0

I have a scenario where I was using curl --noproxy "*" https://.. to get the response but suddenly when I use it now it doesn't return me the response instead it says

curl: (60) Peer certificate cannot be authenticated with known CA certificates
More details here: http://curl.haxx.se/docs/sslcerts.html

now when I use curl -k https:// it gives me response. I am not sure what went wrong and what could be the cause for this.

Any idea how to not use curl -k insecure option ?

2 Answers 2

0

You can load a valid certificate for the site you are trying to connect to with the --cacert /path/to/crt/file. The -k option is usually used for self-signed certs, although I always try and use --cacert.

0

If this happened recently, maybe the remote certificate was signed by an authority not present in your certificate store. If you have no doubt about remote site being legitimate, -k is an option. However:

  • you can try to update your system to refresh ca-certificates package
  • you can get information about certificates using openssl s_client which has many options to debug SSL things.

    ex: $ openssl s_client -connect google.com:443

    • Also: you cant get additional detail on certificates by extending the command like this:

    $ openssl s_client -connect google.com:443 | openssl x509 -noout -text

which includes validity dates, for example :

... Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 5230064140940427690 (0x4894eba0494341aa)
    Signature Algorithm: sha256WithRSAEncryption
        Issuer: C=US, O=Google Inc, CN=Google Internet Authority G2
        Validity
            Not Before: Feb 13 10:55:29 2018 GMT
            Not After : May  8 10:40:00 2018 GMT
        Subject: C=US, ST=California, L=Mountain View, O=Google Inc, CN=*.google.com
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Modulus:
                    00:d7:14:f9:54:c2:48:c4:4c:be:22:b1:59:23:79:
      ... 
11
  • is this anything related to user ? I had created a different user and assigned root permissions
    – vanishka
    Feb 28, 2018 at 12:29
  • no, the ca-certificates are usually globally accessible. However, if it wroked with another user, you should try again with that. And if so look for differences in environment.
    – tonioc
    Feb 28, 2018 at 12:36
  • okay , thanks for the explanation. two questions now, 1. if I use curl -k is there any harm is this insecure ? 2. I remember I had created a user then assigned root permissions to it then in root profile i had exported the proxy settings (when ever I do sudo su root it redirects me to my home) now few days back I created a new user and assigned root permissions to it is there any relation that I should del that user ?
    – vanishka
    Feb 28, 2018 at 13:22
  • 1. "-k" option : this option prevents remote certificate from being verified. As a consequence, you are never sure the communication is actually going to the server you think it goes.
    – tonioc
    Feb 28, 2018 at 16:54
  • 2. I don't think these are linked. What is the result of openssl s_client -connect <yoursite>:443 ?
    – tonioc
    Feb 28, 2018 at 16:55

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .