curl SSL certificate error: verifcation failed -


please me understand why cannot curl url via https:

i using ubuntu 12.04.5 curl 7.22.0, libcurl 7.22.0 , openssl 1.0.1-4ubuntu5.25

$ curl -v https://www.onevanilla.com/ * connect() www.onevanilla.com port 443 (#0) *   trying 199.83.128.4... connected * set certificate verify locations: *   cafile: none   capath: /etc/ssl/certs * sslv3, tls handshake, client hello (1): * sslv3, tls handshake, server hello (2): * sslv3, tls handshake, cert (11): * sslv3, tls alert, server hello (2): * ssl certificate problem, verify ca cert ok. details: error:14090086:ssl routines:ssl3_get_server_certificate:certificate verify failed * closing connection #0 curl: (60) ssl certificate problem, verify ca cert ok. details: error:14090086:ssl routines:ssl3_get_server_certificate:certificate verify failed

so try manually cert:

$ openssl s_client -connect www.onevanilla.com:443 </dev/null | sed -ne '/-begin certificate-/,/-end certificate-/p' > /tmp/www.onevanilla.com.pem

and then:

$ curl -v --cacert /tmp/www.onevanilla.com.pem https://www.onevanilla.com

but same result:

* connect() www.onevanilla.com port 443 (#0) *   trying 199.83.128.4... connected * set certificate verify locations: *   cafile: /tmp/www.onevanilla.com.pem   capath: /etc/ssl/certs * sslv3, tls handshake, client hello (1): * sslv3, tls handshake, server hello (2): * sslv3, tls handshake, cert (11): * sslv3, tls alert, server hello (2): * ssl certificate problem, verify ca cert ok. details: error:14090086:ssl routines:ssl3_get_server_certificate:certificate verify failed * closing connection #0 curl: (60) ssl certificate problem, verify ca cert ok. details: error:14090086:ssl routines:ssl3_get_server_certificate:certificate verify failed

i can verify certificate openssl:

$ openssl s_client -host www.onevanilla.com -port 443 -capath /etc/ssl/certs

and returns verify return code: 0 (ok)

i've run sudo update-ca-certificates --fresh sure, no luck.

so seems me cert valid (not expired, hostname matches cn), can never successful response using curl (unless of course use -k or --insecure options). can please explain?

you've run problem caused long standing issue openssl not handling situations multiple trust path. if report ssllabs you'll see, server provides following chain:

[0] /o=www.onevanilla.com/ou=domain control validated/cn=www.onevanilla.com san=dns:www.onevanilla.com,dns:onevanilla.com [1] /c=us/st=arizona/l=scottsdale/o=godaddy.com, inc./ou=http://certificates.godaddy.com/repository/cn=go daddy secure certification authority/serialnumber=07969287 [2] /c=us/o=the go daddy group, inc./ou=go daddy class 2 certification authority [3] /l=valicert validation network/o=valicert, inc./ou=valicert class 2 policy validation authority/cn=http://www.valicert.com//emailaddress=info@valicert.com

browsers have included root certificate go daddy class 2 certification authority , can build trust path [0],[1] , root certificate , ignore certificates [2] , [3]. openssl instead ignore certificate [3] because self-signed , therefore should not have been included in chain @ all. attempt verify chain [0],[1],[2] , fail because not find root certificate signing [2]. not attempt verify shorter chain [0],[1] instead.

for more details problem see python urllib2 ssl error , http://kriscience.blogspot.de/2013/03/supporting-trusted-but-untrusted.html , the openssl bug report.

what can do: missing certificate https://certs.godaddy.com/repository/valicert_class2_root.crt , use in --cacert parameter.


Comments

Post a Comment

Popular posts from this blog

Payment information shows nothing in one page checkout page magento -

i using magento ver. 1.9.1.0 want remove shipping information , shipping method step 1 page checkout page. changed code in core file like in app\code\core\mage\checkout\block\onepage.php public function getsteps() { $steps = array(); $stepcodes = $this->_getstepcodes(); /* remove shipping address , shipping method */ $excludestep=array_diff($stepcodes,array('shipping','shipping_method')); //$excludestep=$stepcodes; if ($this->iscustomerloggedin()) { $stepcodes = array_diff($excludestep, array('login')); } foreach ($excludestep $step) { $steps[$step] = $this->getcheckout()->getstepdata($step); } return $steps; } and in app\code\core\mage\checkout\controllers\onepagecontroller.php public function savebillingaction() { if ($this->_expireajax()) { return; } if ($this->getrequest()-...
Read more

tcpdump - How to check if server received packet (acknowledged) -

Image
i running tcpdump on server capture traffic between server (servera) , remote server (serverb). not know how read output tcpdump. point out if serverb acknowledging packets being sent servera being received serverb? here tcpdump log: 2015-03-31 11:32:18.038284 ip (tos 0x0, ttl 64, id 30781, offset 0, flags [df], proto tcp (6), length 60) servera.14033 > serverb.8004: flags [s], cksum 0x02bd (correct), seq 337482636, win 14600, options [mss 1460,nop,nop,ts val 506588081 ecr 0,nop,wscale 7], length 0 0x0000: 4500 003c 783d 4000 4006 bae4 0a04 7a0e e.. servera.14033: flags [s.], cksum 0x3b2a (correct), seq 1742982091, ack 337482637, win 4140, options [mss 1380,nop,wscale 0], length 0 0x0000: 4500 0030 5ff2 0000 f606 5d3b cefd b48a e..0_.....];.... 0x0010: 0a04 7a0e 1f44 36d1 67e3 cbcb 141d 938d ..z..d6.g....... 0x0020: 7012 102c 3b2a 0000 0204 0564 0103 0300 p..,;*.....d.... 2015-03-31 11:32:18.078622 ip (tos 0x0, ttl 64, id 30782, offset 0, flags [...
Read more