When using cURL as root, everything works fine:
$ sudo curl -vvv https://test.example.org/ > /dev/null
* Connected to test.example.org (1.2.3.4) port 443 (#0)
* Initializing NSS with certpath: sql:/etc/pki/nssdb
* CAfile: /etc/pki/tls/certs/ca-bundle.crt
CApath: none
* SSL connection using TLS_DHE_RSA_WITH_AES_128_GCM_SHA256
* Server certificate:
* subject: CN=test.example.org,O=organization,L=location,ST=state,C=country
* start date: Okt 26 06:58:41 2015 GMT
* expire date: Okt 24 06:58:41 2020 GMT
* common name: test.example.org
* issuer: [email protected],CN=example.org,O=organization,L=location,ST=state,C=country
As a normal user, it doesn't:
$ curl -vvv https://test.example.org/ > /dev/null
* Connected to test.example.org (1.2.3.4) port 443 (#0)
* Initializing NSS with certpath: sql:/etc/pki/nssdb
* CAfile: /etc/pki/tls/certs/ca-bundle.crt
CApath: none
* Server certificate:
* subject: CN=test.example.org,O=organization,L=location,ST=state,C=country
* start date: Okt 26 06:58:41 2015 GMT
* expire date: Okt 24 06:58:41 2020 GMT
* common name: test.example.org
* issuer: [email protected],CN=example.org,O=organization,L=location,ST=state,C=country
* NSS error -8172 (SEC_ERROR_UNTRUSTED_ISSUER)
* Peer's certificate issuer has been marked as not trusted by the user.
* Closing connection 0
curl: (60) Peer's certificate issuer has been marked as not trusted by the user.
More details here: http://curl.haxx.se/docs/sslcerts.html
Also wget works as expected and openssl connects without error:
$ openssl s_client -connect test.example.org:443 -servername test.example.org -showcerts < /dev/null
...
Verify return code: 0 (ok)
I'm working with Fedora 22, the CA certificate was imported by copying it to /etc/pki/ca-trust/source/anchors/ and running update-ca-trust (both as root) afterwards.
After importing the CA file into Firefox and Chrome, the website is loaded without errors as well.
The server is running apache 2.4, with the following options in the vhost file:
SSLEngine on
SSLProtocol All -SSLv2 -SSLv3
SSLCertificateFile /etc/pki/certs/test.exmple.org.crt
SSLCertificateKeyFile /etc/pki/private/test.exmple.org.key
SSLCACertificateFile /etc/pki/certs/exmple.org.crt
Not sure if this is a server configuration issue or a curl issue. So I'm sorry, if this question would fit better in a different community.
Any ideas?
--carcert /path/to/your/cafile
? Does it work with cURL ?