1

When using cURL as root, everything works fine:

$ sudo curl -vvv  https://test.example.org/ > /dev/null
* Connected to test.example.org (1.2.3.4) port 443 (#0)
* Initializing NSS with certpath: sql:/etc/pki/nssdb
*   CAfile: /etc/pki/tls/certs/ca-bundle.crt
  CApath: none
* SSL connection using TLS_DHE_RSA_WITH_AES_128_GCM_SHA256
* Server certificate:
*   subject: CN=test.example.org,O=organization,L=location,ST=state,C=country
*   start date: Okt 26 06:58:41 2015 GMT
*   expire date: Okt 24 06:58:41 2020 GMT
*   common name: test.example.org
*   issuer: E=email@example.org,CN=example.org,O=organization,L=location,ST=state,C=country

As a normal user, it doesn't:

$ curl -vvv  https://test.example.org/ > /dev/null
* Connected to test.example.org (1.2.3.4) port 443 (#0)
* Initializing NSS with certpath: sql:/etc/pki/nssdb
*   CAfile: /etc/pki/tls/certs/ca-bundle.crt
  CApath: none
* Server certificate:
*   subject: CN=test.example.org,O=organization,L=location,ST=state,C=country
*   start date: Okt 26 06:58:41 2015 GMT
*   expire date: Okt 24 06:58:41 2020 GMT
*   common name: test.example.org
*   issuer: E=email@example.org,CN=example.org,O=organization,L=location,ST=state,C=country
* NSS error -8172 (SEC_ERROR_UNTRUSTED_ISSUER)
* Peer's certificate issuer has been marked as not trusted by the user.
* Closing connection 0
curl: (60) Peer's certificate issuer has been marked as not trusted by the user.
More details here: http://curl.haxx.se/docs/sslcerts.html

Also wget works as expected and openssl connects without error:

$ openssl s_client -connect test.example.org:443 -servername test.example.org  -showcerts < /dev/null
...
    Verify return code: 0 (ok)

I'm working with Fedora 22, the CA certificate was imported by copying it to /etc/pki/ca-trust/source/anchors/ and running update-ca-trust (both as root) afterwards.

After importing the CA file into Firefox and Chrome, the website is loaded without errors as well.

The server is running apache 2.4, with the following options in the vhost file:

    SSLEngine on
    SSLProtocol All -SSLv2 -SSLv3
    SSLCertificateFile /etc/pki/certs/test.exmple.org.crt
    SSLCertificateKeyFile /etc/pki/private/test.exmple.org.key
    SSLCACertificateFile /etc/pki/certs/exmple.org.crt

Not sure if this is a server configuration issue or a curl issue. So I'm sorry, if this question would fit better in a different community.

Any ideas?

  • what if you give the CA explicitly with --carcert /path/to/your/cafile? Does it work with cURL ? – Pierre-Alain TORET Oct 27 '15 at 10:38
  • Same result: "Peer's certificate issuer has been marked as not trusted by the user" – Jens Oct 27 '15 at 11:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.