SSL cert for https://downloads.vscodium.com is signed by invalid authority

[trisweb]

Describe the bug
The current SSL certificate for https://downloads.vscodium.com was created on March 29th, 2025, and expires on the same in 2026, however the certificate authority is invalid and untrusted by most clients.

"net::ERR_CERT_AUTHORITY_INVALID"

Please confirm that this problem is VSCodium-specific

• This bug doesn't happen if I use Microsoft's Visual Studio Code. It only happens in VSCodium.

Please confirm that the issue/resolution isn't already documented

• I checked the Docs page and the Troubleshooting page and my issue is not mentioned there.

To Reproduce
Steps to reproduce the behavior:

1. Go to https://downloads.vscodium.com
2. Observe net::ERR_CERT_AUTHORITY_INVALID certificate security error

Alternatively, update from the mirrored debian repository hosted on https://downloads.vscodium.com/ and see error:

E: Failed to fetch https://download.vscodium.com/debs/dists/vscodium/InRelease Clearsigned file isn't valid, got 'NOSPLIT' (does the network require authentication?)
E: The repository 'https://download.vscodium.com/debs vscodium InRelease' is no longer signed.
N: Updating from such a repository can't be done securely, and is therefore disabled by default.

Expected behavior
Self-expanatory

[daiyam]

@PalinuroSec

[bdube]

The vscodium.com domain appears to have expired and DNS NS has switched from registrar-servers.com to bodis.com.

[daiyam]

Not good at all! I've sent an email to @PalinuroSec. (He has the control on the domain name and he's the team leader of ParrotSec)

@bdube Thx for catching the domain name expiration...

[Beeblebrox21]

- looks like the domain has gone away ...

[strasharo]

The domain now appears to be blocked by the ADGuard list.

[cadusilva]

The domain now appears to be blocked by the ADGuard list.

Not the domain itself, but the CNAME it points to (bodis.com), as it's a monetization service.

[daiyam]

bodis.com is a parking service which is used since the domain name is its grace period.

Last year, we had the same issue, it took several days to get it sorted out (#1840)
I've already asked if I can buy the domain name.

[devloberto]

Oops, I created a kind of duplicate:
VSCodium/vscodium.github.io#96

[madeddy]

Last year, we had the same issue...

So we can expect one or more repetitions in the future. This bodes well.

[mbnoimi]

still occurs!

W: Failed to fetch https://download.vscodium.com/debs/dists/vscodium/InRelease  Could not connect to download.vscodium.com:443 (199.59.243.228). - connect (113: No route to host)

[Macleykun]

bodis.com is a parking service which is used since the domain name is its grace period.

Last year, we had the same issue, it took several days to get it sorted out (#1840) I've already asked if I can buy the domain name.

Just a bit curious, but how could this happen? Is automatic domain renewal not activated maybe?

[PalinuroSec]

we had an issue with out card that refused all the renewals for our infra, including the vscodium domain.

maintaining the domain and the download cdn for this project is a form of donation i'm committed to and a reason to be proud of, but these small incidents have a big impact to the project and i'm very sorry for that.

now the domain got renewed correctly and works again for me, please let me know if the new records are working again for you as well.

p.s.
i would like to remind you that i am not the owner of this project, and the actual owners are free to ask for the domain transfer code whenever they like.

[PalinuroSec]

Just a bit curious, but how could this happen? Is automatic domain renewal not activated maybe?

yes, auto-renewal is on. the reason why the payment was declined is to be investigated, as the balance was there and the renewal went well the previous years.

also we got no email alert from namecheap except for one message that went to spam for failed domain verification

[trisweb]

Thanks @PalinuroSec, it happens.

I'd chip in for 5 years if you want to just put some insurance on it for a while.

[PalinuroSec]

that would be nice.
actually i was thinking of moving the domain off namecheap and migrate it to infomaniak, where it would be possible to create an organization just for vscodium and allow multiple people to manage its assets, so to avoid single points of failure

[Macleykun]

that would be nice. actually i was thinking of moving the domain off namecheap and migrate it to infomaniak, where it would be possible to create an organization just for vscodium and allow multiple people to manage its assets, so to avoid single points of failure

Another one I can recommend is porkbun! It also has the ability to share the access with other users :) !
Source: https://kb.porkbun.com/article/242-subaccounts-vs-authorized-users

[nindogo]

maintaining the domain and the download cdn for this project is a form of donation i'm committed to and a reason to be proud of, but these small incidents have a big impact to the project and i'm very sorry for that.

Hi all,

1. Currently in Kenya — my updates are going through. It may take a few more moments but I am sure in time all people will be able to access the domain.

(But it is unstable

dnf install marble

Updating and loading repositories:
download.vscodium.com 100% | 716.0 B/s | 2.2 KiB | 00m03s
Librepo error: repomd.xml GPG signature verification error: Error during parsing OpenPGP packets

2. VSCode is so good that people using vscodium will be many.
3. Namecheap may be good but maybe there are better solutions — and this is a political/religious/editor war level argument.
4. xkcd was right
   

That said I see @trisweb has committed to fund 5 years of domain registration — could you/@VSCodium consider a project/foundation/parent group to actually collect even lower donations and track them so that this never happens again (while VScode is relevant). Maybe even @microsoft would be open to support it?

[daiyam]

For those interested, I've made a new repo for Linux. Please read #2296. Thx

[madeddy]

... migrate it to infomaniak, where it would be possible... allow multiple people to manage its assets, so to avoid single points of failure

Another one...porkbun! It also has the ability to share the access with other users...

Thats IMO the most logical idea so far to smooth stuff out and security. I see for now only advantages if we don't ask for the price.