4

I am having small initramfs with static busybox into it. The sole purpose of this initramfs is to download/upload files to the HTTPS server.

I have the proper certificate and credentials to do so. But when I execute the command:

curl --cacert /tmp/filename.pem -T /tmp/file_to_upload -u user:pass https://Server_name/

I greeted with an error:

curl: (60) SSL certificate problem: unable to get local issuer certificate

If I use the same command with same certificate onto Ubuntu, then everything goes smooth.

How am I suppose to resolve this issue ?

EDIT: I do not want to use "-k" or "--insecure" switch

NOTE: I do not have openssl or /etc/ssl directory into initramfs

3
  • Which SSL implementation does this version of curl use? It should be in the output of curl --version.
    – JigglyNaga
    May 26, 2016 at 13:13
  • curl 7.37.1 (i686-pc-linux-gnu) libcurl/7.37.1 OpenSSL/1.0.2g zlib/1.2.8
    – SHW
    May 26, 2016 at 13:16
  • I can see two possible reasons: your /etc/ssl/certs/ca-certificates.crt doesn't contains the root CA you need. OR the HTTPS gives you an "Authority Information Access" and expect your client curl to download the intermediate certificate from the given URL. (And `curlè doesn't handle AIA informations. Could you tell us which HTTPS server you use ? If this is a private server, make sure its certificate (intermediate certificate if needed) is in your trusted base.
    – Frédéric Loyer
    Mar 24 at 20:25

1 Answer 1

Reset to default
0

Since you do not have /etc/ssl, I advise adding the curl -k option to your command.

-k, --insecure
(SSL) This option explicitly allows curl to perform "insecure" SSL connections and transfers. All SSL connections are attempted to be made secure by using the CA certificate bundle installed by default. This makes all connections considered "insecure" fail unless -k, --insecure is used.

Per your edit of not wanting -k, another option is creating /etc/ssl/certs, and adding the root certificate(s) underpinning the chain of trust to your certificate in it. However for it to work you need to have openssl installed, or at a minimal /etc/ssl/openssl.cnf configuration file.

A 3rd option can be just concatenating to "filename.pem" all the necessary certificate(s) to complete the chain of trust in the order of importance (i.e. if there are intermediate CAs, the root CA comes last). It works in some software settings (Apache, FreeRadius, never personally tried it with curl).

3
  • 1
    I tried the above mentioned two methods but still with no luck. Is openssl strictly required ?
    – SHW
    May 26, 2016 at 12:49
  • @SHW Using strace shows curl tries to use openssl.cnf.
    – Rui F Ribeiro
    May 26, 2016 at 12:51
  • I added openssl and /etc/ssl/cert directory with all necessary certificates. But still I am getting the same error
    – SHW
    May 26, 2016 at 13:12

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .