System: Ubuntu 14.04, apt-upgrade
d to the latest. openssl, ca-certificates, wget installed
Symptoms:
wget https://api.xxx.io
will result in this error:
ERROR: cannot verify api.xxx.io's certificate, issued by '/C=US/ST=Arizona/L=Scottsdale/O=GoDaddy.com, Inc./OU=http://certs.godaddy.com/repository//CN=Go Daddy Secure Certificate Authority - G2':
Unable to locally verify the issuer's authority.
To connect to api.xxx.io insecurely, use `--no-check-certificate'.
Where as wget https://google.com
works fine.
openssl s_client -connect api.xxx.io:443
results in this:
CONNECTED(00000003)
depth=3 C = US, O = "The Go Daddy Group, Inc.", OU = Go Daddy Class 2 Certification Authority
verify error:num=19:self signed certificate in certificate chain
verify return:0
I attempted to reinstall godaddy's root certificate:
- downloaded their ca cert crt bundle to
/usr/share/ca-certificates/extra
- ran
dpkg-reconfigure ca-certificates
and followd the prompts.
No luck.
also tried c_rehash
with no luck.
This site gets successfully verified on an ubuntu 16 system. Anything else I should try?
edit:
running strace -e open openssl s_client -connect api.xxx.io:443
shows that it isn't even opening ca-certificates.crt:
open("/etc/ld.so.cache", O_RDONLY|O_CLOEXEC) = 3
open("/lib/x86_64-linux-gnu/libssl.so.1.0.0", O_RDONLY|O_CLOEXEC) = 3
open("/lib/x86_64-linux-gnu/libcrypto.so.1.0.0", O_RDONLY|O_CLOEXEC) = 3
open("/lib/x86_64-linux-gnu/libc.so.6", O_RDONLY|O_CLOEXEC) = 3
open("/lib/x86_64-linux-gnu/libdl.so.2", O_RDONLY|O_CLOEXEC) = 3
open("/usr/lib/ssl/openssl.cnf", O_RDONLY) = 3
open("/proc/meminfo", O_RDONLY|O_CLOEXEC) = 3
open("/dev/urandom", O_RDONLY|O_NOCTTY|O_NONBLOCK) = 3
open("/etc/resolv.conf", O_RDONLY|O_CLOEXEC) = 3
open("/etc/resolv.conf", O_RDONLY|O_CLOEXEC) = 3
open("/etc/nsswitch.conf", O_RDONLY|O_CLOEXEC) = 3
open("/etc/ld.so.cache", O_RDONLY|O_CLOEXEC) = 3
open("/lib/x86_64-linux-gnu/libnss_files.so.2", O_RDONLY|O_CLOEXEC) = 3
open("/etc/host.conf", O_RDONLY|O_CLOEXEC) = 3
open("/etc/hosts", O_RDONLY|O_CLOEXEC) = 3
open("/etc/ld.so.cache", O_RDONLY|O_CLOEXEC) = 3
open("/lib/x86_64-linux-gnu/libnss_dns.so.2", O_RDONLY|O_CLOEXEC) = 3
open("/lib/x86_64-linux-gnu/libresolv.so.2", O_RDONLY|O_CLOEXEC) = 3
edit 2:
If I pass the CApath to openssl, it works.
openssl s_client -connect api.xxx.io:443 -showcerts -CApath /etc/ssl/certs
I've tried editing openssl.cnf and using the environment variable overrides and it still won't work otherwise.
edit3: updated the question with a single host rather than 2 different hosts with 2 different certs.