TransWikia.com

Curl verify certificate improperly

Server Fault Asked by Jitesh T on January 19, 2021

I used curl to launch a https request to download the file. I used below command:

curl -v -o Output.pdf
https://otherdomain.com/upload/manual-8mm-f35-csii-vdslr-5.pdf

The result I get is:

      % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0*   Trying 184.106.55.122...
* TCP_NODELAY set
* Connected to otherdomain.com (184.106.55.122) port 443 (#0)
* Initializing NSS with certpath: sql:/etc/pki/nssdb
*   CAfile: /etc/pki/tls/certs/ca-bundle.crt
  CApath: none
* Server certificate:
*   subject: CN=www.otherdomain.com
*   start date: Aug 01 00:00:00 2018 GMT
*   expire date: Jul 31 12:00:00 2020 GMT
*   common name: www.otherdomain.com
*   issuer: CN=RapidSSL RSA CA 2018,OU=www.digicert.com,O=DigiCert Inc,C=US
* NSS error -8179 (SEC_ERROR_UNKNOWN_ISSUER)
* Peer's Certificate issuer is not recognized.
* stopped the pause stream!
  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0
* Closing connection 0
curl: (60) Peer's Certificate issuer is not recognized.
More details here: https://curl.haxx.se/docs/sslcerts.html

curl performs SSL certificate verification by default, using a "bundle"
 of Certificate Authority (CA) public keys (CA certs). If the default
 bundle file isn't adequate, you can specify an alternate file
 using the --cacert option.
If this HTTPS server uses a certificate signed by a CA represented in
 the bundle, the certificate verification probably failed due to a
 problem with the certificate (it might be expired, or the name might
 not match the domain name in the URL).
If you'd like to turn off curl's verification of the certificate, use
 the -k (or --insecure) option.

Any idea what the problem is and how I can fix it?

One Answer

The problem is with the site you are trying to reach. They appear to have misconfigured TLS on their site. In particular, they are not sending an intermediate certificate named "RapidSSL RSA CA 2018" that they should have included in their web server configuration.

The site apparently has many other problems with their TLS setup.

You can't fix their web server because you don't have control over it. But perhaps you can contact someone there to let them know of their problem.

You can tell curl to ignore the certificate problem by using the -k option, but then you cannot be sure you are speaking to the genuine web site.

Answered by Michael Hampton on January 19, 2021

Add your own answers!

Ask a Question

Get help from others!

© 2024 TransWikia.com. All rights reserved. Sites we Love: PCI Database, UKBizDB, Menu Kuliner, Sharing RPP