I'm on a Debian wheezy server and I'm trying to download stuff by https without success.

When I try to use curl, it gives me this answer by example:

curl: (60) SSL certificate problem, verify that the CA cert is OK. Details:
error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed
More details here: http://curl.haxx.se/docs/sslcerts.html

wget gives me something similar:

ERROR: cannot verify www.domain.com’s certificate, issued by “/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert SHA2 High Assurance Server CA”:
  Unable to locally verify the issuer’s authority.

When I perform the command openssl s_client -showcerts -connect www.facebook.com:443 I receive the answer verify error:num=20:unable to get local issuer certificate, but when I do openssl s_client -CApath /etc/ssl/certs/ -showcerts -connect www.facebook.com:443 it works well.

So I think there's a environment var that is not set, because I can perform certificate checking when I set the path to public keys.

What I need to do in order to fix it?

Thanks in advance!

  • Expired certs and expired protocols...time to upgrade, no? – Rui F Ribeiro Jun 13 '18 at 7:00
  • @RuiFRibeiro, my fault! I'll do that. :) – LucasBr Jun 13 '18 at 10:40
  • Use update-ca-certificates --fresh command then check if the error persist ? – GAD3R Jun 13 '18 at 11:22
  • Is dir defined in your openssl.cnf? That's what -CApath overrides. – JigglyNaga Jun 13 '18 at 12:53
  • @JigglyNaga+ not for s_client, which should use only commandline options or envvars SSL_CERT_DIR SSL_CERT_FILE or the compile-time default. But this older system might be affected by a bug in OpenSSL upstream until 2015 s_client didn't actually use the default as it should. But that's only for openssl commandline and doesn't explain curl and wget. – dave_thompson_085 Jun 14 '18 at 0:55

You are not dealing with a misconfiguration.

Wheezy is already showing it´s age probably. The certificate CA public root chains might be mostly expired by now, and openssl/libSSL is using obsolete protocols as we speak.

The easiest way to solve that is upgrading to a recent Debian version, also because Wheezy is from 2013 and has been EOL since May 31, 2018. (or put it other way, some people is already planning/testing their migration soon to Debian 10 while Wheezy is 3 versions and 5 years behind)

You can also try using curl -k or wget --no-check-certificate for ignoring the certificate check, it might work.

You might even try to update the certificates as @GAD3R suggests (no idea if it will solve your problem with wheezy), or install the Digicert root CA certificates by hand. (fb certificate is signed with Digicert)

However with such a Debian old version, you will have other security problems and also dealing with SSL down the line, and as such, if you can, you should upgrade it.

  • 1
    The Debian website indicates wheezy uses OpenSSL 1.0.1e (plus security patches, as for all Debian packages), and although 1.0.1 is no longer supported upstream it does implement TLS 1.1 and 1.2, which are not obsolete. – dave_thompson_085 Jun 14 '18 at 1:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.