Ceci :
$ curl -vk https://deb.debian.org/
* Trying 199.232.170.132:443...
* Connected to deb.debian.org (199.232.170.132) port 443 (#0)
* ALPN: offers h2,http/1.1
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* TLSv1.3 (IN), TLS handshake, Server hello (2):
* TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):
* TLSv1.3 (IN), TLS handshake, Certificate (11):
* TLSv1.3 (IN), TLS handshake, CERT verify (15):
* TLSv1.3 (IN), TLS handshake, Finished (20):
* TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):
* TLSv1.3 (OUT), TLS handshake, Finished (20):
* SSL connection using TLSv1.3 / TLS_AES_128_GCM_SHA256
* ALPN: server accepted h2
* Server certificate:
* subject: CN=cdn-fastly.deb.debian.org
* start date: Sep 28 00:06:02 2023 GMT
* expire date: Dec 27 00:06:01 2023 GMT
* issuer: C=US; O=Let's Encrypt; CN=R3
* SSL certificate verify result: unable to get local issuer certificate (20), continuing anyway.
* using HTTP/2
* h2h3 [:method: GET]
* h2h3 [:path: /]
* h2h3 [:scheme: https]
* h2h3 [:authority: deb.debian.org]
* h2h3 [user-agent: curl/7.88.1]
* h2h3 [accept: */*]
* Using Stream ID: 1 (easy handle 0x55813eef5c80)
> GET / HTTP/2
> Host: deb.debian.org
> user-agent: curl/7.88.1
> accept: */*
>
* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
< HTTP/2 200
< server: Apache
< x-content-type-options: nosniff
< x-frame-options: sameorigin
< referrer-policy: no-referrer
< x-xss-protection: 1
< permissions-policy: interest-cohort=()
< last-modified: Fri, 01 Sep 2023 16:12:16 GMT
< etag: "754-6044e6c99e42d"
< x-clacks-overhead: GNU Terry Pratchett
< content-type: text/html
< accept-ranges: bytes
< date: Tue, 07 Nov 2023 15:03:45 GMT
< via: 1.1 varnish
< age: 50
< x-served-by: cache-par-lfpg1960030-PAR
< x-cache: HIT
< x-cache-hits: 3
< x-timer: S1699369425.124968,VS0,VE0
< vary: Accept-Encoding
< content-length: 1876
<
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">
<HTML>
<HEAD>
<TITLE>Debian mirrors backed by Fastly CDN</TITLE>
</HEAD>
<BODY>
<H1>Debian mirrors backed by Fastly CDN</H1>
<p>
This is <code>deb.debian.org</code>.
This service provides mirrors for the following Debian archive repositories:
<ul>
<li><code>/debian/</code></li>
<li><code>/debian-debug/</code></li>
<li><code>/debian-ports/</code></li>
<li><code>/debian-security/</code></li>
<li><code>/debian-security-debug/</code></li>
</ul>
<p>
The server <code>deb.debian.org</code> does not have packages itself, but the
name has SRV records in DNS that lets apt <em>in stretch and later</em> find places.
<p>
To use it with a sufficiently recent apt, you for instance can put
<pre>
deb http://deb.debian.org/debian unstable main
deb http://deb.debian.org/debian-debug unstable-debug main
deb http://deb.debian.org/debian-ports unstable main
</pre>
in your <code>sources.list</code>.
<p>
As of July 2022 the SRV record is
<pre>
_http._tcp.deb.debian.org. IN SRV 10 1 80 prod.debian.map.fastly.net.
</pre>
If you hit the server behind <code>deb.debian.org</code> directly, either because you
use an older apt or because you use a HTTP proxy that does not support SRV records,
your requests will get HTTP redirected to one of the CDN instances.
If you want to avoid the redirects, you can pick one instance directly. For instance,
this also works in your <code>sources.list</code>:
<pre>
deb http://cdn-fastly.deb.debian.org/debian stable main
deb http://cdn-fastly.deb.debian.org/debian-security stable-security main
deb http://cdn-fastly.deb.debian.org/debian-security-debug stable-security-debug main
</pre>
This service is sponsored by <a href="https://www.fastly.com/">Fastly</a>.
<P>
<HR NOSHADE />
<FONT size="-1"><a href="mailto:dsa@debian.org">DSA</a></FONT>
</BODY>
</HTML>
* Connection #0 to host deb.debian.org left intact