At our company they enforce a web proxy which breaks SSL connections and replaces the certificate by its own fake certificate. (To be precise it uses a proxy cert which is signed by the company cert.)

In order to download from a https URL I therefore have to make my system trust that fake certificate (or disable certificate checking).

I therefore added both the proxy cert and the company cert to both /etc/ssl/certs/ca-bundle.crt and /etc/ssl/certs/ca-certificates.crt. (Both link to the same file.)

Now downloading with wget works fine, however downloading with curl does not work, because curl is not able to verify the certificate:

* Rebuilt URL to: https://company.net/
* Hostname was NOT found in DNS cache
*   Trying
* Connected to ( port 3128 (#0)
* Establish HTTP proxy tunnel to company.net:443
> CONNECT company.net:443 HTTP/1.1
> Host: company.net:443
> User-Agent: curl/7.39.0
> Proxy-Connection: Keep-Alive
< HTTP/1.1 200 Connection established
* Proxy replied OK to CONNECT request
* successfully set certificate verify locations:
*   CAfile: /etc/ssl/certs/ca-bundle.crt
  CApath: none
* SSLv3, TLS handshake, Client hello (1):
* SSLv3, TLS handshake, Server hello (2):
* SSLv3, TLS handshake, CERT (11):
* SSLv3, TLS alert, Server hello (2):
* SSL certificate problem: self signed certificate in certificate chain
* Closing connection 0
curl: (60) SSL certificate problem: self signed certificate in certificate chain

What might be wrong? How can I debug further?

  • What is the curl command + any flags that causes this? What flags are you using with wget?
    – KM.
    Commented Mar 6, 2015 at 13:10
  • No flags. Simply the command and the URL. (Only -v to get the debug output above.) According to strace the commands look into the correct cert files.
    – michas
    Commented Mar 6, 2015 at 13:13
  • Adding -k to ~/.curlrc allows downloading stuff for the moment.
    – michas
    Commented Mar 6, 2015 at 15:11
  • 1
    Use openssl s_client -showcerts to see the whole chain and check each of the certificates with openssl x509 -text to see its contents. The certificates should be in the right order, i.e. first the leaf certificate, then the chain certificates and no root certificate at the end, because the root must reside in your CA store. Commented Mar 6, 2015 at 19:15
  • You may also need to run c_rehash (aka openssl rehash) on that /etc/ssl/certs directory, as curl (if built using OpenSSL) may need that tweak in order to "learn" of those certs you added.
    – Castaglia
    Commented Feb 18, 2016 at 22:00

1 Answer 1


You need to tell nix about the certs, like so:

security.pki.certificates = [''cert strings go here in PEM format''];


 security.pki.certificates = [

      -----BEGIN CERTIFICATE-----
      -----END CERTIFICATE-----

You can add many of them if you so choose. This will add the included certs to the system cert store, and curl should then use them without any extra command line args.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .