Re: BUG #17224: Postgres Yum repo mirror has expired SSL certificate

Matt Bush  writes:
> As mentioned, it's entirely intermittent. The playbook action immediately
> prior to the failing step is to verify that the installed ca-certificates
> us up-to-date, which it is:

> $ rpm -qa | grep ca-certificates
> ca-certificates-2021.2.50-72.el7_9.noarch

Okay, but what about your openssl version?  (I'd think RHEL7 contains
something reasonably up-to-date, but I might be wrong.)  It might be
worth logging the output of "curl -V".

The intermittency might be an artifact of consulting several different
mirrors, only some of which use Let's Encrypt certificates.  (Although
I think all of *.postgresql.org do use those.)

You could also investigate by logging the output of

openssl s_client -connect download.postgresql.org:443