0

I'm on a CentOS 5.7 server trying to install ssl cert through GitHub script.

First when I execute, I get curl error 60 and if I set insecure in ~/.curlrc then I still get curl error 35.

I also tried updating ca-bundle.crt from http://curl.haxx.se/ca/cacert.pem but that did not solve anything, still same error.

I also looked into see if we have update for openSSL_0.9.8e but there are no updates (I found there is 1.0 in fedora archive but it is affected by heartbleed bug).

Looks like the script won't work without resolving curl https verification.

I can't upgrade or move to Centos 6 or higher because the custom services won't work on higher version and development is currently on hold.

Improve this question
4
  • Can you tell us what version of curl you're using so we can assess what parameters etc. it has.
    – shearn89
    Feb 28, 2018 at 10:34
  • Can you also provide an example of the curl command the script is failing on, e.g. curl https://your.url.here/.
    – shearn89
    Feb 28, 2018 at 10:37
  • Looking at that script it appears there's an --insecure flag that might skip some of the verfication. Have you tried that?
    – shearn89
    Feb 28, 2018 at 10:42
  • using curl version 7.15.5. Yea that I tried --insecure flag for that script and it had same errors. curl github.com curl: (35) error:1407742E:SSL routines:SSL23_GET_SERVER_HELLO:tlsv1 alert protocol version
    – user
    Feb 28, 2018 at 15:50

2 Answers 2

Reset to default
3

No support for TLSv1.1 or TLSv1.2 in CentOS 5

Your peer probably disabled protocol version TLSv1. With the openssl and curl on CentOS/RHEL 5 (which had its End of Life on March 31st 2017) TLSv1.1 or TLSv1.2 will not work, so you have to upgrade openssl and curl. However, this cannot be done in a sane way on CentOS/RHEL 5.

Outdated Operating System

The operating system you're using is outdated since April 2014 when CentOS 5.8 was released. If you really cannot upgrade to CentOS 6 you should cross-upgrade to RHEL 5 with Extended Lifecycle Support. However, this will not fix your problem if it is related to the TLS version.

Improve this answer
0

A smelly workaround would be to use a vm to get letsencrypt cert using a bind mount to /etc/letsencrypt. Then just run the vm everytime you need to renew the cert, that way you will be able to generate the cert.

You could probably use a chroot jail with different os in it, but that might not work.

Keep in mind that the setup below is not really separate from your "normal" OS and you might mess stuff up, by doing this. Use at your own risk, no warranty provided.

mkdir /mnt/chroot
cd /mnt/chroot
rpm --rebuilddb --root=/mnt/chroot
wget https://mirror.centos.org/centos/6/os/x86_64/Packages/centos-release-6-9.el6.12.3.x86_64.rpm
rpm -i --root=/mnt/chroot --nodeps centos-release-6-9.el6.12.3.x86_64.rpm
yum --installroot=/mnt/chroot install -y rpm-build yum
chroot /mnt/chroot /bin/bash -l
yum install curl
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .