How to trust self-signed certificate in cURL command line?

Question

I've created a self-signed certificate for foo.localhost using a Let's Encrypt recommendation using this Makefile:

include ../.env

configuration = csr.cnf
certificate = self-signed.crt
key = self-signed.key

.PHONY: all
all: $(certificate)

$(certificate): $(configuration)
    openssl req -x509 -out $@ -keyout $(key) -newkey rsa:2048 -nodes -sha256 -subj '/CN=$(HOSTNAME)' -extensions EXT -config $(configuration)

$(configuration):
    printf "[dn]\nCN=$(HOSTNAME)\n[req]\ndistinguished_name = dn\n[EXT]\nsubjectAltName=DNS:$(HOSTNAME)\nkeyUsage=digitalSignature\nextendedKeyUsage=serverAuth" > $@

.PHONY: clean
clean:
    $(RM) $(configuration)

I've then assigned that to a web server. I've verified that the server returns the relevant certificate:

$ openssl s_client -showcerts -connect foo.localhost:8443 < /dev/null
CONNECTED(00000003)
depth=0 CN = foo.localhost
verify error:num=20:unable to get local issuer certificate
verify return:1
depth=0 CN = foo.localhost
verify error:num=21:unable to verify the first certificate
verify return:1
---
Certificate chain
 0 s:/CN=foo.localhost
   i:/CN=foo.localhost
-----BEGIN CERTIFICATE-----
[…]
-----END CERTIFICATE-----
---
Server certificate
subject=/CN=foo.localhost
issuer=/CN=foo.localhost
---
No client certificate CA names sent
Peer signing digest: SHA512
Server Temp Key: X25519, 253 bits
---
SSL handshake has read 1330 bytes and written 269 bytes
Verification error: unable to verify the first certificate
---
New, TLSv1.2, Cipher is ECDHE-RSA-AES128-GCM-SHA256
Server public key is 2048 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
    Protocol  : TLSv1.2
    Cipher    : ECDHE-RSA-AES128-GCM-SHA256
    Session-ID: […]
    Session-ID-ctx: 
    Master-Key: […]
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    TLS session ticket:
    […]

    Start Time: 1529622990
    Timeout   : 7200 (sec)
    Verify return code: 21 (unable to verify the first certificate)
    Extended master secret: no
---
DONE

How do I make cURL trust it without modifying anything in /etc? --cacert does not work, presumably because there is no CA:

$ curl --cacert tls/foo.localhost.crt 'https://foo.localhost:8443/'
curl: (60) SSL certificate problem: unable to get local issuer certificate
More details here: https://curl.haxx.se/docs/sslcerts.html

curl failed to verify the legitimacy of the server and therefore could not
establish a secure connection to it. To learn more about this situation and
how to fix it, please visit the web page mentioned above.

The goal is to enable HTTPS during development:

• I can't have a completely production-like certificate without a lot of work to enable DNS verification in all development environments. Therefore I have to use a self-signed certificate.
• I still obviously want to make my development environment as similar as possible to production, so I can't simply ignore any and all certificate issues. curl -k is like catch (Exception e) {} in this case - nothing at all like a browser talking to a web server.

In other words, when running curl [something] https://project.local/api/foo I want to be confident that

1. if TLS is configured properly except for having a self-signed certificate the command will succeed and
2. if I have any issues with my TLS configuration except for having a self-signed certificate the command will fail.

Using HTTP or --insecure fails the second criterion.

Answer 1

Try -k:

curl -k https://yourhost/

It should "accept" self-signed certificates

Answer 2

Following these steps should solve your issue:

1. Download and save the self-signed certificate: echo quit | openssl s_client -showcerts -servername "${API_HOST}" -connect "${API_HOST}":443 > cacert.pem
2. Tell the curl client about it: curl --cacert cacert.pem --location --silent https://${API_HOST}

Also one could use wget and ignore certificates with: wget --no-check-certificate https://${API_HOST}

Answer 3

I had this issue, exact same problem and error messages, but I used GNUTLS's certtool to generate my cert rather than openssl.

My problem was that I had not made my self signed cert a CA. It was only configured to act as a web server cert. Which is all I wanted to do with it and I wasn't going to use it as a CA to sign other certs.

But when you want to add a cert into the trust chain as the Issuer of other certs, that cert must be a CA, or it's rejected by openssl!

With certtool -i < mycert.crt, one needs to see this:

    Extensions:
            Basic Constraints (critical):
                    Certificate Authority (CA): TRUE

Try adding -addext basicConstraints=critical,CA:TRUE,pathlen:1 to your openssl command or modifying your cnf file to the same effect.

Or, use certtool, it's much easier for one-off cert generation:

certtool -p --outfile localhost.key
certtool -s --load-privkey localhost.key --outfile localhost.crt

And then answer the prompts to supply the cert's CN and so on. And say yes when asked if it's for a certificate authority!

Answer 4

The solution provided using trustme works perfectly, but if anyone is interested in creating the certificates for learning purposes, these are the steps that worked for me:

1. Create the root CA:

   openssl req -x509 -sha256 -days 1825 -newkey rsa:2048 -keyout rootCA.key -out rootCA.crt
   

2. Create the server private key:

   openssl genrsa -out localhost.key 2048
   

3. Create the certificate signing request:

   openssl req -key localhost.key -new -out localhost.csr
   

4. Create the localhost.ext file with the following content:

   authorityKeyIdentifier=keyid,issuer
   basicConstraints=CA:FALSE
   subjectAltName = @alt_names
   [alt_names]
   DNS.1 = localhost
   

   This file has the DNS configuration for the certificate. This is important as the TLS check won't pass if the name in the URL doesn't match the DNS in the certificate.

5. Sign the server certificate with the root CA that was created before:

   openssl x509 -req -CA rootCA.crt -CAkey rootCA.key -in localhost.csr -out localhost.crt -days 365 -CAcreateserial -extfile localhost.ext
   

6. Convert the crt files to the pem format:

   openssl x509 -in localhost.crt -out localhost.pem
   openssl x509 -in rootCA.crt -out rootCA.pem
   

Now you should be able to use the localhost.pem and the localhost.key in the server. The client should use the rootCA.pem to connect to the server.

In my case, I had to use a jks file. The pem file can be converted to jks as follows:

//first convert it to pkcs12
openssl pkcs12 -export -in localhost.pem -inkey localhost.key -out serverCertificate.p12 -name "serverCertificate"

//then convert it from pkcs12 to jks
keytool -importkeystore -srckeystore serverCertificate.p12 -srcstoretype pkcs12 -destkeystore localhost.jks

The entries in the keystore can be seen using this command:

keytool -keystore localhost.jks -list

The localhost.jks should be used in the server and the connection can be tested using:

curl --cacert rootCA.pem https://localhost:<port>

References:

1. https://www.baeldung.com/openssl-self-signed-cert
2. https://www.digicert.com/kb/ssl-support/openssl-quick-reference-guide.htm
3. https://www.baeldung.com/convert-pem-to-jks

Answer 5

trustme, used by urllib3, looks like a good option. Per their readme:

$ # ----- Creating certs -----
$ python -m trustme
Generated a certificate for 'localhost', '127.0.0.1', '::1'
Configure your server to use the following files:
  cert=/tmp/server.pem
  key=/tmp/server.key
Configure your client to use the following files:
  cert=/tmp/client.pem
$ # ----- Using certs -----
$ gunicorn --keyfile server.key --certfile server.pem app:app
$ curl --cacert client.pem https://localhost:8000/
Hello, world!

Answer 6

It is not valid to have a trust chain that include a self-signed cert. If that were the case anyone could provide a (made up) valid trust chain. If a self-signed cert appears in a trust chain it must be ignored. A self-signed cert could only be valid in a local directory (controlled by the computer owner). The cert given to any server must be chained to the self-signed cert.

A general guide without most of the little details.

• Your output of the openssl s_client command is showing two errors:

  verify error:num=20:unable to get local issuer certificate
  verify error:num=21:unable to verify the first certificate
  

  That means that the default cert store in your machine is missing a cert that validates the chain given from the web site you used. You need a directory with a self-signed cert and a cert chained to that for the web server.

Steps:

1. You could build a new directory (anywhere), process it with the c_rehash script and tell openssl to use it to verify the certs with the option -CApath Directory. Make changes until you get rid of both errors while using the -CApath option.

2. Generate a chained cert for the web server.

3. Then, tell curl about the certificate directory with:

   curl --capath <dir>
   

   and all the other options needed.

That will clear both errors.

Answer 7

If you save off the self-signed.crt from your server, you can pass it to curl via "--cacert self-signed.crt" and curl will validate the certificate of your server using the given CA Cert.