1

I used curl to launch a https request to download the file. I used below command:

curl -v -o Output.pdf https://otherdomain.com/upload/manual-8mm-f35-csii-vdslr-5.pdf

The result I get is:

      % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0*   Trying 184.106.55.122...
* TCP_NODELAY set
* Connected to otherdomain.com (184.106.55.122) port 443 (#0)
* Initializing NSS with certpath: sql:/etc/pki/nssdb
*   CAfile: /etc/pki/tls/certs/ca-bundle.crt
  CApath: none
* Server certificate:
*   subject: CN=www.otherdomain.com
*   start date: Aug 01 00:00:00 2018 GMT
*   expire date: Jul 31 12:00:00 2020 GMT
*   common name: www.otherdomain.com
*   issuer: CN=RapidSSL RSA CA 2018,OU=www.digicert.com,O=DigiCert Inc,C=US
* NSS error -8179 (SEC_ERROR_UNKNOWN_ISSUER)
* Peer's Certificate issuer is not recognized.
* stopped the pause stream!
  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0
* Closing connection 0
curl: (60) Peer's Certificate issuer is not recognized.
More details here: https://curl.haxx.se/docs/sslcerts.html

curl performs SSL certificate verification by default, using a "bundle"
 of Certificate Authority (CA) public keys (CA certs). If the default
 bundle file isn't adequate, you can specify an alternate file
 using the --cacert option.
If this HTTPS server uses a certificate signed by a CA represented in
 the bundle, the certificate verification probably failed due to a
 problem with the certificate (it might be expired, or the name might
 not match the domain name in the URL).
If you'd like to turn off curl's verification of the certificate, use
 the -k (or --insecure) option.

Any idea what the problem is and how I can fix it?

  • Most probably your ca-bundle is out of date. What distribution are you using? What version? Are updates outstanding? – Gerald Schneider Jan 25 at 11:35
  • Thanks @GeraldSchneider I am not a server guy. How can I check ca-bundle details(version, distribution)? Help me to extract those details. Thanks – Jitesh T Jan 25 at 11:49
  • That depends on the Linux distribution you are using. Google <yourdistribution> package management – Gerald Schneider Jan 25 at 12:30
  • We are using "Amazon Linux AMI release 2017.09" – Jitesh T Jan 25 at 13:17
  • @GeraldSchneider We are using AWS Linux – Jitesh T Jan 25 at 14:51
0

The problem is with the site you are trying to reach. They appear to have misconfigured TLS on their site. In particular, they are not sending an intermediate certificate named "RapidSSL RSA CA 2018" that they should have included in their web server configuration.

The site apparently has many other problems with their TLS setup.

You can't fix their web server because you don't have control over it. But perhaps you can contact someone there to let them know of their problem.

You can tell curl to ignore the certificate problem by using the -k option, but then you cannot be sure you are speaking to the genuine web site.

Your Answer

By clicking "Post Your Answer", you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.