1

When using cURL as root, everything works fine:

$ sudo curl -vvv  https://test.example.org/ > /dev/null
* Connected to test.example.org (1.2.3.4) port 443 (#0)
* Initializing NSS with certpath: sql:/etc/pki/nssdb
*   CAfile: /etc/pki/tls/certs/ca-bundle.crt
  CApath: none
* SSL connection using TLS_DHE_RSA_WITH_AES_128_GCM_SHA256
* Server certificate:
*   subject: CN=test.example.org,O=organization,L=location,ST=state,C=country
*   start date: Okt 26 06:58:41 2015 GMT
*   expire date: Okt 24 06:58:41 2020 GMT
*   common name: test.example.org
*   issuer: [email protected],CN=example.org,O=organization,L=location,ST=state,C=country

As a normal user, it doesn't:

$ curl -vvv  https://test.example.org/ > /dev/null
* Connected to test.example.org (1.2.3.4) port 443 (#0)
* Initializing NSS with certpath: sql:/etc/pki/nssdb
*   CAfile: /etc/pki/tls/certs/ca-bundle.crt
  CApath: none
* Server certificate:
*   subject: CN=test.example.org,O=organization,L=location,ST=state,C=country
*   start date: Okt 26 06:58:41 2015 GMT
*   expire date: Okt 24 06:58:41 2020 GMT
*   common name: test.example.org
*   issuer: [email protected],CN=example.org,O=organization,L=location,ST=state,C=country
* NSS error -8172 (SEC_ERROR_UNTRUSTED_ISSUER)
* Peer's certificate issuer has been marked as not trusted by the user.
* Closing connection 0
curl: (60) Peer's certificate issuer has been marked as not trusted by the user.
More details here: http://curl.haxx.se/docs/sslcerts.html

Also wget works as expected and openssl connects without error:

$ openssl s_client -connect test.example.org:443 -servername test.example.org  -showcerts < /dev/null
...
    Verify return code: 0 (ok)

I'm working with Fedora 22, the CA certificate was imported by copying it to /etc/pki/ca-trust/source/anchors/ and running update-ca-trust (both as root) afterwards.

After importing the CA file into Firefox and Chrome, the website is loaded without errors as well.

The server is running apache 2.4, with the following options in the vhost file:

    SSLEngine on
    SSLProtocol All -SSLv2 -SSLv3
    SSLCertificateFile /etc/pki/certs/test.exmple.org.crt
    SSLCertificateKeyFile /etc/pki/private/test.exmple.org.key
    SSLCACertificateFile /etc/pki/certs/exmple.org.crt

Not sure if this is a server configuration issue or a curl issue. So I'm sorry, if this question would fit better in a different community.

Any ideas?

2
  • what if you give the CA explicitly with --carcert /path/to/your/cafile? Does it work with cURL ? Oct 27, 2015 at 10:38
  • Same result: "Peer's certificate issuer has been marked as not trusted by the user"
    – Jens
    Oct 27, 2015 at 11:34

0

You must log in to answer this question.

Browse other questions tagged .