Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Having a strange issue with cURL and PHP on a couple of CentOS boxes.

Locally, I'm running CentOS 6.3. Remote is CentOS 5.9

Locally, the box receives a request, scp's a file to the remote server, then performs a cURL request via PHP to the remote server to send some info. The request always fails on the first attempt of the day. Subsequent requests work fine. Remote has a valid SSL cert -- even so, turning off cert and host verification does not fix the problem.

The logging has not been very helpful. Turning verbosity up to 11, the most meaningful entries are as such:

* About to connect() to www.example.com port 443 (#0)
*   Trying 203.0.113.10... * connected
* Connected to www.example.com (203.0.113.10) port 443 (#0)
* Initializing NSS with certpath: sql:/etc/pki/nssdb
*   CAfile: /etc/pki/tls/certs/ca-bundle.crt
  CApath: none
* NSS error -5938
* Closing connection #0
* SSL connect error

Googling the error doesn't help much either. Looks like twitter was having a similar problem (https://dev.twitter.com/discussions/1549) which they apparently fixed, but didn't elaborate on how it got fixed.

Any ideas on where to look/what to do to mitigate the problem would be appreciated.

share|improve this question

2 Answers 2

up vote 1 down vote accepted

it's general problem for curl compiled with NSS (only redhat-linuxes, debian and suse curl packages compiled without nss). you need compile curl from sources without nss-library.

so, i haven't solution how https-connections worked with nss-curl.

curl --version curl 7.29.0 (x86_64-redhat-linux-gnu) libcurl/7.29.0 NSS/3.14.3.0 zlib/1.2.7 libidn/1.26 libssh2/1.4.3 Protocols: dict file ftp ftps gopher http https imap imaps ldap ldaps pop3 pop3s rtsp scp sftp smtp smtps telnet tftp Features: AsynchDNS GSS-Negotiate IDN IPv6 Largefile NTLM NTLM_WB SSL libz

curl --version curl 7.25.0 (x86_64-suse-linux-gnu) libcurl/7.25.0 OpenSSL/1.0.1e zlib/1.2.7 libidn/1.25 libssh2/1.4.0 Protocols: dict file ftp ftps gopher http https imap imaps ldap ldaps pop3 pop3s rtsp scp sftp smtp smtps telnet tftp Features: AsynchDNS GSS-Negotiate IDN IPv6 Largefile NTLM NTLM_WB SSL libz TLS-SRP

share|improve this answer

The NSS error 5938 message usually means the server killed your connection. You should check the server side logs of curl's target to see why your connection was killed.

It might be something as simple as "could not get a reverse dns hostname for X".

share|improve this answer
    
Yeah, there isn't anything in the server httpd logs. I see the POST to it, but that's it. Are there other logs I could/should check? –  stormdrain Sep 11 '13 at 17:34

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.