I noticed one thing, here my VPS was trying to connect via IPv6.
debian@vps-12345:~$ curl -v https://packages.cloud.google.com/apt/doc/apt-key.gpg
* Trying [2607:f8b0:4020:805::200e]:443...
* Connected to packages.cloud.google.com (2607:f8b0:4020:805::200e) port 443 (#0)
* ALPN: offers h2,http/1.1
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* CAfile: /etc/ssl/certs/ca-certificates.crt
* CApath: /etc/ssl/certs
* TLSv1.3 (IN), TLS handshake, Server hello (2):
* TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):
* TLSv1.3 (IN), TLS handshake, Certificate (11):
* TLSv1.3 (IN), TLS handshake, CERT verify (15):
* TLSv1.3 (IN), TLS handshake, Finished (20):
* TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):
* TLSv1.3 (OUT), TLS handshake, Finished (20):
* SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384
* ALPN: server accepted h2
* Server certificate:
* subject: CN=*.googlecode.com
* start date: Sep 28 05:31:36 2023 GMT
* expire date: Dec 21 05:31:35 2023 GMT
* subjectAltName: host "packages.cloud.google.com" matched cert's "*.cloud.google.com"
* issuer: C=US; O=Google Trust Services LLC; CN=GTS CA 1C3
* SSL certificate verify ok.
* using HTTP/2
* h2h3 [:method: GET]
* h2h3 [:path: /apt/doc/apt-key.gpg]
* h2h3 [:scheme: https]
* h2h3 [:authority: packages.cloud.google.com]
* h2h3 [user-agent: curl/7.88.1]
* h2h3 [accept: */*]
* Using Stream ID: 1 (easy handle 0x55f6d814e790)
> GET /apt/doc/apt-key.gpg HTTP/2
> Host: packages.cloud.google.com
> user-agent: curl/7.88.1
> accept: */*
>
* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
* old SSL session ID is stale, removing
< HTTP/2 403
< content-type: text/html; charset=UTF-8
< referrer-policy: no-referrer
< content-length: 1598
< date: Thu, 19 Oct 2023 03:52:59 GMT
< alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
<
<!DOCTYPE html>
<html lang=en>
<meta charset=utf-8>
<meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width">
<title>Error 403 (Forbidden)!!1</title>
<style>
*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px}* > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) 0}}@media only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:150px}
</style>
<a href=//www.google.com/><span id=logo aria-label=Google></span></a>
<p><b>403.</b> <ins>That’s an error.</ins>
<p>Your client does not have permission to get URL <code>/apt/doc/apt-key.gpg</code> from this server. <ins>That’s all we know.</ins>
* Connection #0 to host packages.cloud.google.com left intact
After disabling IPv6 on my Debian VPS I was able to hit the IPv4 page successfully:
debian@vps-123455:~$ curl -v https://packages.cloud.google.com/apt/doc/apt-key.gpg
* Trying 172.217.13.142:443...
* Connected to packages.cloud.google.com (172.217.13.142) port 443 (#0)
* ALPN: offers h2,http/1.1
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* CAfile: /etc/ssl/certs/ca-certificates.crt
* CApath: /etc/ssl/certs
* TLSv1.3 (IN), TLS handshake, Server hello (2):
* TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):
* TLSv1.3 (IN), TLS handshake, Certificate (11):
* TLSv1.3 (IN), TLS handshake, CERT verify (15):
* TLSv1.3 (IN), TLS handshake, Finished (20):
* TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):
* TLSv1.3 (OUT), TLS handshake, Finished (20):
* SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384
* ALPN: server accepted h2
* Server certificate:
* subject: CN=*.googlecode.com
* start date: Sep 28 05:31:36 2023 GMT
* expire date: Dec 21 05:31:35 2023 GMT
* subjectAltName: host "packages.cloud.google.com" matched cert's "*.cloud.google.com"
* issuer: C=US; O=Google Trust Services LLC; CN=GTS CA 1C3
* SSL certificate verify ok.
* using HTTP/2
* h2h3 [:method: GET]
* h2h3 [:path: /apt/doc/apt-key.gpg]
* h2h3 [:scheme: https]
* h2h3 [:authority: packages.cloud.google.com]
* h2h3 [user-agent: curl/7.88.1]
* h2h3 [accept: */*]
* Using Stream ID: 1 (easy handle 0x55da74508790)
> GET /apt/doc/apt-key.gpg HTTP/2
> Host: packages.cloud.google.com
> user-agent: curl/7.88.1
> accept: */*
>
* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
* old SSL session ID is stale, removing
< HTTP/2 200
< accept-ranges: bytes
< content-length: 2659
< content-security-policy: object-src 'none'; script-src 'nonce-hvlTutWqlerJ4gfdgCmXfo7hhJQ=' 'unsafe-inline'; base-uri 'none'; report-uri https://csp.withgoogle.com/csp/rapture/
< content-type: text/plain; charset=utf-8
< last-modified: Thu, 12 Oct 2023 21:32:36 GMT
< x-content-type-options: nosniff
< x-frame-options: SAMEORIGIN
< x-xss-protection: 0
< date: Thu, 19 Oct 2023 03:54:55 GMT
< alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
<
-----BEGIN PGP PUBLIC KEY BLOCK-----
LinkedIn
Twitter
