Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Since upgrading to Ubuntu 12.04 I've started receiving errors on SSL based curl requests to Apple's verification servers. This happens on all of my 12.04 servers.

Using this command curl -Iv https://buy.itunes.apple.com/verifyReceipt or PHP's curl library I receive this error SSL read: error:00000000:lib(0):func(0):reason(0), errno 104

Here are some details about the boxes that now fail

curl/7.22.0 libcurl/7.22.0 OpenSSL/1.0.1 zlib/1.2.3.4 libidn/1.23 librtmp/2.3

The command continues to work on servers with 10.04.4 LTS

curl/7.19.7 libcurl/7.19.7 OpenSSL/0.9.8k zlib/1.2.3.3 libidn/1.15

Any help would be appreciated.

EDIT: OPENSSL output

CONNECTED(00000003)
depth=2 C = US, O = "VeriSign, Inc.", OU = VeriSign Trust Network, OU = "(c) 2006 VeriSign, Inc. - For authorized use only", CN = VeriSign Class 3 Public Primary Certification Authority - G5
verify error:num=20:unable to get local issuer certificate
verify return:0
---
Certificate chain
 0 s:/1.3.6.1.4.1.311.60.2.1.3=US/1.3.6.1.4.1.311.60.2.1.2=California/businessCategory=Private Organization/serialNumber=C0806592/C=US/postalCode=95014/ST=California/L=Cupertino/street=1 Infinite Loop/O=Apple Inc./OU=iTMS Engineering/CN=buy.itunes.apple.com
   i:/C=US/O=VeriSign, Inc./OU=VeriSign Trust Network/OU=Terms of use at https://www.verisign.com/rpa (c)06/CN=VeriSign Class 3 Extended Validation SSL SGC CA
 1 s:/C=US/O=VeriSign, Inc./OU=VeriSign Trust Network/OU=Terms of use at https://www.verisign.com/rpa (c)06/CN=VeriSign Class 3 Extended Validation SSL SGC CA
   i:/C=US/O=VeriSign, Inc./OU=VeriSign Trust Network/OU=(c) 2006 VeriSign, Inc. - For authorized use only/CN=VeriSign Class 3 Public Primary Certification Authority - G5
 2 s:/C=US/O=VeriSign, Inc./OU=VeriSign Trust Network/OU=(c) 2006 VeriSign, Inc. - For authorized use only/CN=VeriSign Class 3 Public Primary Certification Authority - G5
   i:/C=US/O=VeriSign, Inc./OU=Class 3 Public Primary Certification Authority
---
Server certificate
-----BEGIN CERTIFICATE-----
*snip
-----END CERTIFICATE-----
subject=/1.3.6.1.4.1.311.60.2.1.3=US/1.3.6.1.4.1.311.60.2.1.2=California/businessCategory=Private Organization/serialNumber=C0806592/C=US/postalCode=95014/ST=California/L=Cupertino/street=1 Infinite Loop/O=Apple Inc./OU=iTMS Engineering/CN=buy.itunes.apple.com
issuer=/C=US/O=VeriSign, Inc./OU=VeriSign Trust Network/OU=Terms of use at https://www.verisign.com/rpa (c)06/CN=VeriSign Class 3 Extended Validation SSL SGC CA
---
No client certificate CA names sent
---
SSL handshake has read 6686 bytes and written 536 bytes
---
New, TLSv1/SSLv3, Cipher is RC4-MD5
Server public key is 2048 bit
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
SSL-Session:
    Protocol  : TLSv1
    Cipher    : RC4-MD5
    Session-ID: 2B2D7AA20CA51CD6A0F962E7AC3F96C8B17C4CE9CEA2C386916772949693A93A
    Session-ID-ctx:
    Master-Key: A854A46411B4C710FCD822143E5EE305F2D6C4896BD4E008AD01DC31DCCAE76D9C1679184F11905C68F792A40CB56801
    Key-Arg   : None
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    Start Time: 1345955495
    Timeout   : 300 (sec)
    Verify return code: 20 (unable to get local issuer certificate)
---
share|improve this question
    
What happens when you try to connect directly with OpenSSL on the broken systems? openssl s_client -connect buy.itunes.apple.com:443 –  Shane Madden Aug 25 '12 at 21:57
    
Not enough room for the output in the comments so I added it edited above. –  AWinter Aug 26 '12 at 4:34
    
FWIW: I can't pretend to understand the issue, but it's interesting to note that I arrived at this question through google after the same error code, doing the same thing: Validating iTunes receipts. I use curl 7.35 though, so simply an upgrade of curl hasn't been enough. –  user50849 Oct 13 at 8:39

1 Answer 1

up vote 1 down vote accepted

Problem has been solved in the latest Ubuntu 12.04 updates.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.