While troubleshooting a Debian 7 (Wheezy) server's SSL connectivity issues, I discovered several modern websites failing with certificate validation errors. The specific case involved DigiCert's DigiCert Global Root G2 certificate chain breaking due to missing root CA trust.

First, I verified the basic maintenance commands:

sudo apt-get update
sudo apt-get upgrade
sudo update-ca-certificates --fresh

The package version revealed an outdated CA store:

apt-cache policy ca-certificates
# Output showed:
# Installed: 20130119+deb7u1
# Candidate: 20130119+deb7u2

Despite the Git repository containing updated certificates (visible at Debian's Salsa repo), the packaged version in Wheezy's repositories lacked newer root CAs. This creates a security gap as modern websites migrate to newer certificate chains.

Method 1: Security Repository Update

First ensure your sources.list includes security updates:

deb http://security.debian.org/ wheezy/updates main

Then force a reinstall:

sudo apt-get install --reinstall ca-certificates=20130119+deb7u2
sudo update-ca-certificates --verbose

Method 2: Manual Certificate Injection

For critical certificates like DigiCert G2:

wget https://cacerts.digicert.com/DigiCertGlobalRootG2.crt
sudo cp DigiCertGlobalRootG2.crt /usr/local/share/ca-certificates/
sudo update-ca-certificates

Method 3: Mozilla's Cert Bundle

As a nuclear option (use cautiously in production):

wget https://curl.se/ca/cacert.pem
sudo mv /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt.bak
sudo cp cacert.pem /etc/ssl/certs/ca-certificates.crt

Test SSL connectivity using OpenSSL:

openssl s_client -connect example.com:443 -showcerts 2>/dev/null | openssl verify -CApath /etc/ssl/certs/

Or with cURL for specific certificate validation:

curl --cacert /etc/ssl/certs/ca-certificates.crt -v https://example.com

For production systems still running Wheezy, consider either:

• Migrating to a supported Debian version
• Setting up a local CA certificate cache updated through cron
• Implementing a reverse proxy with modern SSL termination

Example cron job for monthly updates:

0 0 1 * * /usr/bin/curl -s https://curl.se/ca/cacert.pem -o /usr/local/share/ca-certificates/cacert.pem && /usr/sbin/update-ca-certificates

---

Debian Wheezy (7.x) systems frequently encounter SSL/TLS connection failures due to expired or missing root certificates. The core issue stems from:

• Aged ca-certificates package (20130119+deb7u1) lacking modern CA roots
• Security repository not being properly configured in sources.list
• Missing intermediate certificate updates from major CAs like DigiCert

First, check your installed certificates version:

apt-cache policy ca-certificates
openssl version
ls -l /etc/ssl/certs/ | wc -l

Compare against known good baseline (Debian Wheezy should have ~150 certificates).

1. Ensure proper sources.list configuration:

deb http://security.debian.org/ wheezy/updates main
deb-src http://security.debian.org/ wheezy/updates main

2. Force full certificate update:

sudo apt-get update
sudo apt-get install --reinstall ca-certificates
sudo update-ca-certificates --fresh
sudo dpkg-reconfigure ca-certificates

For cases where automatic updates fail, manually add missing certificates:

# Download DigiCert Global Root G2
wget https://cacerts.digicert.com/DigiCertGlobalRootG2.crt

# Convert and install
sudo openssl x509 -inform DER -in DigiCertGlobalRootG2.crt -out /usr/local/share/ca-certificates/DigiCertGlobalRootG2.crt
sudo update-ca-certificates

# Verify installation
openssl x509 -in /etc/ssl/certs/DigiCert_Global_Root_G2.pem -text -noout

Validate SSL connectivity with these diagnostic commands:

# Test HTTPS connection
openssl s_client -connect example.com:443 -servername example.com -showcerts

# Check specific certificate chain
echo | openssl s_client -connect example.com:443 2>/dev/null | openssl x509 -noout -issuer -subject

For production systems still running Wheezy:

• Set up cron job for weekly certificate checks
• Monitor /var/log/daemon.log for SSL errors
• Consider upgrading to supported Debian version
• Maintain local copy of critical CA bundles

Example monitoring script:

#!/bin/bash
EXPIRY=$(openssl x509 -enddate -noout -in /etc/ssl/certs/DigiCert_Global_Root_G2.pem)
if [[ $EXPIRY =~ "Jan 15 23:59:59 2038" ]]; then
    echo "Certificate valid"
else
    echo "Certificate requires update"
fi