3

At our company they enforce a web proxy which breaks SSL connections and replaces the certificate by its own fake certificate. (To be precise it uses a proxy cert which is signed by the company cert.)

In order to download from a https URL I therefore have to make my system trust that fake certificate (or disable certificate checking).

I therefore added both the proxy cert and the company cert to both /etc/ssl/certs/ca-bundle.crt and /etc/ssl/certs/ca-certificates.crt. (Both link to the same file.)

Now downloading with wget works fine, however downloading with curl does not work, because curl is not able to verify the certificate:

* Rebuilt URL to: https://company.net/
* Hostname was NOT found in DNS cache
*   Trying 172.18.111.111...
* Connected to 172.18.111.111 (172.18.111.111) port 3128 (#0)
* Establish HTTP proxy tunnel to company.net:443
> CONNECT company.net:443 HTTP/1.1
> Host: company.net:443
> User-Agent: curl/7.39.0
> Proxy-Connection: Keep-Alive
>
< HTTP/1.1 200 Connection established
<
* Proxy replied OK to CONNECT request
* successfully set certificate verify locations:
*   CAfile: /etc/ssl/certs/ca-bundle.crt
  CApath: none
* SSLv3, TLS handshake, Client hello (1):
* SSLv3, TLS handshake, Server hello (2):
* SSLv3, TLS handshake, CERT (11):
* SSLv3, TLS alert, Server hello (2):
* SSL certificate problem: self signed certificate in certificate chain
* Closing connection 0
curl: (60) SSL certificate problem: self signed certificate in certificate chain

What might be wrong? How can I debug further?

  • What is the curl command + any flags that causes this? What flags are you using with wget? – KM. Mar 6 '15 at 13:10
  • No flags. Simply the command and the URL. (Only -v to get the debug output above.) According to strace the commands look into the correct cert files. – michas Mar 6 '15 at 13:13
  • Adding -k to ~/.curlrc allows downloading stuff for the moment. – michas Mar 6 '15 at 15:11
  • 1
    Use openssl s_client -showcerts to see the whole chain and check each of the certificates with openssl x509 -text to see its contents. The certificates should be in the right order, i.e. first the leaf certificate, then the chain certificates and no root certificate at the end, because the root must reside in your CA store. – Steffen Ullrich Mar 6 '15 at 19:15
  • You may also need to run c_rehash (aka openssl rehash) on that /etc/ssl/certs directory, as curl (if built using OpenSSL) may need that tweak in order to "learn" of those certs you added. – Castaglia Feb 18 '16 at 22:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.