Using curl on a clean vanilla Fedora 21 to retrieve a site hosted via the cloudflare https service gives an error:

curl https://www.opencpu.org
>> curl: (35) Cannot communicate securely with peer: no common encryption algorithm(s).


curl https://www.cloudflare.org
>> curl: (51) Unable to communicate securely with peer: requested domain name does not match the server's certificate.

This problem only appears on Fedora, not on Ubuntu or Mac running the same version of curl. I suppose it must be related to nns then:

curl --version
>> curl 7.37.0 (x86_64-redhat-linux-gnu) libcurl/7.37.0 NSS/3.17.3 Basic ECC zlib/1.2.8 libidn/1.28 libssh2/1.4.3

certutil -L
>> certutil: function failed: SEC_ERROR_LEGACY_DATABASE: The certificate/key database is in an old, unsupported format.

Any guess to what I am doing wrong?

  • What does wget say?
    – poige
    Jan 25, 2015 at 5:55

3 Answers 3


Fedora bug is at https://bugzilla.redhat.com/show_bug.cgi?id=1185708

Cause is curl using NSS, and not wanting to diverge from other NSS using programs.

Currently not fixed as of Jul 2015 in Fedora 22


The common factor with both of these sites is that they use ECC SSL certificates to secure their https connections, rather than the traditional RSA certificates used by most sites. These are currently very rare, but they are expected to increase in popularity in the future.

Both the versions of curl and NSS in use were built with ECC and therefore ought to support these certificates, so I think you've run into a bug in Fedora and should report it. A related bug was recently fixed in RHEL 7.

As a workaround, you can use wget instead of curl, which has no problem connecting to these sites (though the latter returns a 409 Conflict error).


Please try

bash yum update nss

  • 1
    This answer isn't very useful without explaining the reasoning behind the commands. I'd recommend that you edit it to improve it. Aug 30, 2016 at 11:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.