Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Hot answers tagged

232

You should be able to use OpenSSL for your purpose: echo | openssl s_client -showcerts -servername gnupg.org -connect gnupg.org:443 2>/dev/null | openssl x509 -inform pem -noout -text That command connects to the desired website and pipes the certificate in PEM format on to another openssl command that reads and parses the details. (Note that "...


103

Think I found a solution going through the cURL manual: curl https://DOMAIN.EXAMPLE --resolve 'DOMAIN.EXAMPLE:443:192.0.2.17' Added in [curl] 7.21.3. Removal support added in 7.42.0. from CURLOPT_RESOLVE explained


55

Simple solution That's my everyday script: curl --insecure -v https://www.google.com 2>&1 | awk 'BEGIN { cert=0 } /^\* SSL connection/ { cert=1 } /^\*/ { if (cert) print }' Output: * SSL connection using TLS1.2 / ECDHE_RSA_AES_128_GCM_SHA256 * server certificate verification SKIPPED * server certificate status verification SKIPPED * ...


52

Yeah, you can do that, as curl --help or man curl would have told you: -k, --insecure (SSL) This option explicitly allows curl to perform "insecure" SSL connections and transfers. All SSL connections are attempted to be made secure by using the CA certificate bundle installed by default. This makes all connections considered "insecure" fail ...


47

For RHEL 6 or later, you should be using update-ca-trust, as lzap describes in his answer below. --- For older versions of Fedora, CentOS, Redhat: Curl is using the system-default CA bundle is stored in /etc/pki/tls/certs/ca-bundle.crt . Before you change it, make a copy of that file so that you can restore the system default if you need to. You can ...


38

You are correct -- lighttpd doesn't support POST requests with an empty message body without a 'Content-Length' header set to zero, and CURL sends such a request. There's argument back and forth about who's right, but in my opinion, lighttpd is broken. A POST with no Content-Length and no Transfer-Encoding is perfectly legal and has no message body. Adding -...


36

The recommended way of doing that on RHEL 6+ systems is to use update-ca-trust tool, which is now installed by default. # cat /etc/pki/ca-trust/source/README This directory /etc/pki/ca-trust/source/ contains CA certificates and trust settings in the PEM file format. The trust settings found here will be interpreted with a high priority - higher than the ...


29

Use '&' after a command to background a process, and 'wait' to wait for them to finish. Use '()' around the commands if you need to create a sub-shell. #!/bin/bash curl -s -o foo http://example.com/file1 && echo "done1" & curl -s -o bar http://example.com/file2 && echo "done2" & curl -s -o baz http://example.com/file3 &&...


28

You can use the -d option in curl with a @- argument to accept input from a pipe. You will need to construct the key-value pairs yourself. Try this: echo "time=`uptime`" | curl -d @- http://URL The backticks (`) denote that the enclosed command (in this case uptime) should be executed, and the backtick-quoted text replaced with the output of the executed ...


24

Depends on what kind of information you want, but: openssl s_client -showcerts -connect gnupg.org:443 should give you most, although not as nicely human readable like Chrome presents it.


23

Powershell. $wc = New-Object System.Net.WebClient $wc.DownloadFile($source, $dest) There's also Invoke-WebRequest in PS 3.0.


21

nmap -p 443 --script ssl-cert gnupg.org The -p 443 specifies to scan port 443 only. All ports will be scanned if it is omitted, and the certificate details for any SSL service that is found will be displayed. The --script ssl-cert tells the Nmap scripting engine to run only the ssl-cert script. From the doc, this script "(r)etrieves a server's SSL ...


18

curl -k or curl --insecure does NOT fix this particular error condition: "curl: (51) SSL peer certifcate


18

wget(1) works sequentally by default, and has this option built in: -i file --input-file=file Read URLs from a local or external file. If - is specified as file, URLs are read from the standard input. (Use ./- to read from a file literally named -.) If this function is used, no URLs need be present on the command line. If there are ...


18

I saw a similar kind of problem, yet not accessing twitter. Problem I saw was on RHEL 6.1 -> RHEL 6.4, using curl to access a REST API. curl showed error: curl: (35) SSL connect error Issue ended up being that our server running the REST API was RHEL 6.6, using a newer version of NSS. Once we upgraded the client NSS version curl was successful. We ...


17

instead of using wget, curl works like this: curl --silent http://domain.com/cron.php which will work in the same way as wget. if its a php file you are launching, is there any reason you cant run it via the command line php interpreter like so: php -q /path/to/cron.php same on a webserver request and often will work much faster and without certain ...


17

I've been having the same trouble and after poking around a bit found that you can download a package of CA-certs ready for curl on ubuntu directly from the curl dev site. cd /etc/ssl/certs sudo wget http://curl.haxx.se/ca/cacert.pem Now curl uses the most up-to-date bundle and you're good to go.


16

xargs -n 1 curl -O < your_files.txt


15

You likely will need to troubleshoot this from the server side, not the client side. I believe you are confusing an 'empty response' with 'no response'. They do not mean the same thing. Likely you are getting a reply that does not contain any data. You can test this by simply using telnet instead of going through curl: telnet 111.222.159.30 80 Once ...


15

The curl client isn't caching files, but the remote server network might well be. Try adding an arbitrary query string variable to the URL to see if you can reproduce it.


14

Running curl with strace might give you a clue. strace curl https://www.google.com |& grep open Lots of output, but right near the end I see: open("/etc/ssl/certs/578d5c04.0", O_RDONLY) = 4 which is where my certificates are stored.


14

There should be a program 'curl-config' in curl's 'bin/', i.e. where the 'curl' binary resides. ./curl-config --ca gives the ca bundle install path. I just did a whatis curl-config: "Get information about a libcurl installation" so I guess it will only be available if libcurl was installed, which I presume is standard though.


14

If the server sends you a TLS alert unknown ca like in this case then the server does not accept the client certificate you have send (-E my.pem). One reason for this might be that you have used the wrong certificate. Another reason might be that you've used the correct certificate but failed to add the necessary chain certificates.


13

curl -I will generate a HEAD request. Adding the -L option will make it follow redirects. Timeouts can be controlled with several options depending on which bit of the request you want to time out. From the man page: --connect-timeout <seconds> Maximum time in seconds that you allow the connection to the server to take. This only limits ...


13

What you would need to do is: wget https://dl.fedoraproject.org/pub/epel/epel-release-latest-7.noarch.rpm If you still get an SSL warning try: wget --no-check-certificate https://dl.fedoraproject.org/pub/epel/epel-release-latest-7.noarch.rpm Then you can rpm -Uvh webtatic-release.rpm Which should show up here: ll /etc/yum.repos.d


12

I think this is a bug in curl. If I specify a method with -X, curl should handle the response according to the RFC. Unfortunately, the maintainer of curl does not agree. Someone filed a bug and even submitted a patch: http://sourceforge.net/tracker/?func=detail&atid=100976&aid=1810273&group_id=976 but the curl maintainer rejected it. Apparently ...


11

Your curl command is running as root (via sudo) but your php command is not. Try moving your sudo between the pipe ("|") and 'php' (assuming you want your installer to run as root in the first place...).


11

You can change in /etc/hosts to make the server think that the domain is located at a certain IP. This is the syntax: 192.168.10.20 www.domain.tld This will make cURL use the IP-address you want without the SSL-certificate to break.


11

There is no wget like built-in command in Windows. You can use the .net Framework via Windows PowerShell like in this example: https://superuser.com/questions/362152/native-alternative-to-wget-in-windows-powershell or like i do and use wget for Windows: http://gnuwin32.sourceforge.net/packages/wget.htm


Only top voted, non community-wiki answers of a minimum length are eligible