SSL certificate errors when fetching `i2p-archive-keyring.gpg` and signing keys from `i2p.net`

[FenX999]

Following the Debian install instructions, curl-ing the archive keyring from geti2p.net/_static/i2p-archive-keyring.gpg returns a 301 redirect to https://i2p.net/i2p-archive-keyring.gpg. Connecting to that redirect target fails TLS verification — the server presents a self-signed certificate, and wget additionally reports that the certificate's owner does not match the hostname i2p.net.

Because the keyring is security-critical (it's the root of trust for all subsequently installed I2P packages), I stopped rather than bypass cert checks with -k / --no-check-certificate.

Steps to reproduce

1. curl -v https://geti2p.net/_static/i2p-archive-keyring.gpg -o /tmp/key.gpg
   • TLS to geti2p.net succeeds (valid Let's Encrypt cert, CN=geti2p.net, issued by R13).
   • Response: HTTP/1.1 301 MOVED PERMANENTLY, Location: https://i2p.net/i2p-archive-keyring.gpg.
2. curl -fL https://geti2p.net/_static/i2p-archive-keyring.gpg -o /tmp/key.gpg
   • Fails: curl: (60) SSL certificate problem: self-signed certificate.
3. wget https://i2p.net/idk.key.asc
   • Fails: ERROR: The certificate of 'i2p.net' is not trusted. / doesn't have a known issuer. / owner does not match hostname 'i2p.net'.

Server details from curl -v on geti2p.net

• Server: Werkzeug/3.1.5 Python/3.12.3
• Redirect issued to https://i2p.net/i2p-archive-keyring.gpg
• HSTS header set

Resolved IPs seen from my host

• geti2p.net → 81.7.7.63 (valid cert)
• i2p.net → 109.0.66.29, 2a02:8400::5757:444e:0 (self-signed cert, hostname mismatch)

Environment

• Debian VM (fresh install)
• curl 7.88.1
• ca-certificates package up to date

Impact

The documented curl command in the Debian install instructions cannot complete successfully without disabling certificate verification, which defeats the purpose of fetching a signing key over TLS. New users following the docs will either hit a wall or — worse — be tempted to use -k and import whatever key the endpoint serves.

[zzzi2p]

Thanks for the report.

You didn't say where you got the instructions from, I assume the deb.i2p.net home page? The website instructions at https://i2p.net/en/docs/guides/installing-i2p-on-debian-and-ubuntu/ look right.

I just fixed up deb.i2p.net to fix all the links and instructions so we should be good.

Don't know what your cert issue was with curl and wget, firefox works fine from here. Maybe it was some transient issue with our hosting or DNS, or maybe something malicious is happening with your DNS.