At our company they enforce a web proxy which breaks SSL connections and replaces the certificate by its own fake certificate. (To be precise it uses a proxy cert which is signed by the company cert.)
In order to download from a https URL I therefore have to make my system trust that fake certificate (or disable certificate checking).
I therefore added both the proxy cert and the company cert to both
/etc/ssl/certs/ca-certificates.crt. (Both link to the same file.)
Now downloading with
wget works fine, however downloading with
curl does not work, because
curl is not able to verify the certificate:
* Rebuilt URL to: https://company.net/ * Hostname was NOT found in DNS cache * Trying 172.18.111.111... * Connected to 172.18.111.111 (172.18.111.111) port 3128 (#0) * Establish HTTP proxy tunnel to company.net:443 > CONNECT company.net:443 HTTP/1.1 > Host: company.net:443 > User-Agent: curl/7.39.0 > Proxy-Connection: Keep-Alive > < HTTP/1.1 200 Connection established < * Proxy replied OK to CONNECT request * successfully set certificate verify locations: * CAfile: /etc/ssl/certs/ca-bundle.crt CApath: none * SSLv3, TLS handshake, Client hello (1): * SSLv3, TLS handshake, Server hello (2): * SSLv3, TLS handshake, CERT (11): * SSLv3, TLS alert, Server hello (2): * SSL certificate problem: self signed certificate in certificate chain * Closing connection 0 curl: (60) SSL certificate problem: self signed certificate in certificate chain
What might be wrong? How can I debug further?