OpenWrtで証明書エラーが発生してopkg updateが叩けないぜ！

# コトの始まり
なぜかは分かりませんが、証明書エラーで`opkg update`を叩いても
```shell-session
root@OpenWrt:~# opkg update
Downloading https://downloads.openwrt.org/releases/24.10.1/targets/x86/64/packages/Packages.gz
SSL verify error: certificate is self-signed or not signed by a trusted CA
*** Failed to download the package list from https://downloads.openwrt.org/releases/24.10.1/targets/x86/64/pac
kages/Packages.gz

Downloading https://downloads.openwrt.org/releases/24.10.1/packages/x86_64/base/Packages.gz
SSL verify error: certificate is self-signed or not signed by a trusted CA
*** Failed to download the package list from https://downloads.openwrt.org/releases/24.10.1/packages/x86_64/ba
se/Packages.gz

Downloading https://downloads.openwrt.org/releases/24.10.1/targets/x86/64/kmods/6.6.86-1-af351158cfb5febf5155a
3aa53785982/Packages.gz
SSL verify error: certificate is self-signed or not signed by a trusted CA
SSL verify error: certificate is self-signed or not signed by a trusted CA
*** Failed to download the package list from https://downloads.openwrt.org/releases/24.10.1/targets/x86/64/kmo
ds/6.6.86-1-af351158cfb5febf5155a3aa53785982/Packages.gz

Downloading https://downloads.openwrt.org/releases/24.10.1/packages/x86_64/luci/Packages.gz
SSL verify error: certificate is self-signed or not signed by a trusted CA
*** Failed to download the package list from https://downloads.openwrt.org/releases/24.10.1/packages/x86_64/lu
ci/Packages.gz

Downloading https://downloads.openwrt.org/releases/24.10.1/packages/x86_64/packages/Packages.gz
SSL verify error: certificate is self-signed or not signed by a trusted CA
SSL verify error: certificate is self-signed or not signed by a trusted CA
*** Failed to download the package list from https://downloads.openwrt.org/releases/24.10.1/packages/x86_64/pa
ckages/Packages.gz

Downloading https://downloads.openwrt.org/releases/24.10.1/packages/x86_64/routing/Packages.gz
SSL verify error: certificate is self-signed or not signed by a trusted CA
SSL verify error: certificate is self-signed or not signed by a trusted CA
*** Failed to download the package list from https://downloads.openwrt.org/releases/24.10.1/packages/x86_64/ro
uting/Packages.gz

Downloading https://downloads.openwrt.org/releases/24.10.1/packages/x86_64/telephony/Packages.gz
SSL verify error: certificate is self-signed or not signed by a trusted CA
SSL verify error: certificate is self-signed or not signed by a trusted CA
*** Failed to download the package list from https://downloads.openwrt.org/releases/24.10.1/packages/x86_64/te
lephony/Packages.gz

Collected errors:
 * opkg_download: Failed to download https://downloads.openwrt.org/releases/24.10.1/targets/x86/64/packages/Pa
ckages.gz, wget returned 5.
 * opkg_download: Failed to download https://downloads.openwrt.org/releases/24.10.1/packages/x86_64/base/Packa
ges.gz, wget returned 5.
 * opkg_download: Failed to download https://downloads.openwrt.org/releases/24.10.1/targets/x86/64/kmods/6.6.8
6-1-af351158cfb5febf5155a3aa53785982/Packages.gz, wget returned 5.
 * opkg_download: Failed to download https://downloads.openwrt.org/releases/24.10.1/packages/x86_64/luci/Packa
ges.gz, wget returned 5.
 * opkg_download: Failed to download https://downloads.openwrt.org/releases/24.10.1/packages/x86_64/packages/P
ackages.gz, wget returned 5.
 * opkg_download: Failed to download https://downloads.openwrt.org/releases/24.10.1/packages/x86_64/routing/Pa
ckages.gz, wget returned 5.
 * opkg_download: Failed to download https://downloads.openwrt.org/releases/24.10.1/packages/x86_64/telephony/
Packages.gz, wget returned 5.
```
…と、信頼されたCAじゃないかオレオレ証明書だぜ！と警告してきます。
しかし、普通にブラウザでアクセスしてもLet's Encryptの証明書でちゃんと返ってきます。
クライアントはCloudflare WARPとZeroTrust、TLSインスペクションでオレオレ証明書を信頼している状態ですが、OpenWrt等ルーターやNW機器は普通に素通りしている状態です。

ふと思い出したのは2021年頃に発生したLet's EncryptのCA入れ替えイベントで、古いCAが残っていると影響を受けることがある記事を見た記憶がありました。
# 対処
ひとまず証明書エラーをガン無視して実行してみましょう。
コマンドは→`opkg update --no-check-certificate`
```shell-session
root@OpenWrt:~# opkg update --no-check-certificate
Downloading https://downloads.openwrt.org/releases/24.10.1/targets/x86/64/packages/Packages.gz
Updated list of available packages in /var/opkg-lists/openwrt_core
Downloading https://downloads.openwrt.org/releases/24.10.1/targets/x86/64/packages/Packages.sig
Signature check passed.
Downloading https://downloads.openwrt.org/releases/24.10.1/packages/x86_64/base/Packages.gz
Updated list of available packages in /var/opkg-lists/openwrt_base
Downloading https://downloads.openwrt.org/releases/24.10.1/packages/x86_64/base/Packages.sig
Signature check passed.
Downloading https://downloads.openwrt.org/releases/24.10.1/targets/x86/64/kmods/6.6.86-1-af351158cfb5febf5155a
3aa53785982/Packages.gz
Updated list of available packages in /var/opkg-lists/openwrt_kmods
Downloading https://downloads.openwrt.org/releases/24.10.1/targets/x86/64/kmods/6.6.86-1-af351158cfb5febf5155a
3aa53785982/Packages.sig
Signature check passed.
Downloading https://downloads.openwrt.org/releases/24.10.1/packages/x86_64/luci/Packages.gz
Updated list of available packages in /var/opkg-lists/openwrt_luci
Downloading https://downloads.openwrt.org/releases/24.10.1/packages/x86_64/luci/Packages.sig
Signature check passed.
Downloading https://downloads.openwrt.org/releases/24.10.1/packages/x86_64/packages/Packages.gz
Updated list of available packages in /var/opkg-lists/openwrt_packages
Downloading https://downloads.openwrt.org/releases/24.10.1/packages/x86_64/packages/Packages.sig
Signature check passed.
Downloading https://downloads.openwrt.org/releases/24.10.1/packages/x86_64/routing/Packages.gz
Updated list of available packages in /var/opkg-lists/openwrt_routing
Downloading https://downloads.openwrt.org/releases/24.10.1/packages/x86_64/routing/Packages.sig
Signature check passed.
Downloading https://downloads.openwrt.org/releases/24.10.1/packages/x86_64/telephony/Packages.gz
Updated list of available packages in /var/opkg-lists/openwrt_telephony
Downloading https://downloads.openwrt.org/releases/24.10.1/packages/x86_64/telephony/Packages.sig
Signature check passed.
```

ひとまずupdateは叩けました。
おそらく原因であろうCAをCA無視で更新します。
コマンドは→`opkg install ca-certificates --no-check-certificate`

```shell-session
root@OpenWrt:~# opkg install ca-certificates --no-check-certificate
Installing ca-certificates (20241223-r1) to root...
Downloading https://downloads.openwrt.org/releases/24.10.1/packages/x86_64/base/ca-certificates_20241223-r1_al
l.ipk
Configuring ca-certificates.
```

その後、再起動をせずとも証明書エラーは解消しました。
やはり古い証明書が影響を及ぼしていたようです。