This is fallout from my https only on dl change. ;)

It's trying to use https://dl.rdu3.fedoraproject.org... which doesn't have a valid cert.

I have removed the rdu3 networks from dl.rdu3 and put them on dl.fedoraproject.org... I hope that might fix it.

No, no, sorry, I may have confused you. There are two separate problems.

The dl.rdu3 HTTPS thing is the first problem; that caused the openQA test I was inspecting to fail to download a package from the dl.rdu3 internal mirror (as it should). That having happened, it tried to download the package from the next mirror in the list instead, which in this case happened to be fedora.ipacct.com , and then I saw this problem - the download worked, but the package failed to install because it has the wrong signature.

The two problems aren't themselves directly related, it's just that we happened to encounter this one because the first one happened. I don't think the rdu3 thing is causing this at all, I think it's probably a mirror misconfiguration.

The rdu3 thing was a mirrormanager misconfiguration on my part.

The dl.rdu3.fedoraproject.org site in mirrormanager had that it should be the preferred mirror for 10.16.160.0/19 (all the internal rdu3 nets). When it had a working http this was fine, but once I made it redirect to https that broke. The fix was to remove that network from dl.rdu3.fedoraproject.org and put it under dl.fedoraproject.org instead. I've done that and it should be handing out https://dl.fedoraproject.org which should have a valid cert.

I have mailed the site maintainer of that site and disabled it in mirrormanager for now.