Public bug reported: Affects: ubuntu / appstream (https://bugs.launchpad.net/ubuntu/+source/appstream/+filebug)
Description: The host appstream.ubuntu.com (185.125.188.36) is serving a TLS certificate that expired on Jul 31 2026. GNOME Software fetches deb-app screenshots from https://appstream.ubuntu.com/media/... ; every screenshot download fails with "Unacceptable TLS certificate", so no image previews render in the Software detail pages. This only affects the deb/AppStream screenshot path. Snap app screenshots (snapcraft.io / dashboard.snapcraft.io) are unaffected and still load. Steps to reproduce: 1. On Ubuntu 26.04 with gnome-software (not snap-store), open any deb app's detail page (e.g. GNOME Tweaks, GNOME Music, Rhythmbox). 2. Observe the screenshot carousel is empty / images never load. 3. Check the user journal: journalctl --user -u gnome-software --since "1 hour ago" | grep screenshot Expected error: Failed to download screenshot 'https://appstream.ubuntu.com/media/resolute/org/gnome/tweaks/.../[email protected]': Unacceptable TLS certificate Independent verification of the expired cert: $ echo | openssl s_client -connect appstream.ubuntu.com:443 -servername appstream.ubuntu.com | openssl x509 -noout -subject -issuer -dates subject=CN=appstream.ubuntu.com issuer=C=US, O=Let's Encrypt, CN=R13 notBefore=May 2 11:13:33 2026 GMT notAfter=Jul 31 11:13:32 2026 GMT <-- expired ~25 days ago $ echo | openssl s_client -connect appstream.ubuntu.com:443 -servername appstream.ubuntu.com 2>/dev/null | grep "Verify return code" Verify return code: 10 (certificate has expired) $ curl -vI https://appstream.ubuntu.com/media/... curl: (60) SSL certificate OpenSSL verify result: certificate has expired Other Canonical hosts on the same machine/network validate fine, confirming this is not a local clock/CA/proxy issue: launchpad.net notAfter=Sep 18 2026 (valid) archive.ubuntu.com notAfter=Oct 27 2026 (valid) security.ubuntu.com notAfter=Nov 1 2026 (valid) api.launchpad.net notAfter=Sep 18 2026 (valid) snapcraft.io notAfter=Sep 27 2026 (valid) Only appstream.ubuntu.com is expired. DNS resolves to a single Canonical-owned IP with no CNAME / no alternate edge: $ dig +short A appstream.ubuntu.com 185.125.188.36 $ dig @8.8.8.8 +short A appstream.ubuntu.com 185.125.188.36 Environment: Ubuntu 26.04.1 LTS (resolute) gnome-software 50.0-1 appstream 1.1.2-1 ca-certificates 20260601~26.04.1 libsoup-3.0-0 3.6.6-1 System clock: NTP-synced to ntp-nts-2.ps5.canonical.com, within 0.0001s. Likely cause: Automatic Let's Encrypt renewal failed for the appstream.ubuntu.com host, and the low traffic to /media (only deb-app screenshots, not used by the default snap-store) meant nobody noticed for ~25 days. The cert just needs renewing on Canonical's side. Expected fix: Renew the TLS certificate on appstream.ubuntu.com so screenshot downloads succeed again. ** Affects: appstream (Ubuntu) Importance: Undecided Status: New -- You received this bug notification because you are a member of Ubuntu Desktop Bugs, which is subscribed to appstream in Ubuntu. https://bugs.launchpad.net/bugs/2164983 Title: appstream.ubuntu.com serving expired TLS certificate — GNOME Software can't load screenshots To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/appstream/+bug/2164983/+subscriptions -- desktop-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/desktop-bugs
![https://appstream.ubuntu.com/media/resolute/org/gnome/tweaks/.../[email protected]](https://appstream.ubuntu.com/media/resolute/org/gnome/tweaks/.../image-1_624x...@1.png){kind=link}