Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

After extensive searching I haven't found documentation of this problem yet. Suddenly, possibly following a software update(?), cURL fails to establish SSL connections with this error:

curl: (35) error:0200100D:system library:fopen:Permission denied

With strace, I found out that it's trying to open an SSL certificate which is denied:

open("/etc/ssl/certs/3c58f906.0", O_RDONLY|O_LARGEFILE) = -1 EACCES (Permission denied)

This certificate is a symlink which points to AddTrust_External_Root.pem which in turn is a symlink to /usr/share/ca-certificates/mozilla/AddTrust_External_Root.crt. The permissions are such that indeed my user isn't allowed to access it:

ls -l /usr/share/ca-certificates/mozilla/AddTrust_External_Root.crt 
-rw-r----- 1 root ssl-cert 1521 2011-09-01 18:48 /usr/share/ca-certificates/mozilla/AddTrust_External_Root.crt

There's probably a reason why this file isn't world-readable, but it's stopping cURL from functioning. Does anybody know the reason, and, more importantly, a safe and secure solution?

share|improve this question
up vote 2 down vote accepted

There is no reason for this file not to be world readable. It's not anything unique to your system and is included in the default install:

Generally I think anything under /usr/share/ may be world readable (since its under "share").

Now why this file is not world readable on your system is the real question. A bug probably.

share|improve this answer
Thank you Edmunds and @cjc. I'll just chmod a+r the certificate file then. – reinouts Jul 25 '12 at 11:53

Hmm. It's world readable on my Lucid installation:

$ ls -l /usr/share/ca-certificates/mozilla/AddTrust_External_Root.crt
-rw-r--r-- 1 root root 1521 2011-09-01 16:48 /usr/share/ca-certificates/mozilla/AddTrust_External_Root.crt

There appears to be something wrong with your installation, or a previous administrator changed the ownership/permissions for obscure reasons.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.