1

I have a set of keys that authenticate me to some external server. They all use a root CA that's not installed in common distributions.

I am validating if the external server responds, using a Docker image.

This is in GitLab CI script so I am keeping it in that format.

CPI avail Ubuntu:
  stage: checkCpiAvailability
  image: ubuntu:18.04
  script:
    - apt update
    - apt install -y curl wget unzip openssl openssh-client
    - openssl version
    - test/bench/curl/curlRequest.sh

Curl command:

curl -v \
  --cacert "$SCRIPT_DIR/target/....crt" \
  --key "$SCRIPT_DIR/target/temp.$KEY_FILENAME.private.key" \
  --cert "$SCRIPT_DIR/target/temp.$KEY_FILENAME.client.crt:$KEY_PASS2" \
  --header "Content-Type: application/soap+xml; charset=utf-8" \
  --data "@$SCRIPT_DIR/../soapSamples/queryRequest-sampleFromSpec.xml" \
  "$SERVICE_URL" \

When I do it with Ubuntu image, it works.
But when I do the same with Centos 7 image, it fails.

CPI avail Centos7:
  stage: checkCpiAvailability
  image: centos:7
  script:
    - yum -y update
    - yum -y install curl wget unzip openssl openssh-clients
    - openssl version
    - test/bench/curl/curlRequest.sh

Error message:

* unable to load client key: -8178 (SEC_ERROR_BAD_KEY)
* NSS error -8178 (SEC_ERROR_BAD_KEY)
* Peer's public key is invalid.
* Closing connection 0
curl: (58) unable to load client key: -8178 (SEC_ERROR_BAD_KEY)

There are questions on SO that solve this error but I wonder whether it's my fault if it's working with the Ubuntu image.

Do I need to install something additional? Or does Centos have some different setup and needs e.g. a passphrase for the keys as I read in one of the answers? How can I make it the same as in Ubuntu?

  • I would use the lower level tool: openssl s_client to troubleshoot what's going on at the SSL/TLS layer. Of course you have to learn how to use it with equivalent options (eg: --cacert <=> -CAfile, --key <=> -key, etc.) – A.B Aug 11 '19 at 13:16
  • The offending CA root is not installed on the one it is not working. – Rui F Ribeiro Aug 11 '19 at 16:57
  • The CA root is not installed on either because it's a CA that's not in the commonly present set. – Ondra Žižka Aug 12 '19 at 8:12
  • What is the key type? Compare the versions of curl and libssl for your two setups. – Patrick Mevzek Aug 16 '19 at 15:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.