steamrt steam runtime via: /home/mikhail/.local/share/Steam/steamrt64/steam-runtime-steamrt/_v2-entry-point steamwebhelper.sh[21612]: Starting steamwebhelper with steamrt steam runtime at /home/mikhail/.local/share/Steam/steamrt64/steam-runtime-steamrt/_v2-entry-point src/common/opensslconnection.cpp (1636) : unable to load trusted SSL root certificates src/common/opensslconnection.cpp (1636) : unable to load trusted SSL root certificates assert_20250729112111_16.dmp[21681]: Uploading dump (out-of-process) /tmp/dumps/assert_20250729112111_16.dmp Steam Runtime Launch Service: starting steam-runtime-launcher-service Steam Runtime Launch Service: steam-runtime-launcher-service is running pid 21688 bus_name=com.steampowered.PressureVessel.LaunchAlongsideSteam assert_20250729112111_16.dmp[21681]: Finished uploading minidump (out-of-process): success = yes assert_20250729112111_16.dmp[21681]: response: CrashID=bp-497b44e8-e7f1-402f-95a8-fe7d62250728 assert_20250729112111_16.dmp[21681]: file ''/tmp/dumps/assert_20250729112111_16.dmp'', upload yes: ''CrashID=bp-497b44e8-e7f1-402f-95a8-fe7d62250728'' exec ./steamwebhelper -nocrashdialog -lang=en_US -cachedir=/home/mikhail/.local/share/Steam/config/htmlcache -steampid=21570 -buildid=1753403107 -steamid=0 -logdir=/home/mikhail/.local/share/Steam/logs -uimode=7 -startcount=0 -steamuniverse=Public -realm=Global -clientui=/home/mikhail/.local/share/Steam/clientui -steampath=/home/mikhail/.local/share/Steam/ubuntu12_32/steam -launcher=0 --valve-initial-threadpool-size=12 --valve-enable-site-isolation --enable-smooth-scrolling --password-store=basic --log-file=/home/mikhail/.local/share/Steam/logs/cef_log.txt --disable-quick-menu --disable-component-update --enable-features=PlatformHEVCDecoderSupport --disable-features=SpareRendererForSitePerProcess,DcheckIsFatal,BlockPromptsIfIgnoredOften,ValveFFmpegAllowLowDelayHEVC src/common/opensslconnection.cpp (1636) : unable to load trusted SSL root certificates src/common/opensslconnection.cpp (1636) : unable to load trusted SSL root certificates 07/29 11:21:18 Init: Installing breakpad exception handler for appid(steam)/version(1753403107)/tid(21570) assert_20250729112118_32.dmp[22023]: Uploading dump (out-of-process) /tmp/dumps/assert_20250729112118_32.dmp assert_20250729112118_32.dmp[22023]: Finished uploading minidump (out-of-process): success = yes assert_20250729112118_32.dmp[22023]: response: CrashID=bp-39e7a9d3-4f41-450f-8f42-ab70e2250728 assert_20250729112118_32.dmp[22023]: file ''/tmp/dumps/assert_20250729112118_32.dmp'', upload yes: ''CrashID=bp-39e7a9d3-4f41-450f-8f42-ab70e2250728'' reaping pid: 21571 -- steam [2025-07-29 11:23:12] Background update loop checking for update. . . [2025-07-29 11:23:12] Checking for available updates... [2025-07-29 11:23:12] Downloading manifest: https://client-update.akamai.steamstatic.com/steam_client_publicbeta_ubuntu12 [2025-07-29 11:23:12] Manifest download: send request [2025-07-29 11:23:12] Manifest download: waiting for download to finish [2025-07-29 11:23:12] Manifest download: finished [2025-07-29 11:23:12] Download failed: http error 0 (client-update.akamai.steamstatic.com/steam_client_publicbeta_ubuntu12) [2025-07-29 11:23:12] Downloading manifest: https://client-update.fastly.steamstatic.com/steam_client_publicbeta_ubuntu12 [2025-07-29 11:23:12] Manifest download: send request [2025-07-29 11:23:12] Manifest download: waiting for download to finish [2025-07-29 11:23:13] Manifest download: finished [2025-07-29 11:23:13] Download failed: http error 0 (client-update.fastly.steamstatic.com/steam_client_publicbeta_ubuntu12) [2025-07-29 11:23:13] Downloading manifest: https://client-update.steamstatic.com/steam_client_publicbeta_ubuntu12 [2025-07-29 11:23:13] Manifest download: send request [2025-07-29 11:23:13] Manifest download: waiting for download to finish [2025-07-29 11:23:13] Manifest download: finished [2025-07-29 11:23:13] Download failed: http error 0 (client-update.steamstatic.com/steam_client_publicbeta_ubuntu12) [2025-07-29 11:23:13] DownloadManifest - exhausted list of download hosts [2025-07-29 11:23:13] failed to load manifest from buffer. [2025-07-29 11:23:13] Failed to load manifest [2025-07-29 11:23:13] Error: Download failed: http error 0 [2025-07-29 11:23:13] Saving metrics to disk (/home/mikhail/.local/share/Steam/package/steam_client_metrics.bin) [2025-07-29 11:23:13] Error: Failed to determine download location for universe 1 [2025-07-29 11:26:18] Error: Failed to determine download location for universe 1 [2025-07-29 11:31:05] Shutdown mikhail@primary-ws ~>
Last good ca-certificates is 2024.2.69_v8.0.401-5.fc42
Sight, Unfortunately I have forgoten about this one during the discovery phase of https://fedoraproject.org/wiki/Changes/dropingOfCertPemFile We have to modify the package to accommodate this change. I will take a look
Created attachment 2106170 [details] Telegram screencast The steam client is not only one application which broke after ca-certificates package update.
Created attachment 2106171 [details] Screenshot working Telegram client This workaround # ln -s /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem /etc/pki/tls/cert.pem not works for Telegram client. Only downgrading package to 2024.2.69_v8.0.401-5.fc42 version helps.
User can use following temporary option https://fedoraproject.org/wiki/Changes/droppingOfCertPemFile#Temporary_fix This doesn't change the fact that this has to be addressed in the packages themselves
Not sure if this is useful but I just moved from Fedora 43 to 44 (rawhide) and have the same issue. Manifested when running the Steam client that's installed by Discover and the default repositories: steamwebhelper.sh[13331]: Starting steamwebhelper with steamrt steam runtime at /home/gregor/.local/share/Steam/steamrt64/steam-runtime-steamrt/_v2-entry-point src/common/opensslconnection.cpp (1636) : unable to load trusted SSL root certificates src/common/opensslconnection.cpp (1636) : unable to load trusted SSL root certificates assert_20251212144044_17.dmp[13390]: Uploading dump (out-of-process) /tmp/dumps/assert_20251212144044_17.dmp assert_20251212144044_17.dmp[13390]: Finished uploading minidump (out-of-process): success = no assert_20251212144044_17.dmp[13390]: error: Couldn't connect to server assert_20251212144044_17.dmp[13390]: file ''/tmp/dumps/assert_20251212144044_17.dmp'', upload no: ''Couldn't connect to server'' As before, fixed using the following workaround: update-ca-trust extract --rhbz2387674
This is to be expected in future releases.. There is a upstream issue that is trying to fix this https://github.com/ValveSoftware/steam-for-linux/issues/12318 we will not be fixing this in fedora.
Actually fixed it in fedora, closing the ticket, feel free to reopen if something breaks.