The ssl connection fails with error 48: Unknown CA. How can I fix it?
My Goal is to use Debian live-build to create a live-Image for Rootkit-Detection. I have put the links to the https-mirrors in the corresponding variables in bootstrap. But if I hit lb build it fails with the Error 48.
My OS is Debian Trixie if that is important for the problem.
Here is my terminal.
root@Geraet4 /h/j/Debian_ISO# lb build
[2026-05-03 18:58:49] lb build
P: live-build 20250505+deb13u1
P: Building for a debian/testing/amd64 system
[2026-05-03 18:58:50] lb bootstrap
P: Setting up clean exit handler
[2026-05-03 18:58:50] lb bootstrap_cache restore
P: Restoring bootstrap stage from cache...
[2026-05-03 18:58:52] lb bootstrap_debootstrap
P: Begin bootstrapping system...
W: Skipping bootstrap, already done
[2026-05-03 18:58:52] lb bootstrap_cache save
P: Saving bootstrap stage to cache...
P: Bootstrap stage completed
P: Begin unmounting filesystems...
P: Saving caches...
Reading package lists... Done
Building dependency tree... Done
[2026-05-03 18:58:53] lb chroot
P: Setting up clean exit handler
[2026-05-03 18:58:53] lb chroot_cache restore
[2026-05-03 18:58:54] lb chroot_prep install all mode-archives-chroot
[2026-05-03 18:58:54] lb chroot_devpts install
P: Begin mounting /dev/pts...
[2026-05-03 18:58:54] lb chroot_proc install
P: Begin mounting /proc...
[2026-05-03 18:58:54] lb chroot_selinuxfs install
[2026-05-03 18:58:54] lb chroot_sysfs install
P: Begin mounting /sys...
[2026-05-03 18:58:54] lb chroot_debianchroot install
P: Configuring file /etc/debian_chroot
[2026-05-03 18:58:54] lb chroot_dpkg install
P: Configuring file /sbin/start-stop-daemon
dpkg-divert: warning: diverting file '/usr/sbin/start-stop-daemon' from an Essential package with rename is dangerous, use --no-rename
[2026-05-03 18:58:54] lb chroot_tmpfs install
[2026-05-03 18:58:54] lb chroot_sysv-rc install
P: Configuring file /usr/sbin/policy-rc.d
[2026-05-03 18:58:54] lb chroot_hosts install
P: Configuring file /etc/hosts
[2026-05-03 18:58:54] lb chroot_resolv install
P: Configuring file /etc/resolv.conf
[2026-05-03 18:58:54] lb chroot_hostname install
P: Configuring file /etc/hostname
P: Configuring file /bin/hostname
dpkg-divert: warning: diverting file '/usr/bin/hostname' from an Essential package with rename is dangerous, use --no-rename
[2026-05-03 18:58:54] lb chroot_apt install
P: Configuring file /etc/apt/apt.conf
[2026-05-03 18:58:54] lb chroot_archives chroot install
P: Configuring file /etc/apt/sources.list
Ign:1 https://security.debian.ethz.ch/debian-security stable-security InRelease
Ign:2 https://debian.ethz.ch/debian stable InRelease
Get:3 http://security.debian.org testing-security InRelease [48.0 kB]
Ign:4 https://mirror.eu.oneandone.net testing InRelease
Ign:5 https://security.debian.org/debian-security stable-security InRelease
Ign:6 https://mirror.eu.oneandone.net testing-updates InRelease
Ign:1 https://security.debian.ethz.ch/debian-security stable-security InRelease
Ign:2 https://debian.ethz.ch/debian stable InRelease
Ign:5 https://security.debian.org/debian-security stable-security InRelease
Ign:6 https://mirror.eu.oneandone.net testing-updates InRelease
Ign:4 https://mirror.eu.oneandone.net testing InRelease
Ign:1 https://security.debian.ethz.ch/debian-security stable-security InRelease
Ign:2 https://debian.ethz.ch/debian stable InRelease
Ign:5 https://security.debian.org/debian-security stable-security InRelease
Ign:4 https://mirror.eu.oneandone.net testing InRelease
Ign:6 https://mirror.eu.oneandone.net testing-updates InRelease
Ign:1 https://security.debian.ethz.ch/debian-security stable-security InRelease
Ign:2 https://debian.ethz.ch/debian stable InRelease
Ign:5 https://security.debian.org/debian-security stable-security InRelease
Ign:6 https://mirror.eu.oneandone.net testing-updates InRelease
Ign:4 https://mirror.eu.oneandone.net testing InRelease
Ign:1 https://security.debian.ethz.ch/debian-security stable-security InRelease
Ign:2 https://debian.ethz.ch/debian stable InRelease
Ign:5 https://security.debian.org/debian-security stable-security InRelease
Ign:4 https://mirror.eu.oneandone.net testing InRelease
Ign:6 https://mirror.eu.oneandone.net testing-updates InRelease
Err:1 https://security.debian.ethz.ch/debian-security stable-security InRelease
SSL connection failed: error:0A000086:SSL routines::certificate verify failed / Success [IP: 129.132.89.152 443]
Err:2 https://debian.ethz.ch/debian stable InRelease
SSL connection failed: error:0A000086:SSL routines::certificate verify failed / Success [IP: 129.132.89.152 443]
Err:5 https://security.debian.org/debian-security stable-security InRelease
SSL connection failed: error:0A000086:SSL routines::certificate verify failed / Success [IP: 151.101.194.132 443]
Err:6 https://mirror.eu.oneandone.net testing-updates InRelease
SSL connection failed: error:0A000086:SSL routines::certificate verify failed / Success [IP: 217.72.206.21 443]
Err:4 https://mirror.eu.oneandone.net testing InRelease
SSL connection failed: error:0A000086:SSL routines::certificate verify failed / Success [IP: 217.72.206.21 443]
Fetched 48.0 kB in 35s (1384 B/s)
Reading package lists... Done
W: Failed to fetch https://mirror.eu.oneandone.net/dists/testing/InRelease SSL connection failed: error:0A000086:SSL routines::certificate verify failed / Success [IP: 217.72.206.21 443]
W: Failed to fetch https://mirror.eu.oneandone.net/dists/testing-updates/InRelease SSL connection failed: error:0A000086:SSL routines::certificate verify failed / Success [IP: 217.72.206.21 443]
W: Failed to fetch https://debian.ethz.ch/debian/dists/stable/InRelease SSL connection failed: error:0A000086:SSL routines::certificate verify failed / Success [IP: 129.132.89.152 443]
W: Failed to fetch https://security.debian.ethz.ch/debian-security/dists/stable-security/InRelease SSL connection failed: error:0A000086:SSL routines::certificate verify failed / Success [IP: 129.132.89.152 443]
W: Failed to fetch https://security.debian.org/debian-security/dists/stable-security/InRelease SSL connection failed: error:0A000086:SSL routines::certificate verify failed / Success [IP: 151.101.194.132 443]
W: Some index files failed to download. They have been ignored, or old ones used instead.
N: Some sources can be modernized. Run 'apt modernize-sources' to do so.
Reading package lists... Done
Building dependency tree... Done
debian-archive-keyring is already the newest version (2025.1).
Solving dependencies... Done
0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.
Ign:1 https://debian.ethz.ch/debian stable InRelease
Ign:2 https://security.debian.org/debian-security stable-security InRelease
Hit:3 http://security.debian.org testing-security InRelease
Ign:4 https://mirror.eu.oneandone.net testing InRelease
Ign:5 https://security.debian.ethz.ch/debian-security stable-security InRelease
Ign:6 https://mirror.eu.oneandone.net testing-updates InRelease
Ign:1 https://debian.ethz.ch/debian stable InRelease
Ign:2 https://security.debian.org/debian-security stable-security InRelease
Ign:5 https://security.debian.ethz.ch/debian-security stable-security InRelease
Ign:6 https://mirror.eu.oneandone.net testing-updates InRelease
Ign:4 https://mirror.eu.oneandone.net testing InRelease
Ign:1 https://debian.ethz.ch/debian stable InRelease
Ign:2 https://security.debian.org/debian-security stable-security InRelease
Ign:5 https://security.debian.ethz.ch/debian-security stable-security InRelease
Ign:4 https://mirror.eu.oneandone.net testing InRelease
Ign:6 https://mirror.eu.oneandone.net testing-updates InRelease
Ign:1 https://debian.ethz.ch/debian stable InRelease
Ign:2 https://security.debian.org/debian-security stable-security InRelease
Ign:5 https://security.debian.ethz.ch/debian-security stable-security InRelease
Ign:6 https://mirror.eu.oneandone.net testing-updates InRelease
Ign:4 https://mirror.eu.oneandone.net testing InRelease
Ign:1 https://debian.ethz.ch/debian stable InRelease
Ign:2 https://security.debian.org/debian-security stable-security InRelease
Ign:5 https://security.debian.ethz.ch/debian-security stable-security InRelease
Ign:4 https://mirror.eu.oneandone.net testing InRelease
Ign:6 https://mirror.eu.oneandone.net testing-updates InRelease
Err:1 https://debian.ethz.ch/debian stable InRelease
SSL connection failed: error:0A000086:SSL routines::certificate verify failed / Success [IP: 129.132.89.152 443]
Err:2 https://security.debian.org/debian-security stable-security InRelease
SSL connection failed: error:0A000086:SSL routines::certificate verify failed / Success [IP: 151.101.130.132 443]
Err:5 https://security.debian.ethz.ch/debian-security stable-security InRelease
SSL connection failed: error:0A000086:SSL routines::certificate verify failed / Success [IP: 129.132.89.152 443]
Err:6 https://mirror.eu.oneandone.net testing-updates InRelease
SSL connection failed: error:0A000086:SSL routines::certificate verify failed / Success [IP: 217.72.206.21 443]
Err:4 https://mirror.eu.oneandone.net testing InRelease
SSL connection failed: error:0A000086:SSL routines::certificate verify failed / Success [IP: 217.72.206.21 443]
Reading package lists... Done
W: Failed to fetch https://mirror.eu.oneandone.net/dists/testing/InRelease SSL connection failed: error:0A000086:SSL routines::certificate verify failed / Success [IP: 217.72.206.21 443]
W: Failed to fetch https://mirror.eu.oneandone.net/dists/testing-updates/InRelease SSL connection failed: error:0A000086:SSL routines::certificate verify failed / Success [IP: 217.72.206.21 443]
W: Failed to fetch https://debian.ethz.ch/debian/dists/stable/InRelease SSL connection failed: error:0A000086:SSL routines::certificate verify failed / Success [IP: 129.132.89.152 443]
W: Failed to fetch https://security.debian.ethz.ch/debian-security/dists/stable-security/InRelease SSL connection failed: error:0A000086:SSL routines::certificate verify failed / Success [IP: 129.132.89.152 443]
W: Failed to fetch https://security.debian.org/debian-security/dists/stable-security/InRelease SSL connection failed: error:0A000086:SSL routines::certificate verify failed / Success [IP: 151.101.130.132 443]
W: Some index files failed to download. They have been ignored, or old ones used instead.
N: Some sources can be modernized. Run 'apt modernize-sources' to do so.
Reading package lists... Done
Building dependency tree... Done
Calculating upgrade... Done
0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.
Reading package lists... Done
Building dependency tree... Done
Calculating upgrade... Done
0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.
Reading package lists... Done
Building dependency tree... Done
Del linux-image-amd64 6.19.13-1 [1696 B]
This is the error message in wireshark.
