Public bug reported:
Since LastPass rotated the TLS certificate for lastpass.com on
2026-10-12, `lpass login` fails with:
Error: SSL peer certificate or SSH remote key was not OK.
(libcurl error 60, CURLE_PEER_FAILED_VERIFICATION). TLS fails before
authentication, with any username/password.
ENVIRONMENT
- Ubuntu 26.04 (resolute)
- lastpass-cli 1.6.1-4
- libcurl4t64 8.18.0-1ubuntu2.8
- openssl 3.5.5-1ubuntu3.7
WORKS VS FAILS
- curl https://lastpass.com/ -> works (same libcurl, same CA bundle)
- openssl s_client -CAfile /etc/ssl/certs/ca-certificates.crt
-verify_return_error -> "Verify return code: 0 (ok)"
- openssl verify (with -partial_chain and/or -purpose sslserver) -> OK, CLI
cannot reproduce
- lpass login -> fails TLS handshake
The new served chain is:
0 CN=lastpass.com (LASTPASS US LP) <- GlobalSign GCC E46 OV TLS CA
2025
1 CN=GlobalSign GCC E46 OV TLS CA 2025 <- GlobalSign Root E46
2 CN=GlobalSign Root E46 <- GlobalSign Root CA - R3
(cross-signed root, NEW)
ROOT CAUSE EVIDENCE
Hooking X509_verify_cert() via LD_PRELOAD in both processes:
process X509_VERIFY_PARAM flags result
lpass login 0x88000 (TRUSTED_FIRST|PARTIAL_CHAIN) FAIL err=1
(X509_V_ERR_UNSPECIFIED) at depth 2
curl 0x88000 (same flags) ok
openssl s_cli 0x8000 (TRUSTED_FIRST only) ok
Failure is at depth 2, the cross-signed Root E46. All trust stores contain both
the
self-signed "GlobalSign Root E46" and "GlobalSign Root CA - R3".
Clearing X509_V_FLAG_TRUSTED_FIRST inside lpass's process makes verification
pass 3/3
and lpass proceeds to normal authentication. Clearing PARTIAL_CHAIN alone does
not help.
The puzzle for triage: curl carries the same flag combination and succeeds, so
some
additional property of lpass's SSL/X509 setup interacts badly with OpenSSL
3.5.5 chain
building on this chain shape. The trigger is clearly the newly served
cross-signed root;
the previous chain worked.
WORKAROUND
Prepend the exact cross-signed "GlobalSign Root E46" certificate (third cert
from
`openssl s_client -showcerts`) to a copy of the system bundle, then:
export CURL_CA_BUNDLE=$HOME/lpass-ca-fix.pem
lpass login [email protected]
Anchoring the exact server-sent cross-certificate sidesteps the failing path.
Full report incl. the LD_PRELOAD shim source and reproduction notes is attached
(lpass-ssl-bug-report.md).
ProblemType: Bug
DistroRelease: Ubuntu 26.04
Package: lastpass-cli 1.6.1-4
ProcVersionSignature: Ubuntu 7.0.0-38.38-generic 7.0.14
Uname: Linux 7.0.0-38-generic x86_64
ApportVersion: 2.34.1-0ubuntu0.1
Architecture: amd64
CasperMD5CheckResult: unknown
CurrentDesktop: ubuntu:GNOME
Date: Mon Oct 26 08:56:03 2026
InstallationDate: Installed on 2026-03-30 (210 days ago)
InstallationMedia: Ubuntu 24.04.4 LTS "Noble Numbat" - Release amd64 (20260210)
ProcEnviron:
LANG=en_US.UTF-8
PATH=(custom, no user)
SHELL=/bin/bash
TERM=xterm-ghostty
XDG_RUNTIME_DIR=<set>
SourcePackage: lastpass-cli
UpgradeStatus: Upgraded to resolute on 2026-09-30 (26 days ago)
modified.conffile..etc.cron.daily.apport: [deleted]
** Affects: lastpass-cli (Ubuntu)
Importance: Undecided
Status: New
** Tags: amd64 apport-bug resolute wayland-session
** Attachment added: "lpass-ssl-bug-report.md"
https://bugs.launchpad.net/bugs/2172235/+attachment/6012861/+files/lpass-ssl-bug-report.md
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2172235
Title:
lpass login fails TLS certificate verification since lastpass.com
certificate rotation (2026-10-12)
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/lastpass-cli/+bug/2172235/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
