Server Fault Asked by Jitesh T on January 19, 2021
I used curl to launch a https request to download the file. I used below command:
curl -v -o Output.pdf
https://otherdomain.com/upload/manual-8mm-f35-csii-vdslr-5.pdf
The result I get is:
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0* Trying 184.106.55.122...
* TCP_NODELAY set
* Connected to otherdomain.com (184.106.55.122) port 443 (#0)
* Initializing NSS with certpath: sql:/etc/pki/nssdb
* CAfile: /etc/pki/tls/certs/ca-bundle.crt
CApath: none
* Server certificate:
* subject: CN=www.otherdomain.com
* start date: Aug 01 00:00:00 2018 GMT
* expire date: Jul 31 12:00:00 2020 GMT
* common name: www.otherdomain.com
* issuer: CN=RapidSSL RSA CA 2018,OU=www.digicert.com,O=DigiCert Inc,C=US
* NSS error -8179 (SEC_ERROR_UNKNOWN_ISSUER)
* Peer's Certificate issuer is not recognized.
* stopped the pause stream!
0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0
* Closing connection 0
curl: (60) Peer's Certificate issuer is not recognized.
More details here: https://curl.haxx.se/docs/sslcerts.html
curl performs SSL certificate verification by default, using a "bundle"
of Certificate Authority (CA) public keys (CA certs). If the default
bundle file isn't adequate, you can specify an alternate file
using the --cacert option.
If this HTTPS server uses a certificate signed by a CA represented in
the bundle, the certificate verification probably failed due to a
problem with the certificate (it might be expired, or the name might
not match the domain name in the URL).
If you'd like to turn off curl's verification of the certificate, use
the -k (or --insecure) option.
Any idea what the problem is and how I can fix it?
The problem is with the site you are trying to reach. They appear to have misconfigured TLS on their site. In particular, they are not sending an intermediate certificate named "RapidSSL RSA CA 2018" that they should have included in their web server configuration.
The site apparently has many other problems with their TLS setup.
You can't fix their web server because you don't have control over it. But perhaps you can contact someone there to let them know of their problem.
You can tell curl to ignore the certificate problem by using the -k
option, but then you cannot be sure you are speaking to the genuine web site.
Answered by Michael Hampton on January 19, 2021
Get help from others!
Recent Questions
Recent Answers
© 2024 TransWikia.com. All rights reserved. Sites we Love: PCI Database, UKBizDB, Menu Kuliner, Sharing RPP