cURL / Mailing Lists / curl-users / Single Mail

curl-users

curl --cacert doesn't work...

From: Mag. Manuela Stromberger - Energie Klagenfurt GmbH <manuela.stromberger_at_outlook.com>
Date: Wed, 13 Aug 2014 21:12:14 +0200

Hi,

curl 7.21.7 for OpenWrt has a bug.

I saved the server certificate from dtdns.com.

openssl s_client -connect dtdns.com:443

Then I tried this on Ubuntu:

Ubuntu:

user_at_PC:~$ curl --version
curl 7.35.0 (x86_64-pc-linux-gnu) libcurl/7.35.0 OpenSSL/1.0.1f zlib/1.2.8 libidn/1.28 librtmp/2.3
Protocols: dict file ftp ftps gopher http https imap imaps ldap ldaps pop3 pop3s rtmp rtsp smtp smtps telnet tftp
Features: AsynchDNS GSS-Negotiate IDN IPv6 Largefile NTLM NTLM_WB SSL libz TLS-SRP
user_at_PC:~$
user@PC:~$ curl --cacert DTDNS.crt -X GET 'https://www.dtdns.com/api/autodns.cfm?id=....&pw=....&ip=....'

It works - curl checks if the server certificate is the same like.

Then I tried the same on OpenWrt 10.03.1, r29592:

root_at_Router:~# curl --version
curl 7.21.7 (mips-openwrt-linux-gnu) libcurl/7.21.7 OpenSSL/0.9.8r zlib/1.2.3
Protocols: file ftp ftps http https imap imaps pop3 pop3s rtsp smtp smtps tftp
Features: IPv6 Largefile NTLM SSL libz
root_at_Router:~#

root@Router:/etc# curl --cacert DTDNS.crt -X GET 'https://www.dtdns.com/api/autodns.cfm?id=....&pw=....&ip=....'
curl: (60) SSL certificate problem, verify that the CA cert is OK. Details:
error:14090086:lib(20):func(144):reason(134)
More details here: http://curl.haxx.se/docs/sslcerts.html

curl performs SSL certificate verification by default, using a "bundle"
of Certificate Authority (CA) public keys (CA certs). If the default
bundle file isn't adequate, you can specify an alternate file
using the --cacert option.
If this HTTPS server uses a certificate signed by a CA represented in
the bundle, the certificate verification probably failed due to a
problem with the certificate (it might be expired, or the name might
not match the domain name in the URL).
If you'd like to turn off curl's verification of the certificate, use
the -k (or --insecure) option.
root_at_Router:/etc#

When I use -k it works but I want the more secure method! :-)

Best Regards,
Manuela

-------------------------------------------------------------------
List admin: http://cool.haxx.se/list/listinfo/curl-users
FAQ: http://curl.haxx.se/docs/faq.html
Etiquette: http://curl.haxx.se/mail/etiquette.html
Received on 2014-08-13

This message: [ Message body ]
Next message: Daniel Stenberg: "Re: cURL with CyaSSL, cURL logo usage"
Previous message: leah_at_wolfssl.com: "cURL with CyaSSL, cURL logo usage"
Next in thread: Daniel Stenberg: "Re: curl --cacert doesn't work..."
Reply: Daniel Stenberg: "Re: curl --cacert doesn't work..."

Contemporary messages sorted: [ by date ] [ by thread ] [ by subject ] [ by author ] [ by messages with attachments ]