-1

Is there any way to byepass the ssl checking for one domain from my server?

The problem is when calling the url in the application. I need to call a url say https://blog.domain.com:8444/application/current or https://xx.xx.xx.xx:8444/application/current

Is there a way where I can bye-pass the ssl check for this particular domain from my application server? I have followed a tutorial

http://turboflash.wordpress.com/2009/06/23/curl-adding-installing-trusting-new-self-signed-certificate/ However curl command still says 'SSL certificate problem'

What I Need is that my server will trust the two uls permanently and will show up them without checking the ssl validity.

2

1 Answer 1

3

I gather you are using CURL for something. If you are using it from the command line, you basically have two choices:

  • Specify the -k option (--insecure) to allow CURL to proceed in the event of an SSL verification failure. This opens you to MitM attacks, but literally does not check the certificate's validity.
  • Add the self-signed certificates to your trust root

If you only access SSL sites with self-signed certificates like this using your CURL command you can create a PEM file containing all the self-signed certificates. Then, you can use the --cacert option to specify that file, and your validation should succeed only for those self-signed certificates (and importantly, not for "real" ones).

You could also add the self-signed certificates to the CA file CURL is currently using, which is typically curl-ca-bundle.crt located someplace dependent on your installation.

If you are not using it from the command line there should be parameters you can pass which are equivalent to this.

3
  • on using curl -k, the page is loading. But I need this https url to be trusted server wide. It should load this https url from browser or application or from command mode without validating ssl. Sep 20, 2013 at 6:22
  • Great. I gave you a solution to that already - trust the self-signed SSL certificates, which act as their own CA certificates. If you want to do that for a browser too you might have to add them to multiple trust roots, depending on your platform and software (I'll leave this as an exercise to you). If you have a lot of them, establish enterprise PKI instead. Sep 20, 2013 at 6:26
  • Falcon, I fixed it by adding the intermediate CA certificate to my servers /usr/share/ca-certificates directory and added the certificate name to /etc/ca-certificates.conf and then updated it with 'update-ca-certificates --fresh'. Once this is done the https url is accessible from server via browser or application or from command mode. Thanks Sep 20, 2013 at 9:06

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .