On January 3, the HTTPS certificate for the the SecureDrop package repository, apt.freedom.press, expired. It has since been renewed.

The temporary expiry was the result of an oversight on our part. It did not cause any delays of pending software updates for your SecureDrop servers, and no administrative action is required.

If you are a SecureDrop administrator, you may have received OSSEC alerts with the subject line “CRON-APT completed on mon” and a message that server certificate verification failed. This was due to the temporarily expired certificate, and you can safely ignore these past alerts.

If you attempted to install SecureDrop during this past weekend, you may have encountered similar errors, which should now be resolved.

We apologize for the oversight, and will undertake additional steps to improve automated monitoring and renewal to reduce the likelihood of future errors of this kind.