I'm trying to add a CA certificate to OpenBSD.
- I have copied the
- I have created the
.0file from the certificate (using
openssl x509 -hash -noout -in company.crt)
- I can run
openssl verify -CApath /etc/ssl/private/ company.crtjust fine; result:
However, when I try:
curl -vi https://company.example/ I get:
* Trying 192.168.XXX.XXX... * TCP_NODELAY set * Connected to company.example (192.168.XXX.XXX) port 443 (#0) * ALPN, offering h2 * ALPN, offering http/1.1 * successfully set certificate verify locations: * CAfile: /etc/ssl/cert.pem CApath: none * TLSv1.2 (OUT), TLS handshake, Client hello (1): * TLSv1.2 (IN), TLS handshake, Server hello (2): * TLSv1.2 (IN), TLS handshake, Certificate (11): * TLSv1.2 (OUT), TLS alert, unknown CA (560): * SSL certificate problem: unable to get local issuer certificate * Closing connection 0 curl: (60) SSL certificate problem: unable to get local issuer certificate More details here: https://curl.haxx.se/docs/sslcerts.html curl failed to verify the legitimacy of the server and therefore could not establish a secure connection to it. To learn more about this situation and how to fix it, please visit the web page mentioned above.
From what I gather from the message curl looks at/in
/etc/ssl/cert.pem. I could add the
.crt to that file but a) I don't know what the correct way is and b) won't it get removed whenever I update all Root Certificates? I was hoping I could keep our own certificate(s) in a separate location. I haven't been able to find much on google so far other than that a
.0 file is, apparently, required. But then on how to actually use the certificate is nowhere to be found.
Oh, also, the provided link in the error message (https://curl.haxx.se/docs/sslcerts.html) isn't very helpful.
To be clear, this is what I do on Debian machines which works fine:
- Copy the
chmod 755and the