We have a public facing development server that requires SSL for a particular function.
Yet EVERYTHING that uses SSL in any form returns
curl: (60) Peer's certificate issuer has been marked as not trusted by the user.
This is not an issue of "Well just use ssl-verify=false on yum, or --insecure on curl requests.
I realize I can do that on both of those to do my calls. But ultimately - I MUST be able to use SSL because the development we are using these servers for requires it.
It seems that the CA is out of date. I have tried the following https://access.redhat.com/solutions/1549003
I have tried importing the cacert.pem file myself (tho I will admit, I'm lacking in knowledge here, so its possible I did it wrong)
I have checked date/time on the server to make sure that is not the issue.
I cannot get the "Network Admin" (term used loosely, as he'll be the first to admit he has absolutely no knowledge of Linux - pure Microsoft) to even be bothered with reinstalling Centos to this machine, so I need to find a solution to this.
Any help would be appreciated. Below are some examples of what we get when trying to do things such as yum, curl, and running certbot --apache
[root@localhost work]# yum reinstall mc Loaded plugins: fastestmirror Loading mirror speeds from cached hostfile Could not get metalink https://mirrors.fedoraproject.org/metalink?repo=epel- 7&arch=x86_64 error was 14: curl#60 - "Peer's certificate issuer has been marked as not trusted by the user." * base: repos.dfw.quadranet.com * epel: mirror.compevo.com * extras: repos-tx.psychz.net * updates: mirror.us.oneandone.net * webtatic: repo.webtatic.com https://us-east.repo.webtatic.com/yum/el7/x86_64/repodata/repomd.xml: [Errno 14] curl#60 - "Peer's certificate issuer has been marked as not trusted by the user." Trying other mirror. It was impossible to connect to the CentOS servers. This could mean a connectivity issue in your environment, such as the requirement to configure a proxy, or a transparent proxy that tampers with TLS security, or an incorrect system clock. You can try to solve this issue by using the instructions on https://wiki.centos.org/yum-errors If above article doesn't help to resolve this issue please use https://bugs.centos.org/. https://uk.repo.webtatic.com/yum/el7/x86_64/repodata/repomd.xml: [Errno 14] curl#60 - "Peer's certificate issuer has been marked as not trusted by the user." Trying other mirror. https://sp.repo.webtatic.com/yum/el7/x86_64/repodata/repomd.xml: [Errno 14] curl#60 - "Peer's certificate issuer has been marked as not trusted by the user." Trying other mirror. https://repo.webtatic.com/yum/el7/x86_64/repodata/repomd.xml: [Errno 14] curl#60 - "Peer's certificate issuer has been marked as not trusted by the user." Trying other mirror.
[root@localhost work]# curl https://www.google.com curl: (60) Peer's certificate issuer has been marked as not trusted by the user. More details here: http://curl.haxx.se/docs/sslcerts.html curl performs SSL certificate verification by default, using a "bundle" of Certificate Authority (CA) public keys (CA certs). If the default bundle file isn't adequate, you can specify an alternate file using the --cacert option. If this HTTPS server uses a certificate signed by a CA represented in the bundle, the certificate verification probably failed due to a problem with the certificate (it might be expired, or the name might not match the domain name in the URL). If you'd like to turn off curl's verification of the certificate, use the -k (or --insecure) option.
CERTBOT (FOR LETSENCRYPT SSL CERT REQUEST)
[root@localhost work]# sudo certbot --apache Saving debug log to /var/log/letsencrypt/letsencrypt.log Plugins selected: Authenticator apache, Installer apache Enter email address (used for urgent renewal and security notices) (Enter 'c' to cancel): firstname.lastname@example.org Starting new HTTPS connection (1): acme-v02.api.letsencrypt.org An unexpected error occurred: SSLError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:579) Please see the logfiles in /var/log/letsencrypt for more details.