winget upgrade is not working (Failed in attempting to update the source: winget)

[vishnu-itachi]

Brief description of your issue

Hi, since 1 week or so winget is not working at all. This is what I get

➜winget upgrade
Failed in attempting to update the source: winget
Failed when searching source; results will not be included: winget
No installed package found matching input criteria.

Updating the source I get the following:

➜ winget source update
Updating all sources...
Updating source: msstore...
Done
Updating source: winget...
Cancelled

Now running with verbose logs:

➜ winget source update --verbose-logs --logs

gives me log file which has one error :

2025-01-28 22:47:54.327 [CORE] Adding chain to pinning configuration [Microsoft Store Source]:
DigiCert Global Root G3 : PublicKey
  Microsoft Azure ECC TLS Issuing CA 04 : Subject | Issuer
    sfdataservice.microsoft.com : Subject | Issuer
2025-01-28 22:47:54.327 [CORE] Adding chain to pinning configuration [Microsoft Store Source]:
DigiCert Global Root G3 : PublicKey
  Microsoft Azure ECC TLS Issuing CA 04 : Subject | Issuer
    sfdataservice.microsoft.com : Subject | Issuer
2025-01-28 22:47:54.327 [CORE] Setting action: Get, Type: Standard, Name: sources_metadata
2025-01-28 22:47:54.327 [YAML] Detected UTF-8
2025-01-28 22:47:54.327 [REPO] Named source to be updated, found: winget
2025-01-28 22:47:54.333 [CORE] Did not find extension: PFN = Microsoft.Winget.Source_8wekyb3d8bbwe, ID = IndexDB
2025-01-28 22:47:54.333 [CORE] Retrieving headers from url: https://cdn.winget.microsoft.com/cache/source2.msix
2025-01-28 22:47:55.128 [FAIL] WindowsPackageManager.dll!00007FFE504FB4D5: LogHr(1) tid(5d04) 80072F06 
2025-01-28 22:47:55.128 [FAIL] C:\__w\1\s\external\pkg\src\AppInstallerRepositoryCore\Microsoft\PreIndexedPackageSourceFactory.cpp(125)\WindowsPackageManager.dll!00007FFE507E453F: (caller: 00007FFE5070922E) LogHr(2) tid(5d04) 80072F06     Msg:[PreIndexedPackageUpdateCheck failed on location: https://cdn.winget.microsoft.com/cache/source2.msix -- winrt::hresult_error: The host name in the certificate is invalid or does not match] 

2025-01-28 22:47:55.128 [CORE] Retrieving headers from url: https://cdn.winget.microsoft.com/cache/source.msix
2025-01-28 22:47:55.879 [FAIL] WindowsPackageManager.dll!00007FFE504FB4D5: LogHr(3) tid(5d04) 80072F06 
2025-01-28 22:47:55.879 [FAIL] C:\__w\1\s\external\pkg\src\AppInstallerRepositoryCore\Microsoft\PreIndexedPackageSourceFactory.cpp(125)\WindowsPackageManager.dll!00007FFE507E453F: (caller: 00007FFE5070922E) LogHr(4) tid(5d04) 80072F06     Msg:[PreIndexedPackageUpdateCheck failed on location: https://cdn.winget.microsoft.com/cache/source.msix -- winrt::hresult_error: The host name in the certificate is invalid or does not match] 

2025-01-28 22:47:55.879 [FAIL] C:\__w\1\s\external\pkg\src\AppInstallerRepositoryCore\RepositorySource.cpp(96)\WindowsPackageManager.dll!00007FFE507E2355: (caller: 00007FFE506EF2F3) LogHr(5) tid(5d04) 80072F06     Msg:[winrt::hresult_error: The host name in the certificate is invalid or does not match] 

2025-01-28 22:47:55.879 [REPO] Source add/update failed, waiting 8281 milliseconds and retrying: winget
2025-01-28 22:48:04.164 [CORE] Did not find extension: PFN = Microsoft.Winget.Source_8wekyb3d8bbwe, ID = IndexDB
2025-01-28 22:48:04.164 [CORE] Retrieving headers from url: https://cdn.winget.microsoft.com/cache/source2.msix
2025-01-28 22:48:04.923 [FAIL] WindowsPackageManager.dll!00007FFE504FB4D5: LogHr(6) tid(5d04) 80072F06 
2025-01-28 22:48:04.923 [FAIL] C:\__w\1\s\external\pkg\src\AppInstallerRepositoryCore\Microsoft\PreIndexedPackageSourceFactory.cpp(125)\WindowsPackageManager.dll!00007FFE507E453F: (caller: 00007FFE5070922E) LogHr(7) tid(5d04) 80072F06     Msg:[PreIndexedPackageUpdateCheck failed on location: https://cdn.winget.microsoft.com/cache/source2.msix -- winrt::hresult_error: The host name in the certificate is invalid or does not match] 

2025-01-28 22:48:04.923 [CORE] Retrieving headers from url: https://cdn.winget.microsoft.com/cache/source.msix
2025-01-28 22:48:05.697 [FAIL] WindowsPackageManager.dll!00007FFE504FB4D5: LogHr(8) tid(5d04) 80072F06 
2025-01-28 22:48:05.697 [FAIL] C:\__w\1\s\external\pkg\src\AppInstallerRepositoryCore\Microsoft\PreIndexedPackageSourceFactory.cpp(125)\WindowsPackageManager.dll!00007FFE507E453F: (caller: 00007FFE5070922E) LogHr(9) tid(5d04) 80072F06     Msg:[PreIndexedPackageUpdateCheck failed on location: https://cdn.winget.microsoft.com/cache/source.msix -- winrt::hresult_error: The host name in the certificate is invalid or does not match] 

2025-01-28 22:48:05.697 [FAIL] C:\__w\1\s\external\pkg\src\AppInstallerRepositoryCore\RepositorySource.cpp(956)\WindowsPackageManager.dll!00007FFE507E2ED7: (caller: 00007FFE505BB012) LogHr(10) tid(5d04) 80072F06     Msg:[winrt::hresult_error: The host name in the certificate is invalid or does not match] 

2025-01-28 22:48:05.697 [REPO] Failed to update source: winget
2025-01-28 22:48:05.940 [CLI ] Leaf command succeeded: root:source:update

I tried almost all methods present in other github issues
No specific order

➜ Get-History | grep winget
   1       12.388 winget upgrade --all
   2        7.731 winget source update
   3       11.973 winget source update --verbose-logs --logs
   4        2.975 sudo winget source update --force
   5       10.906 sudo winget source update
   6        0.226 winget source reset --force
   7        2.721 sudo winget source reset --force
   8       16.140 winget upgrade --all
   9        0.219 wget https://cdn.winget.microsoft.com/cache/source.msix
  10        0.264 winget settings --enable BypassCertificatePinningForMicrosoftStore
  11        2.806 sudo winget settings --enable BypassCertificatePinningForMicrosoftStore
  12        8.510 winget upgrade --all
  13        0.252 winget --version
  14        9.711 winget upgrade
  15       10.501 winget source update
  16        1.579 winget source update --verbose-logs --logs
  18        0.103 histry | grep winget

Nothing worked.

Finally accessing the CDN on the browser shows:

Doing wget shows the following:

# WSL
❯❯ ~                                                                                                       22:51:58
 wget https://cdn.winget.microsoft.com/cache/source.msix
--2025-01-28 22:52:19--  https://cdn.winget.microsoft.com/cache/source.msix
Loaded CA certificate '/etc/ssl/certs/ca-certificates.crt'
Resolving cdn.winget.microsoft.com (cdn.winget.microsoft.com)... 152.195.19.97
Connecting to cdn.winget.microsoft.com (cdn.winget.microsoft.com)|152.195.19.97|:443... connected.
The certificate's owner does not match hostname ‘cdn.winget.microsoft.com’

# Windows Powershell
➜ curl https://cdn.winget.microsoft.com/cache/source.msix
curl: (60) schannel: SNI or certificate check failed: SEC_E_WRONG_PRINCIPAL (0x80090322) - The target principal name is incorrect.
More details here: https://curl.se/docs/sslcerts.html

curl failed to verify the legitimacy of the server and therefore could not
establish a secure connection to it. To learn more about this situation and
how to fix it, please visit the webpage mentioned above.

Hope I have given enough info.

Steps to reproduce

Expected behavior

should update or show upgrades

Actual behavior

Environment

➜ winget --version
v1.9.25200

[similar-issues-ai]

We've found some similar issues:

• Failed in attempting to update the source: winget #2666 , similarity score: 85%
• Error 0x8a15003f on "winget upgrade" (The source data is corrupted or tampered) #4224 , similarity score: 82%

If any of the above are duplicates, please consider closing this issue out and adding additional context in the original issue.

Note: You can give me feedback by 👍 or 👎 this comment.

[florelis]

The SSL certificate you are getting when accessing https://cdn.winget.microsoft.com/cache/ is not for the right domain for some reason.

What domain is the cert for? You can check that by clicking on the "Not secure" message in your browser's address bar.
If the cert domain is correct, what is it's certification path/hierarchy?
Do you happen to have a proxy or something else that would be intercepting the connection?

[vishnu-itachi]

Hi. This is the domain

And this is the hierarchy

Also, I am not behind any proxy. It's the normal ISP internet. Nothing has changed recently.

[Trenly]

@vishnu-itachi - does https://cdn.winget.microsoft.com/cache/source2.msix work for you?

[vishnu-itachi]

it's the same :(

[bnystrom]

Having exactly the same issue. Winget worked fine in the past.

[denelon]

Thanks for reporting this. It doesn't seem to affect all CDN end points, we're looking into it.

[hackean-msft]

@vishnu-itachi @bnystrom Can you provide information about the region where this requests are failing for cert reasons.

[vishnu-itachi]

If you mean to ask which region I am hitting the requests, then it's India, Bangalore. Not sure if this is the answer you are expecting

[vishnu-itachi]

Btw I just tried to hit the cdn urls on my mac using same wifi and both URLs are working. So its windows only issue not the internet.

[bnystrom]

@vishnu-itachi - does https://cdn.winget.microsoft.com/cache/source2.msix work for you?

When I try that link I get "the request is blocked"

Windows 10, Central US.

[denelon]

We've isolated this to the CDN service we're using. We've raised an incident report with them.

[vishnu-itachi]

Now I am getting a different error:

>> curl https://cdn.winget.microsoft.com/cache/source.msix                                                                                                                                                               
curl: (28) Failed to connect to cdn.winget.microsoft.com port 443 after 21451 ms: Could not connect to server

Is there a way I can configure a different CDN and make the update?